> This page is for Spain Public Administration Flow.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://infonite.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://infonite.dev/_mcp/server.

# On Consent Submitted

POST 

Triggered when your customer accepts the consent and the legal documents shown in the widget. From this point the sources may be queried on their behalf.

**This is the event to store.** `data` carries what was agreed and the proof of it: `accepted_features` is the scope granted, `accepted_documents` the exact version and hash of every text accepted, and the address, the agent and the timestamp say from where and when.

An application that shows no documents of its own on our screen sends `accepted_documents` empty. Consent is the **act**; the documents are what the application had to show.

**The schema below describes `data` decrypted — on purpose**, so this reference has a model you can read and code against. What arrives at your endpoint depends on how the session was created:

* **With an `aes_key`**: `data` is a single string, `aes::Base64(IV + Ciphertext + Tag)`. Decrypt it and you get exactly the object documented below. The walkthrough and the code are in [Payload Encryption](/guides/payload-encryption).
* **Without an `aes_key`**: `data` is **not in the body at all** — absent, not `null`. Somebody's records are never put on the wire unencrypted, so the event tells you what happened and you read the content from [Get Session Results](https://infonite.dev/flows/spain-public-administration/api-reference/spain-public-administration-api/sessions-results/flows-es-public-administration-v-1-session-results) when it arrives.

**Answer `2xx` as soon as the payload reaches you**, whatever your processing does with it afterwards: any other status is recorded as a failed delivery even though the event arrived. [Answering a delivery](/guides/webhooks#answering-a-delivery) has the handler to copy.

Reference: https://infonite.dev/flows/spain-public-administration/api-reference/spain-public-administration-api/webhooks/webhook-es-public-administration-consent

## Request

### Payload

- `event_class` ("EsPublicAdministrationV1FlowEvent", required) — Payload class discriminator — always this value for Spain Public Administration events.
- `app_id` (string, required)
- `customer_id` (string, required)
- `session_id` (string, required)
- `producer` ("es-public-administration", required) — The flow that produced the event.
- `event` ("es-public-administration:consent", required) — The event type: `consent`.
- `status_code` (enum, required) — Describes the status of a flow.
  - Allowed values: `READY`, `WAITING`, `COMPLETED`, `FAILED`, `SYSTEM_CANCELLED`, `CLIENT_CANCELLED`, `CUSTOMER_CANCELLED`, `TIMED_OUT`, `CONFIGURATION_ERROR`
- `date` (string, optional)
- `status_message` (string, optional, nullable)
- `data` (catgrid_flows__flows__es_public_administration__v1__machine__out__ConsentOutput__Out, optional) — What the customer agreed to, and the proof of it. Documented decrypted: on the wire it is the `aes::…` string of this object when the session carries an `aes_key`, and absent when it does not.

## Types

### catgrid_flows__flows__es_public_administration__v1__machine__out__ConsentOutput__Out

Consent and documents accepted by the customer.

- `accepted_features` (list of enum, required)
  - Allowed values: `accounts_read`, `cards_read`, `deposits_read`, `loans_read`, `credits_read`, `investment_accounts_read`, `funds_read`, `stocks_read`, `pensions_read`, `accounts_certificates`, `direct_debits_read`, `customer_information_read`, `source_contracts_read`, `cloud_resource_read`, `supplier_invoices_read`, `client_invoices_read`, `labor_check`, `public_pensions`, `public_document_verification`, `yearly_individual_tax`, `vehicles_data`, `driver_data`, `academic_data`, `properties_data`, `credit_registry_data`
- `accepted_date` (string, optional)
- `user_ip` (string, optional)
- `user_agent` (string, optional)
- `origin` (string, optional)
- `user_phone` (string, optional)
- `user_email` (string, optional)
- `user_full_name` (string, optional)
- `user_identification` (_IdentificationNumberDto, optional) — An identification number with autodetection: validating a PLAIN STRING picks the best-matching type and runs its stdnum validator; the after-validator then recomputes `validated` and `country` from the type — never trust them as input.
- `accepted_documents` (map from string to Out-Output, optional)

### _IdentificationNumberDto

An identification number with autodetection: validating a PLAIN STRING picks the best-matching type and runs its stdnum validator; the after-validator then recomputes `validated` and `country` from the type — never trust them as input.

- `value` (string, required) — The number, cleaned; normalized by the type's stdnum validator when it passes.
- `type` (enum, optional, default: unknown) — Types of identification numbers Allowed values are: - `unknown`: Unknown/Unspecified - `es:dni`: Spanish DNI - `es:nie`: Spanish NIE - `es:cif`: Spanish CIF - `es:ssn`: Spanish Social Security Number - `co:cc`: Colombian Cédula de Ciudadanía - `co:ce`: Colombian Cédula de Extranjería - `co:nit`: Colombian NIT - `co:ti`: Colombian Tarjeta de Identidad
  - Allowed values: `unknown`, `es:dni`, `es:nie`, `es:cif`, `es:ssn`, `co:cc`, `co:ce`, `co:nit`, `co:ti`
- `validated` (boolean, optional, default: false) — True when `value` passed the stdnum validation for `type`. ALWAYS recomputed by the after-validator — assigning it manually has no effect.
- `country` (string, optional, nullable) — Derived from `type` (forced by the after-validator); None for `unknown`.
- `valid_until` (date, optional, nullable)

### Out-Output

- `version` (string, required) — The version tag of the document template accepted.
- `hash` (string, optional) — SHA-256 hash of the document content or template for integrity checks.
- `sign_date` (string, optional) — Date and time when the document was signed digitally, or None if not signed.
- `signature_provider` (string, optional) — The signature service used (e.g., 'yousign', 'signaturit', 'internal').
- `signature_metadata` (map from string to any, optional) — Arbitrary dictionary to store signature-specific identifiers, transaction tokens, or provider callback payloads.