Remove a duplicate consent

If an end user has connected the same institution more than once, they can end up with multiple active consents for the same accounts. This article explains how to identify and resolve duplicates.

Why duplicates occur

Duplicate consents happen when a user completes the connection flow more than once for the same institution and the same set of accounts — for example, reconnecting after thinking their first attempt failed. Each completed flow creates a separate consent with its own arrangement ID.

Identify duplicate consents

1. List the user's consents:

   GET /consent?end_user_id={end_user_id}

2. Look for two or more consents that share the same institution and are both in an active status.

3. To confirm they cover the same accounts, compare the accounts returned for each consent:

   • Banking: GET /v1/banking/accounts
   • Energy: GET /v1/energy/accounts

If the institution and accounts match, the consents are duplicates.

Revoke the duplicate

You have a few options:

• Ask the end user to revoke it through the consumer consent dashboard, where they can view and revoke their own consents.
• Revoke it via the API — call DELETE /consent/{arrangement_id} with the duplicate consent's arrangement ID. See Revoke a consent via the API for the full steps.
• Contact Fiskil Support if you'd like the team to handle the revocation for you.

Revoking a consent triggers a consent.revoked webhook, and in Australia (CDR) you're required to delete the CDR data associated with the revoked consent.

Which consent should you keep?

Generally, keep the most recently created consent — it carries the most up-to-date authorisation — and revoke the older one.

To understand why duplicates cause repeated webhooks and higher costs, see Multiple active consents.