Understand consent renewal events

You may receive a consent.updated webhook event for an end user when their consent is renewed. This article explains what triggers these events and how to handle them.

What is a consent renewal?

A consent renewal extends or re-authorises an existing consent before it expires, so data sharing continues without interruption. In Australia (CDR), this means the existing consent arrangement with the data holder is extended rather than replaced. The end user must confirm the renewal through the data holder's own interface.

Who initiates renewals?

Renewals are initiated by your application — Fiskil does not initiate renewals on behalf of end users. The consumer dashboard Fiskil provides to end users lets them view or revoke their consents; it does not currently offer a renewal option. If you want users to renew, your app needs to prompt them and start the renewal flow before the consent expires.

How renewals are surfaced

When an end user completes a renewal, Fiskil processes the updated consent and sends a consent.updated webhook to your endpoint with the new consent details, including the updated expiry date. The event payload identifies the consent, end user, and institution, so you can match it to your records. Because the renewal was initiated by your application, the event reflects a programmatic update rather than a change made by Fiskil or through the Fiskil Console.

See the webhooks guide for the full payload format and event types.

What to do when you receive a consent.updated event

1. Read the consent's new status and expiry date from the event payload.
2. Update your records so your app reflects the new expiry.
3. If the consent was renewed, continue accessing the user's data as normal — access now runs until the new expiry date.