Capture consent
Goal: record a data principal's §6 consent against a versioned notice, with affirmative action and the right lawful basis — producing a tamper-evident §6(10) receipt.
1. Begin (get a nonce)
From the browser with your publishable key, or your server with a secret key:
curl -X POST $API/v1/public/consent/begin \
-H "authorization: Bearer pk_live_…" \
-d '{"principalId":"user-123","noticeId":"n1","version":1,"language":"hi"}'
# → { "nonce": "…" }2. Capture
Submit the affirmative choice + the nonce. The lawful basis must be consent on this endpoint (a §7/§17 basis is recorded elsewhere — it is never mislabeled as consent).
curl -X POST $API/v1/public/consent/capture \
-H "authorization: Bearer pk_live_…" \
-d '{
"principalId":"user-123","noticeId":"n1","version":1,"language":"hi",
"nonce":"…","affirmativeAction":true,
"lawfulBasis":{"kind":"consent"},
"selectedPurposes":["marketing-email"],
"ageBand":"adult","requestId":"r-001"
}'
# → { "receipt": { "seq": 7, "purposes": ["marketing-email"], "hash": "…" }, "blocked": [] }3. Verify it later
curl -X POST $API/v1/admin/principal-trail -H "authorization: Bearer sk_live_…" \
-d '{"principalId":"user-123"}'§9 children: if the principal is a child, the §9(3) restricted purposes are dropped (returned in
blocked) and a verifiable parental-consent proof is required. The server-trusted age verdict (from /v1/age/verify) overrides any client-asserted age.