> This page is for Financial Rider Flow.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://infonite.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://infonite.dev/_mcp/server.

# On Consent Submitted

POST 

Triggered when your customer consents to what the session will read. From this point their banks may be connected on their behalf.

**This is the event to store.** `data` carries what was agreed and the proof of it: `accepted_features` is the scope granted, `accepted_documents` the version and hash of every text accepted — with the moment it was signed, for a document that asked for a signature —, and the address, the agent and the timestamp say from where and when.

A session created with `consent_level: none` shows no consent screen and sends no consent event: you collected the consent yourself, and you answer for it.

**The schema below describes `data` decrypted — on purpose**, so this reference has a model you can read and code against. What arrives at your endpoint depends on how the session was created:

* **With an `aes_key`**: `data` is a single string, `aes::Base64(IV + Ciphertext + Tag)`. Decrypt it and you get exactly the object documented below. The walkthrough and the code are in [Payload Encryption](/guides/payload-encryption).
* **Without an `aes_key`**: `data` is **not in the body at all** — absent, not `null`. Read the consent from [Get Session Results](https://infonite.dev/flows/financial-rider/api-reference/financial-rider-api/sessions-results/flows-financial-rider-v-1-session-results).

**Answer `2xx` as soon as the payload reaches you**, whatever your processing does with it afterwards: any other status is recorded as a failed delivery even though the event arrived. [Answering a delivery](/guides/webhooks#answering-a-delivery) has the handler to copy.

Reference: https://infonite.dev/flows/financial-rider/api-reference/financial-rider-api/webhooks/webhook-financial-rider-consent

## Request

### Payload

- `event_class` ("FinancialRiderV1FlowEvent", required) — Payload class discriminator — always this value for Financial Rider events.
- `app_id` (string, required)
- `customer_id` (string, required)
- `session_id` (string, required)
- `producer` ("financial-rider", required) — The flow that produced the event.
- `event` ("financial-rider:consent", required) — The event type: `consent`.
- `status_code` (enum, required) — Describes the status of a flow.
  - Allowed values: `READY`, `WAITING`, `COMPLETED`, `FAILED`, `SYSTEM_CANCELLED`, `CLIENT_CANCELLED`, `CUSTOMER_CANCELLED`, `TIMED_OUT`, `CONFIGURATION_ERROR`
- `date` (string, optional)
- `status_message` (string, optional, nullable)
- `data` (ConsentOutput, optional) — What your customer agreed to, and the proof of it — the same object the results publish as `consent`. Documented decrypted: on the wire it is the `aes::…` string of this object when the session carries an `aes_key`, and absent when it does not.

## Types

### ConsentOutput

What the end user consented to, and from where.

- `accepted_date` (string, required) — When the end user consented.
- `accepted_features` (list of enum, required) — What they authorized the session to read.
  - Allowed values: `accounts_read`, `cards_read`, `deposits_read`, `loans_read`, `credits_read`, `investment_accounts_read`, `funds_read`, `stocks_read`, `pensions_read`, `accounts_certificates`, `direct_debits_read`, `customer_information_read`, `source_contracts_read`, `cloud_resource_read`, `supplier_invoices_read`, `client_invoices_read`, `labor_check`, `public_pensions`, `public_document_verification`, `yearly_individual_tax`, `vehicles_data`, `driver_data`, `academic_data`, `properties_data`, `credit_registry_data`
- `user_ip` (string, optional) — The IP address of the device they consented from.
- `user_agent` (string, optional) — The browser they consented from.
- `origin` (string, optional) — The page the widget was embedded in.
- `accepted_documents` (map from string to AcceptedDocumentSchema, optional, default: {}) — The documents shown on the consent screen, by slot, each with the exact version and digest the end user was shown. Empty when your application shows none.

### AcceptedDocumentSchema

- `version` (string, required) — The version of the document the end user was shown.
- `hash` (string, required) — The SHA-256 digest of its exact text.
- `sign_date` (string, optional) — When the end user signed it, to the minute. Absent for a document only presented and accepted with the consent.
- `signature_provider` (string, optional) — How it was signed. Absent for a document only presented.