Skip to main content
PUT
/
access-records
/
{ak}
Replace an Access Record
curl --request PUT \
  --url https://api.central.consent/v1/access-records/{ak} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "record-metadata": {
    "schema-version": "1.0",
    "controller-arrangement": {
      "controllers": [
        {
          "name": "Bright Energy Ltd",
          "contact-url": "https://bright-energy.com/contact",
          "privacy-rights-url": "https://bright-energy.com/your-rights",
          "lia-reference": "LIA-2024-003",
          "statutory-reference": "Energy Act 2023, s.147",
          "storage-conditions": {
            "location": "GB",
            "retention-period": "P2Y"
          }
        }
      ],
      "art26-reference": "JCA-2024-BrightGrid-001"
    },
    "identity-record-ref": "ir_a3c5e7f9b1d3a3c5e7f9b1d3"
  },
  "notice": {
    "shared-notice": {
      "terms-url": "https://bright-energy.com/privacy-v3.html",
      "notice-version": "v3.2",
      "notice-language": "en"
    },
    "notices": [
      {
        "controller-name": "Grid Analytics Ltd",
        "terms-url": "https://gridanalytics.com/privacy-v2.html",
        "notice-version": "v2.0",
        "notice-language": "en"
      }
    ]
  },
  "processing": {
    "legal-basis": "uk-consent",
    "purpose": "Energy efficiency analysis and tariff recommendations",
    "data-types": [],
    "data-source": "National Grid ESO / MPAS",
    "recipients": [
      {
        "name": "Analytics Co Ltd",
        "role": "Sub-processor",
        "privacy-url": "https://analyticsco.com/privacy"
      }
    ]
  },
  "access-event": {
    "registered-at": "2023-11-07T05:31:56Z",
    "expiry": "2027-11-10T17:07:01.580Z",
    "controller-reference": "REF-00123",
    "consent": {
      "method": "Explicit web checkbox"
    }
  },
  "reidentification-token": "<string>"
}
'
import requests

url = "https://api.central.consent/v1/access-records/{ak}"

payload = {
    "record-metadata": {
        "schema-version": "1.0",
        "controller-arrangement": {
            "controllers": [
                {
                    "name": "Bright Energy Ltd",
                    "contact-url": "https://bright-energy.com/contact",
                    "privacy-rights-url": "https://bright-energy.com/your-rights",
                    "lia-reference": "LIA-2024-003",
                    "statutory-reference": "Energy Act 2023, s.147",
                    "storage-conditions": {
                        "location": "GB",
                        "retention-period": "P2Y"
                    }
                }
            ],
            "art26-reference": "JCA-2024-BrightGrid-001"
        },
        "identity-record-ref": "ir_a3c5e7f9b1d3a3c5e7f9b1d3"
    },
    "notice": {
        "shared-notice": {
            "terms-url": "https://bright-energy.com/privacy-v3.html",
            "notice-version": "v3.2",
            "notice-language": "en"
        },
        "notices": [
            {
                "controller-name": "Grid Analytics Ltd",
                "terms-url": "https://gridanalytics.com/privacy-v2.html",
                "notice-version": "v2.0",
                "notice-language": "en"
            }
        ]
    },
    "processing": {
        "legal-basis": "uk-consent",
        "purpose": "Energy efficiency analysis and tariff recommendations",
        "data-types": [],
        "data-source": "National Grid ESO / MPAS",
        "recipients": [
            {
                "name": "Analytics Co Ltd",
                "role": "Sub-processor",
                "privacy-url": "https://analyticsco.com/privacy"
            }
        ]
    },
    "access-event": {
        "registered-at": "2023-11-07T05:31:56Z",
        "expiry": "2027-11-10T17:07:01.580Z",
        "controller-reference": "REF-00123",
        "consent": { "method": "Explicit web checkbox" }
    },
    "reidentification-token": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)
const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    'record-metadata': {
      'schema-version': '1.0',
      'controller-arrangement': {
        controllers: [
          {
            name: 'Bright Energy Ltd',
            'contact-url': 'https://bright-energy.com/contact',
            'privacy-rights-url': 'https://bright-energy.com/your-rights',
            'lia-reference': 'LIA-2024-003',
            'statutory-reference': 'Energy Act 2023, s.147',
            'storage-conditions': {location: 'GB', 'retention-period': 'P2Y'}
          }
        ],
        'art26-reference': 'JCA-2024-BrightGrid-001'
      },
      'identity-record-ref': 'ir_a3c5e7f9b1d3a3c5e7f9b1d3'
    },
    notice: {
      'shared-notice': {
        'terms-url': 'https://bright-energy.com/privacy-v3.html',
        'notice-version': 'v3.2',
        'notice-language': 'en'
      },
      notices: [
        {
          'controller-name': 'Grid Analytics Ltd',
          'terms-url': 'https://gridanalytics.com/privacy-v2.html',
          'notice-version': 'v2.0',
          'notice-language': 'en'
        }
      ]
    },
    processing: {
      'legal-basis': 'uk-consent',
      purpose: 'Energy efficiency analysis and tariff recommendations',
      'data-types': [],
      'data-source': 'National Grid ESO / MPAS',
      recipients: [
        {
          name: 'Analytics Co Ltd',
          role: 'Sub-processor',
          'privacy-url': 'https://analyticsco.com/privacy'
        }
      ]
    },
    'access-event': {
      'registered-at': '2023-11-07T05:31:56Z',
      expiry: '2027-11-10T17:07:01.580Z',
      'controller-reference': 'REF-00123',
      consent: {method: 'Explicit web checkbox'}
    },
    'reidentification-token': '<string>'
  })
};

