Data Providers

Verify Access Record

Returns the full access record for a given access key. Called by Data Providers before releasing meter data.

Authentication: Unauthenticated by design. The access key acts as the credential; treat it as a secret.

Note on PII: This endpoint returns no PII. The person-property relationship (MPxN, address, move-in date, identity verification) is held in the linked Identity Record, which is accessible only to authenticated Data Users via GET /identity-records/{ir}. The identity-record-ref in record-metadata provides the link.

Verification checklist (all record types):

access-event.state must be ACTIVE.
access-event.expiry must be in the future, or null.
At least one controller in record-metadata.controller-arrangement.controllers must match the organisation you have a verified commercial relationship with on your platform. For joint arrangements, verify against the lead entry.
The data types being requested must be within processing.data-types.
Log response.transaction-id for your audit trail.

Additional checks by legal basis:

Consent records: confirm access-event.consent.consent-type is appropriate for the data category being released.
Legitimate interests: confirm lia-reference is present on the lead controller entry in record-metadata.controller-arrangement.
Public task / legal obligation: confirm statutory-reference is present on the lead controller entry in record-metadata.controller-arrangement.

GET

access-records

{ak}

Verify Access Record

curl --request GET \
  --url https://api.central.consent/v1/access-records/{ak}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.central.consent/v1/access-records/{ak}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.central.consent/v1/access-records/{ak}"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.central.consent/v1/access-records/{ak}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "access-record": {
    "record-metadata": {
      "schema-version": "1.0",
      "controller-arrangement": {
        "arrangement-type": "sole",
        "controllers": [
          {
            "name": "Bright Energy Ltd",
            "role": "sole",
            "contact-url": "https://bright-energy.com/contact",
            "address": {
              "addressLine1": "221B Baker Street",
              "townCity": "London",
              "postcode": "NW1 6XE",
              "addressLine2": "Marylebone",
              "county": "Greater London"
            },
            "privacy-rights-url": "https://bright-energy.com/your-rights",
            "lia-reference": "LIA-2024-003",
            "statutory-reference": "Energy Act 2023, s.147",
            "storage-conditions": {
              "location": "GB",
              "retention-period": "P2Y"
            }
          }
        ],
        "art26-reference": "JCA-2024-BrightGrid-001"
      },
      "record-identifier": "ak_691df0c788ca043403b7fa90",
      "created-at": "2024-01-15T09:30:00Z",
      "identity-record-ref": "ir_a3c5e7f9b1d3a3c5e7f9b1d3"
    },
    "notice": {
      "shared-notice": {
        "terms-url": "https://bright-energy.com/privacy-v3.html",
        "notice-version": "v3.2",
        "notice-language": "en"
      },
      "notices": [
        {
          "controller-name": "Grid Analytics Ltd",
          "terms-url": "https://gridanalytics.com/privacy-v2.html",
          "notice-version": "v2.0",
          "notice-language": "en"
        }
      ]
    },
    "processing": {
      "legal-basis": "uk-consent",
      "purpose": "Energy efficiency analysis and tariff recommendations",
      "data-types": [
        "HH-CONSUMPTION"
      ],
      "jurisdiction": "GB",
      "data-source": "National Grid ESO / MPAS",
      "recipients": [
        {
          "name": "Analytics Co Ltd",
          "role": "Sub-processor",
          "privacy-url": "https://analyticsco.com/privacy"
        }
      ]
    },
    "access-event": {
      "state": "ACTIVE",
      "registered-at": "2023-11-07T05:31:56Z",
      "expiry": "2027-11-10T17:07:01.580Z",
      "controller-reference": "REF-00123",
      "consent": {
        "consent-type": "expressed-consent",
        "method": "Explicit web checkbox"
      },
      "revoked-at": "2025-06-01T14:22:00Z"
    },
    "reidentification-token": "<string>"
  }
}

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}

Path Parameters

string

required

The access key issued at registration. Unique opaque identifier for an access record, issued by the register on creation. Treat as a secret — possession enables access verification.

Pattern: ^ak_[0-9a-f]{24}$

Example:

"ak_691df0c788ca043403b7fa90"

Response

Access record found and returned.

The full access record returned for verification. notice and access-event.consent will be null for non-consent records.

response

object

required

Show child attributes

access-record

object

required

A data access record covering all lawful bases. The same schema is used regardless of processing.legal-basis. The notice field and access-event.consent sub-object are null for non-consent records and populated for consent records.

Show child attributes

Last modified on March 25, 2026

Verify Access Record

curl --request GET \
  --url https://api.central.consent/v1/access-records/{ak}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.central.consent/v1/access-records/{ak}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.central.consent/v1/access-records/{ak}"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.central.consent/v1/access-records/{ak}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "access-record": {
    "record-metadata": {
      "schema-version": "1.0",
      "controller-arrangement": {
        "arrangement-type": "sole",
        "controllers": [
          {
            "name": "Bright Energy Ltd",
            "role": "sole",
            "contact-url": "https://bright-energy.com/contact",
            "address": {
              "addressLine1": "221B Baker Street",
              "townCity": "London",
              "postcode": "NW1 6XE",
              "addressLine2": "Marylebone",
              "county": "Greater London"
            },
            "privacy-rights-url": "https://bright-energy.com/your-rights",
            "lia-reference": "LIA-2024-003",
            "statutory-reference": "Energy Act 2023, s.147",
            "storage-conditions": {
              "location": "GB",
              "retention-period": "P2Y"
            }
          }
        ],
        "art26-reference": "JCA-2024-BrightGrid-001"
      },
      "record-identifier": "ak_691df0c788ca043403b7fa90",
      "created-at": "2024-01-15T09:30:00Z",
      "identity-record-ref": "ir_a3c5e7f9b1d3a3c5e7f9b1d3"
    },
    "notice": {
      "shared-notice": {
        "terms-url": "https://bright-energy.com/privacy-v3.html",
        "notice-version": "v3.2",
        "notice-language": "en"
      },
      "notices": [
        {
          "controller-name": "Grid Analytics Ltd",
          "terms-url": "https://gridanalytics.com/privacy-v2.html",
          "notice-version": "v2.0",
          "notice-language": "en"
        }
      ]
    },
    "processing": {
      "legal-basis": "uk-consent",
      "purpose": "Energy efficiency analysis and tariff recommendations",
      "data-types": [
        "HH-CONSUMPTION"
      ],
      "jurisdiction": "GB",
      "data-source": "National Grid ESO / MPAS",
      "recipients": [
        {
          "name": "Analytics Co Ltd",
          "role": "Sub-processor",
          "privacy-url": "https://analyticsco.com/privacy"
        }
      ]
    },
    "access-event": {
      "state": "ACTIVE",
      "registered-at": "2023-11-07T05:31:56Z",
      "expiry": "2027-11-10T17:07:01.580Z",
      "controller-reference": "REF-00123",
      "consent": {
        "consent-type": "expressed-consent",
        "method": "Explicit web checkbox"
      },
      "revoked-at": "2025-06-01T14:22:00Z"
    },
    "reidentification-token": "<string>"
  }
}

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}

Documents

Identity Records

Re-identification

Authentication

Data Users

Data Providers

DCC

Webhooks

Verify Access Record

Path Parameters

Response