# System Consent

**Summary:** Endpoints for System Consent

- Role: [Developers](https://www.subrite.no/developers)
- Source: https://www.subrite.no/developers/system-consent
- Updated: 2026-10-20
- Markdown index: https://www.subrite.no/developers/llms.txt

<a id="get-api-v1-members-profile-system-consents"></a>
## Get the signed-in member's system consents

`GET /api/v1/members/profile/system-consents`

**Authentication:** Bearer token (JWT)

### Responses

#### 200

Content type: `application/json` · `array of SystemConsentDto`

| Name | Type | Description |
| --- | --- | --- |
| `[].areaId` (Required when parent is present) | `string` | GDPR self-assessment area id, e.g. "podcast" |
| `[].group` (Required when parent is present) | `string` | Allowed values: `"communication"`, `"activity"`, `"profile"` |
| `[].legalBasis` (Required when parent is present) | `string` | Null until the tenant has completed the GDPR self-assessment · Allowed values: `"legitimate_interests"`, `"consent"` · Can be null |
| `[].status` (Required when parent is present) | `string` | not\_set when the member never changed the answer · Allowed values: `"accepted"`, `"withdrawn"`, `"not_set"` |
| `[].allowed` (Required when parent is present) | `boolean` | Whether the processing is allowed for this member right now |
| `[].updatedAt` (Required when parent is present) | `string (date-time)` | Can be null |

#### 401

Content type: `application/json` · `ErrorResponse`

unauthorized

| Name | Type | Description |
| --- | --- | --- |
| `messageCode` (Required) | `string` |   |
| `message` | `string` |   |
| `errors` (Required) | `array of FieldError` |   |
| `errors[].field` (Required when parent is present) | `string` |   |
| `errors[].fieldValue` (Required when parent is present) | `string` |   |
| `errors[].identifier` (Required when parent is present) | `string` |   |
| `errors[].identifierValue` (Required when parent is present) | `string` |   |
| `errors[].messageCode` (Required when parent is present) | `string` |   |
| `errors[].message` | `string` |   |
| `errors[].errorType` (Required when parent is present) | `string` |   |

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 403

Content type: `application/json` · `ErrorResponse`

forbiddenResource

Same fields as [Get the signed-in member's system consents (401)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

#### 404

Content type: `application/json` · `ErrorResponse`

memberNotFound

| Name | Type | Description |
| --- | --- | --- |
| `messageCode` (Required) | `string` | Allowed values: `"memberNotFound"` |
| `message` | `string` |   |
| `errors` (Required) | `array of FieldError` |   |
| `errors[].field` (Required when parent is present) | `string` |   |
| `errors[].fieldValue` (Required when parent is present) | `string` |   |
| `errors[].identifier` (Required when parent is present) | `string` |   |
| `errors[].identifierValue` (Required when parent is present) | `string` |   |
| `errors[].messageCode` (Required when parent is present) | `string` |   |
| `errors[].message` | `string` |   |
| `errors[].errorType` (Required when parent is present) | `string` |   |

**Example response**

`application/json`

```json
{
  "messageCode": "memberNotFound",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the signed-in member's system consents (401)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

### Example request

```bash
curl https://api.subrite.no/api/v1/members/profile/system-consents \
  --header 'Authorization: Bearer <token>'
```

### Example response

200 · `application/json`

```json
[
  {
    "areaId": "string",
    "group": "communication",
    "legalBasis": "legitimate_interests",
    "status": "accepted",
    "allowed": true,
    "updatedAt": "2019-08-24T14:15:22Z"
  }
]
```

<a id="put-api-v1-members-profile-system-consents-areaid"></a>
## Set the signed-in member's answer to one system consent

`PUT /api/v1/members/profile/system-consents/{areaId}`

**Authentication:** Bearer token (JWT)

### Parameters

| Name | In | Type | Description |
| --- | --- | --- | --- |
| `areaId` (Required) | path | `string` |   |

### Request body

Content type: `application/json` · Required · `UpdateSystemConsentDto`

| Name | Type | Description |
| --- | --- | --- |
| `status` (Required) | `string` | Allowed values: `"accepted"`, `"withdrawn"` |
| `reference` | `string` | Where the change was made, e.g. the page URL · `maxLength`: `1000` · Can be null |

**Example request body**

`application/json`

