fepli
API resources

Consents

A consent (Einwilligung) records that a family or an organiser agreed to something: a consent form of an edition or an offer, such as permission to take photos, or the general terms. Consents can expire and can be revoked.

All consent endpoints need ROLE_ADMIN.

  • Name
    uuid
    Type
    string
    Description

    The consent's identifier.

  • Name
    type
    Type
    string
    Description

    form_consent for a consent to a form of an edition or an offer, consent for the general one.

  • Name
    form
    Type
    object
    Description

    For consents to a form: the form's uuid, its title, its subject (who it is collected for: participant, account or host), compulsory (compulsory, opt-in, opt-out or force_decision) and its text.

  • Name
    account
    Type
    reference
    Description

    The account that gave the consent.

  • Name
    participant
    Type
    reference
    Description

    The participant the consent is for.

  • Name
    offer
    Type
    reference
    Description

    The offer the consent is for.

  • Name
    edition
    Type
    reference
    Description

    The edition the consent is for.

  • Name
    decision
    Type
    integer
    Description

    1 if consent was given, 0 if it was declined.

  • Name
    signedAt
    Type
    timestamp
    Description

    When the consent was given.

  • Name
    signedBy
    Type
    string
    Description

    Who signed, where it was recorded: a guardian signing through the consent link, or a colleague recording the consent in the admin. After a revocation through the API, the name of the person or service account who revoked it.

  • Name
    revokedAt
    Type
    timestamp
    Description

    When the consent was revoked.

  • Name
    validUntil
    Type
    timestamp
    Description

    When the consent expires.

  • Name
    valid
    Type
    boolean
    Description

    Whether the record is in effect: not revoked and not expired. Check decision as well: a declined consent can be valid too.

  • Name
    createdAt
    Type
    timestamp
    Description

    When the record was created.

GET/consents

List all consents

Returns a page of consents, newest first.

Optional filters

  • Name
    account
    Type
    string
    Description

    Only consents of this account (UUID or e-mail address).

  • Name
    participant
    Type
    string
    Description

    Only consents for this participant (UUID).

  • Name
    offer
    Type
    string
    Description

    Only consents to forms of this offer (UUID).

  • Name
    edition
    Type
    string
    Description

    Only consents to forms of this edition (UUID or alias).

  • Name
    revoked
    Type
    boolean
    Description

    true for revoked consents only, false to leave them out.

  • Name
    page, itemsPerPage
    Type
    integer
    Description

    See Pagination.

Request

GET·/consents
curl -G https://ferienpass-musterstadt.de/api/consents \
  -H "Authorization: Bearer $FEPLI_TOKEN" \
  --data-urlencode "account=familie.mueller@example.org" \
  -d revoked=false

Response

[
  {
    "uuid": "0192d0e9-6d7e-7f80-9a1b-2c3d4e5f6a31",
    "type": "form_consent",
    "form": {
      "uuid": "01913e5e-8b9c-7d0e-9f1a-2b3c4d5e6f32",
      "title": "Fotoerlaubnis",
      "subject": "participant",
      "compulsory": "opt-in",
      "text": "Ich bin damit einverstanden, dass Fotos meines Kindes …"
    },
    "account": {
      "uuid": "0191c7b2-4d5e-7f60-8a1b-2c3d4e5f6a05",
      "name": "Anna Müller"
    },
    "participant": {
      "uuid": "0191c7b3-1f2a-7c4d-8e5f-6a7b8c9d0e06",
      "name": "Lena Müller"
    },
    "edition": {
      "uuid": "01913e5c-2b4a-7d10-9f3e-6a1c2e7b4d01",
      "name": "Herbstferien 2026",
      "alias": "herbstferien-2026"
    },
    "decision": 1,
    "signedAt": "2026-09-01T08:02:57+02:00",
    "signedBy": "Anna Müller",
    "valid": true,
    "createdAt": "2026-09-01T08:02:57+02:00"
  }
]
GET/consents/{uuid}

Returns one consent.

Request

GET·/consents/{uuid}
curl https://ferienpass-musterstadt.de/api/consents/0192d0e9-6d7e-7f80-9a1b-2c3d4e5f6a31 \
  -H "Authorization: Bearer $FEPLI_TOKEN"
POST/consents/{uuid}/revoke

Revokes a consent on the family's behalf, for example after they sent a signed paper form. The request has no body. Returns the revoked consent.

A consent that is already revoked can't be revoked again (409).

Request

POST·/consents/{uuid}/revoke
curl -X POST https://ferienpass-musterstadt.de/api/consents/0192d0e9-6d7e-7f80-9a1b-2c3d4e5f6a31/revoke \
  -H "Authorization: Bearer $FEPLI_TOKEN"
DELETE/consents/{uuid}

Deletes a consent record. Responds with 204 No Content. To withdraw consent but keep the record of it, revoke it instead.

Request

DELETE·/consents/{uuid}
curl -X DELETE https://ferienpass-musterstadt.de/api/consents/0192d0e9-6d7e-7f80-9a1b-2c3d4e5f6a31 \
  -H "Authorization: Bearer $FEPLI_TOKEN"

Was this page helpful?