fetch('https://api.central.consent/v1/access-records/{ak}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.central.consent/v1/access-records/{ak}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'record-metadata' => [
        'schema-version' => '1.0',
        'controller-arrangement' => [
                'controllers' => [
                                [
                                                                'name' => 'Bright Energy Ltd',
                                                                'contact-url' => 'https://bright-energy.com/contact',
                                                                'privacy-rights-url' => 'https://bright-energy.com/your-rights',
                                                                'lia-reference' => 'LIA-2024-003',
                                                                'statutory-reference' => 'Energy Act 2023, s.147',
                                                                'storage-conditions' => [
                                                                                                                                'location' => 'GB',
                                                                                                                                'retention-period' => 'P2Y'
                                                                ]
                                ]
                ],
                'art26-reference' => 'JCA-2024-BrightGrid-001'
        ],
        'identity-record-ref' => 'ir_a3c5e7f9b1d3a3c5e7f9b1d3'
    ],
    'notice' => [
        'shared-notice' => [
                'terms-url' => 'https://bright-energy.com/privacy-v3.html',
                'notice-version' => 'v3.2',
                'notice-language' => 'en'
        ],
        'notices' => [
                [
                                'controller-name' => 'Grid Analytics Ltd',
                                'terms-url' => 'https://gridanalytics.com/privacy-v2.html',
                                'notice-version' => 'v2.0',
                                'notice-language' => 'en'
                ]
        ]
    ],
    'processing' => [
        'legal-basis' => 'uk-consent',
        'purpose' => 'Energy efficiency analysis and tariff recommendations',
        'data-types' => [
                
        ],
        'data-source' => 'National Grid ESO / MPAS',
        'recipients' => [
                [
                                'name' => 'Analytics Co Ltd',
                                'role' => 'Sub-processor',
                                'privacy-url' => 'https://analyticsco.com/privacy'
                ]
        ]
    ],
    'access-event' => [
        'registered-at' => '2023-11-07T05:31:56Z',
        'expiry' => '2027-11-10T17:07:01.580Z',
        'controller-reference' => 'REF-00123',
        'consent' => [
                'method' => 'Explicit web checkbox'
        ]
    ],
    'reidentification-token' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.central.consent/v1/access-records/{ak}"

