Revoke a consent via the API

Revoking a consent ends data sharing for a specific connection. Once revoked, Fiskil no longer syncs data for that consent, and in Australia (CDR) your application must delete the associated CDR data.

How to revoke a consent

1. If you don't have the consent's arrangement ID, list the user's consents first:

   GET /consent?end_user_id={end_user_id}

   The response returns the user's consents, including each consent's arrangement ID, institution, and status. Use this to identify which consent to revoke.

2. Call the revoke endpoint with the arrangement ID:

   DELETE /consent/{arrangement_id}

3. On success, the API returns HTTP 204 No Content.

This revokes the consent both in Fiskil's system and at the data holder (the bank or energy retailer), which is notified through the standard arrangement-deletion process. See the API reference for full request and response schemas.

What happens after revocation

• The consent.revoked webhook fires.
• Data syncing for that consent stops immediately.
• Data already synced remains accessible via the API until your application deletes it.
• In Australia (CDR), you're required to delete all CDR data associated with the revoked consent.

A revoked consent cannot be reinstated. If the user wants to reconnect the same institution, they must go through the consent flow again to create a new consent.

Revoke a consent vs delete an end user

Revoking a consent removes access for one connection while preserving the end user record and any other active consents. To fully remove a user and all their data from Fiskil, delete the end user instead:

DELETE /end-users/{id}

This revokes all of the user's active consents and deletes the end user record.

If revocation fails

If the data holder returns an error during revocation, Fiskil still marks the consent as revoked and stops syncing data for it. The arrangement at the data holder may remain active temporarily. Contact Fiskil Support if you need to confirm the status of a revocation.