```json
{
  "status": "accepted",
  "reference": "string"
}
```

### Responses

#### 200

Content type: `application/json` · `SystemConsentDto`

| Name | Type | Description |
| --- | --- | --- |
| `areaId` (Required) | `string` | GDPR self-assessment area id, e.g. "podcast" |
| `group` (Required) | `string` | Allowed values: `"communication"`, `"activity"`, `"profile"` |
| `legalBasis` (Required) | `string` | Null until the tenant has completed the GDPR self-assessment · Allowed values: `"legitimate_interests"`, `"consent"` · Can be null |
| `status` (Required) | `string` | not\_set when the member never changed the answer · Allowed values: `"accepted"`, `"withdrawn"`, `"not_set"` |
| `allowed` (Required) | `boolean` | Whether the processing is allowed for this member right now |
| `updatedAt` (Required) | `string (date-time)` | Can be null |

#### 400

Content type: `application/json` · `ErrorResponse`

invalidSystemConsent, invalidFormat

| Name | Type | Description |
| --- | --- | --- |
| `messageCode` (Required) | `string` | Allowed values: `"invalidSystemConsent"`, `"invalidFormat"` |
| `message` | `string` |   |
| `errors` (Required) | `array of FieldError` |   |
| `errors[].field` (Required when parent is present) | `string` |   |
| `errors[].fieldValue` (Required when parent is present) | `string` |   |
| `errors[].identifier` (Required when parent is present) | `string` |   |
| `errors[].identifierValue` (Required when parent is present) | `string` |   |
| `errors[].messageCode` (Required when parent is present) | `string` |   |
| `errors[].message` | `string` |   |
| `errors[].errorType` (Required when parent is present) | `string` |   |

**Example response**

`application/json`

```json
{
  "messageCode": "invalidSystemConsent",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 401

Content type: `application/json` · `ErrorResponse`

unauthorized

Same fields as [Get the signed-in member's system consents (401)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 403

Content type: `application/json` · `ErrorResponse`

forbiddenResource

Same fields as [Get the signed-in member's system consents (401)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

#### 404

Content type: `application/json` · `ErrorResponse`

memberNotFound

Same fields as [Get the signed-in member's system consents (404)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

**Example response**

`application/json`

```json
{
  "messageCode": "memberNotFound",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the signed-in member's system consents (401)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

### Example request

```bash
curl 'https://api.subrite.no/api/v1/members/profile/system-consents/{areaId}' \
  --request PUT \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "status": "accepted",
  "reference": "string"
}'
```

### Example response

200 · `application/json`

```json
{
  "areaId": "string",
  "group": "communication",
  "legalBasis": "legitimate_interests",
  "status": "accepted",
  "allowed": true,
  "updatedAt": "2019-08-24T14:15:22Z"
}
```

<a id="get-api-v1-members-id-system-consents"></a>
## Get a member's system consents

`GET /api/v1/members/{id}/system-consents`

**Authentication:** Bearer token (JWT)

### Parameters

| Name | In | Type | Description |
| --- | --- | --- | --- |
| `id` (Required) | path | `string` |   |

### Responses

#### 200

Content type: `application/json` · `array of SystemConsentDto`

| Name | Type | Description |
| --- | --- | --- |
| `[].areaId` (Required when parent is present) | `string` | GDPR self-assessment area id, e.g. "podcast" |
| `[].group` (Required when parent is present) | `string` | Allowed values: `"communication"`, `"activity"`, `"profile"` |
| `[].legalBasis` (Required when parent is present) | `string` | Null until the tenant has completed the GDPR self-assessment · Allowed values: `"legitimate_interests"`, `"consent"` · Can be null |
| `[].status` (Required when parent is present) | `string` | not\_set when the member never changed the answer · Allowed values: `"accepted"`, `"withdrawn"`, `"not_set"` |
| `[].allowed` (Required when parent is present) | `boolean` | Whether the processing is allowed for this member right now |
| `[].updatedAt` (Required when parent is present) | `string (date-time)` | Can be null |

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbiddenResource

Same fields as [Get the signed-in member's system consents (401)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 404

Content type: `application/json` · `ErrorResponse`

memberNotFound

Same fields as [Get the signed-in member's system consents (404)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

**Example response**

`application/json`

```json
{
  "messageCode": "memberNotFound",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the signed-in member's system consents (401)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

### Example request

```bash
curl 'https://api.subrite.no/api/v1/members/{id}/system-consents' \
  --header 'Authorization: Bearer <token>'
```

### Example response

200 · `application/json`

```json
[
  {
    "areaId": "string",
    "group": "communication",
    "legalBasis": "legitimate_interests",
    "status": "accepted",
    "allowed": true,
    "updatedAt": "2019-08-24T14:15:22Z"
  }
]
```

<a id="get-api-v1-members-id-system-consents-areaid-history"></a>
## Get the history of one of a member's system consents

`GET /api/v1/members/{id}/system-consents/{areaId}/history`

**Authentication:** Bearer token (JWT)

### Parameters

| Name | In | Type | Description |
| --- | --- | --- | --- |
| `id` (Required) | path | `string` |   |
| `areaId` (Required) | path | `string` |   |
| `page` | query | `number` | Default: `1` · `minimum`: `1` |
| `take` | query | `number` | Default: `10` · `minimum`: `1`, `maximum`: `50` |
| `orderBy` | query | `string` | Allowed values: `"createdAt"`, `"id"`, `"updatedAt"` · Default: `"createdAt"` |
| `orderDirection` | query | `string` | Allowed values: `"asc"`, `"desc"` · Default: `"desc"` |

