Manage multiple active consents for the same institution

An end user can hold more than one active consent at a time — including multiple consents for the same institution. While technically possible, duplicate consents for the same institution cause several problems and are best avoided.

How Fiskil handles multiple consents

Fiskil treats the end user as the anchor for their data. When multiple consents exist for the same institution and end user, data is retrieved for each active consent independently. This means:

• Sync webhooks can fire multiple times for the same underlying data — once per consent.
• You may receive duplicate webhook events without any change in the user's actual data.
• Costs accrue per active consent, so duplicates increase your consumption.

The data returned by the Data API (accounts, transactions, usage) is the combined view across the user's active consents — it is not duplicated. The consent_id field in webhook payloads identifies which consent triggered each event.

Problems caused by duplicates

If a user has two active consents for the same energy retailer, each consent independently triggers syncs — so you may see the same sync webhook fire repeatedly, referencing the same underlying data. And because each active consent is billed separately, duplicates directly increase your monthly consumption.

Prevent and fix duplicates

Best practice is to hold one active consent per institution per end user:

1. Before starting a new consent flow, list the user's existing consents with GET /consent?end_user_id={end_user_id} (use the active filter) and check for an active consent at the same institution.
2. If the user is reconnecting the same accounts, revoke the existing consent first — call DELETE /consent/{arrangement_id} or revoke it from the Fiskil Console — then let them create a fresh consent. See Revoke a consent via the API.
3. If a consent is approaching expiry, renew it rather than creating a second one. See Understand consent renewal events.

If you're already seeing repeated webhooks from duplicates, revoke the extras and allow up to 24 hours for sync activity to normalise.