API reference
Bank Consents
Generated HTTP reference for the 1 operation the published OpenAPI document describes under bank-consents.
2 min read
Bank Consents
This page is generated from the published OpenAPI document. It is complete with respect to that document and says nothing about surfaces the document does not describe yet. See what is generated here for what that means.
Base URL: https://api.codespar.dev
Every operation below requires a Bearer token. See Authentication.
GET /v1/bank-consents/{id}
Read one bank consent
Path parameters
| Name | Type | Required | Description |
|---|---|---|---|
id | string | yes | ofb_-prefixed consent id. |
Responses
| Status | Body | Description |
|---|---|---|
200 | object | OK |
404 | object | Not Found. No consent with this id in the caller's project. A consent belonging to another project in the same organization answers here too. |
Response 200
| Field | Type | Required | Description |
|---|---|---|---|
authorisation_url | string,null | yes | The URL the consumer opens to authorise the consent at their bank. |
authorized_at | string,null (date-time) | yes | American spelling here, unlike status: "authorised"; both mirror their own column names. Stamped in the same statement as the transition into authorised. |
bank_consent_id | string,null | yes | The bank's own identifier for the consent, as returned when it was opened. |
bank_id | string | yes | Lowercase kebab-case, as supplied when the consent was opened: itau, bradesco, bb, inter. |
consumed_at | string,null (date-time) | yes | — |
consumer_id | string | yes | The consumer, in the caller's own namespace. |
created_at | string (date-time) | yes | — |
expires_at | string,null (date-time) | yes | Mirror of the bank-side consent expiry, stamped when the consent is opened. |
id | string | yes | ofb_-prefixed. The id every other operation in this family takes. |
metadata | object | yes | — |
revoked_at | string,null (date-time) | yes | — |
scopes | array of string | yes | The OFB scopes the consent was opened for. |
status | "pending" | "authorised" | "revoked" | "expired" | "consumed" | yes | authorised carries the British spelling, which is the column's own and not a typo. revoked, expired and consumed are terminal: no transition leaves them. Read "is this consent usable now" from status being authorised, never from revoked_at being null. |
token_expires_at | string,null (date-time) | yes | Expiry of the bank access token. The token references themselves are never returned by this API. |
wallet_id | string,null | yes | The wallet named on the create request, or null. Written once at creation and never rewritten: neither state transition on this consent touches the column. It is a label, not routing. A statement refresh copies this value onto every event it ingests, and nothing downstream reads it: reconciliation resolves a wallet from the funding source behind an event's connection_id, and the events this family publishes carry no such key. Binding a consent to a wallet therefore does not, on its own, put the ingested statement into that wallet's reconciliation. |
Example response
{
"id": "obj_0000000000000000",
"bank_id": "bank_0000000000000000",
"consumer_id": "csm_0000000000000000",
"status": "pending",
"scopes": [
"string"
],
"created_at": "2026-01-15T12:00:00.000Z",
"metadata": {}
}Example request
curl -X GET https://api.codespar.dev/v1/bank-consents/{id} \
-H "Authorization: Bearer $CODESPAR_API_KEY"