### Responses

#### 200

Content type: `application/json` · `SystemConsentHistoryDtoPaginated`

| Name | Type | Description |
| --- | --- | --- |
| `items` (Required) | `array of SystemConsentHistoryDto` |   |
| `items[].id` (Required when parent is present) | `number` |   |
| `items[].areaId` (Required when parent is present) | `string` |   |
| `items[].type` (Required when parent is present) | `string` | Allowed values: `"accepted"`, `"withdrawn"` |
| `items[].channel` (Required when parent is present) | `string` | Allowed values: `"mypage"`, `"onboarding"`, `"newsletter"`, `"admin"`, `"mailchimp"`, `"make"`, `"m2m"`, `"mailmojo"`, `"import"` |
| `items[].reference` (Required when parent is present) | `string` | Can be null |
| `items[].legalBasis` (Required when parent is present) | `string` | Allowed values: `"legitimate_interests"`, `"consent"` · Can be null |
| `items[].assessmentVersion` (Required when parent is present) | `number` | Can be null |
| `items[].createdAt` (Required when parent is present) | `string (date-time)` |   |
| `meta` (Required) | `PageMeta` |   |
| `meta.page` (Required) | `number` |   |
| `meta.take` (Required) | `number` |   |
| `meta.count` (Required) | `number` |   |
| `meta.pageCount` (Required) | `number` |   |
| `meta.hasPreviousPage` (Required) | `boolean` |   |
| `meta.hasNextPage` (Required) | `boolean` |   |

#### 400

Content type: `application/json` · `ErrorResponse`

invalidSystemConsent, badRequest

| Name | Type | Description |
| --- | --- | --- |
| `messageCode` (Required) | `string` | Allowed values: `"invalidSystemConsent"`, `"badRequest"` |
| `message` | `string` |   |
| `errors` (Required) | `array of FieldError` |   |
| `errors[].field` (Required when parent is present) | `string` |   |
| `errors[].fieldValue` (Required when parent is present) | `string` |   |
| `errors[].identifier` (Required when parent is present) | `string` |   |
| `errors[].identifierValue` (Required when parent is present) | `string` |   |
| `errors[].messageCode` (Required when parent is present) | `string` |   |
| `errors[].message` | `string` |   |
| `errors[].errorType` (Required when parent is present) | `string` |   |

**Example response**

`application/json`

```json
{
  "messageCode": "invalidSystemConsent",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbiddenResource

Same fields as [Get the signed-in member's system consents (401)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 404

Content type: `application/json` · `ErrorResponse`

memberNotFound

Same fields as [Get the signed-in member's system consents (404)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

**Example response**

`application/json`

```json
{
  "messageCode": "memberNotFound",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the signed-in member's system consents (401)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

### Example request

```bash
curl 'https://api.subrite.no/api/v1/members/{id}/system-consents/{areaId}/history' \
  --header 'Authorization: Bearer <token>'
```

### Example response

200 · `application/json`

```json
{
  "items": [
    {}
  ],
  "meta": {
    "page": 0,
    "take": 0,
    "count": 0,
    "pageCount": 0,
    "hasPreviousPage": true,
    "hasNextPage": true
  }
}
```

<a id="get-api-v1-system-consents-website-tracking-userid"></a>
## Whether a user's Page views choice allows sending to Subrite Signal

`GET /api/v1/system-consents/website-tracking/{userId}`

**Authentication:** Bearer token (JWT)

### Parameters

| Name | In | Type | Description |
| --- | --- | --- | --- |
| `userId` (Required) | path | `number` |   |

### Responses

#### 200

Content type: `application/json` · `WebsiteTrackingDto`

| Name | Type | Description |
| --- | --- | --- |
| `allowed` (Required) | `boolean` | Whether websites may send this user's page views to Subrite Signal right now |

#### 401

unauthorized

#### 403

Content type: `application/json` · `ErrorResponse`

forbiddenResource

Same fields as [Get the signed-in member's system consents (401)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

**Example response**

`application/json`

```json
{
  "messageCode": "string",
  "message": "string",
  "errors": [
    {}
  ]
}
```

#### 500

Content type: `application/json` · `ErrorResponse`

internalServerError

Same fields as [Get the signed-in member's system consents (401)](https://www.subrite.no/developers/system-consent?md=true#get-api-v1-members-profile-system-consents).

### Example request

```bash
curl 'https://api.subrite.no/api/v1/system-consents/website-tracking/{userId}' \
  --header 'Authorization: Bearer <token>'
```

### Example response

200 · `application/json`

```json
{
  "allowed": true
}
```