	payload := strings.NewReader("{\n  \"record-metadata\": {\n    \"schema-version\": \"1.0\",\n    \"controller-arrangement\": {\n      \"controllers\": [\n        {\n          \"name\": \"Bright Energy Ltd\",\n          \"contact-url\": \"https://bright-energy.com/contact\",\n          \"privacy-rights-url\": \"https://bright-energy.com/your-rights\",\n          \"lia-reference\": \"LIA-2024-003\",\n          \"statutory-reference\": \"Energy Act 2023, s.147\",\n          \"storage-conditions\": {\n            \"location\": \"GB\",\n            \"retention-period\": \"P2Y\"\n          }\n        }\n      ],\n      \"art26-reference\": \"JCA-2024-BrightGrid-001\"\n    },\n    \"identity-record-ref\": \"ir_a3c5e7f9b1d3a3c5e7f9b1d3\"\n  },\n  \"notice\": {\n    \"shared-notice\": {\n      \"terms-url\": \"https://bright-energy.com/privacy-v3.html\",\n      \"notice-version\": \"v3.2\",\n      \"notice-language\": \"en\"\n    },\n    \"notices\": [\n      {\n        \"controller-name\": \"Grid Analytics Ltd\",\n        \"terms-url\": \"https://gridanalytics.com/privacy-v2.html\",\n        \"notice-version\": \"v2.0\",\n        \"notice-language\": \"en\"\n      }\n    ]\n  },\n  \"processing\": {\n    \"legal-basis\": \"uk-consent\",\n    \"purpose\": \"Energy efficiency analysis and tariff recommendations\",\n    \"data-types\": [],\n    \"data-source\": \"National Grid ESO / MPAS\",\n    \"recipients\": [\n      {\n        \"name\": \"Analytics Co Ltd\",\n        \"role\": \"Sub-processor\",\n        \"privacy-url\": \"https://analyticsco.com/privacy\"\n      }\n    ]\n  },\n  \"access-event\": {\n    \"registered-at\": \"2023-11-07T05:31:56Z\",\n    \"expiry\": \"2027-11-10T17:07:01.580Z\",\n    \"controller-reference\": \"REF-00123\",\n    \"consent\": {\n      \"method\": \"Explicit web checkbox\"\n    }\n  },\n  \"reidentification-token\": \"<string>\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.put("https://api.central.consent/v1/access-records/{ak}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"record-metadata\": {\n    \"schema-version\": \"1.0\",\n    \"controller-arrangement\": {\n      \"controllers\": [\n        {\n          \"name\": \"Bright Energy Ltd\",\n          \"contact-url\": \"https://bright-energy.com/contact\",\n          \"privacy-rights-url\": \"https://bright-energy.com/your-rights\",\n          \"lia-reference\": \"LIA-2024-003\",\n          \"statutory-reference\": \"Energy Act 2023, s.147\",\n          \"storage-conditions\": {\n            \"location\": \"GB\",\n            \"retention-period\": \"P2Y\"\n          }\n        }\n      ],\n      \"art26-reference\": \"JCA-2024-BrightGrid-001\"\n    },\n    \"identity-record-ref\": \"ir_a3c5e7f9b1d3a3c5e7f9b1d3\"\n  },\n  \"notice\": {\n    \"shared-notice\": {\n      \"terms-url\": \"https://bright-energy.com/privacy-v3.html\",\n      \"notice-version\": \"v3.2\",\n      \"notice-language\": \"en\"\n    },\n    \"notices\": [\n      {\n        \"controller-name\": \"Grid Analytics Ltd\",\n        \"terms-url\": \"https://gridanalytics.com/privacy-v2.html\",\n        \"notice-version\": \"v2.0\",\n        \"notice-language\": \"en\"\n      }\n    ]\n  },\n  \"processing\": {\n    \"legal-basis\": \"uk-consent\",\n    \"purpose\": \"Energy efficiency analysis and tariff recommendations\",\n    \"data-types\": [],\n    \"data-source\": \"National Grid ESO / MPAS\",\n    \"recipients\": [\n      {\n        \"name\": \"Analytics Co Ltd\",\n        \"role\": \"Sub-processor\",\n        \"privacy-url\": \"https://analyticsco.com/privacy\"\n      }\n    ]\n  },\n  \"access-event\": {\n    \"registered-at\": \"2023-11-07T05:31:56Z\",\n    \"expiry\": \"2027-11-10T17:07:01.580Z\",\n    \"controller-reference\": \"REF-00123\",\n    \"consent\": {\n      \"method\": \"Explicit web checkbox\"\n    }\n  },\n  \"reidentification-token\": \"<string>\"\n}")
  .asString();
require 'uri'
require 'net/http'

url = URI("https://api.central.consent/v1/access-records/{ak}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"record-metadata\": {\n    \"schema-version\": \"1.0\",\n    \"controller-arrangement\": {\n      \"controllers\": [\n        {\n          \"name\": \"Bright Energy Ltd\",\n          \"contact-url\": \"https://bright-energy.com/contact\",\n          \"privacy-rights-url\": \"https://bright-energy.com/your-rights\",\n          \"lia-reference\": \"LIA-2024-003\",\n          \"statutory-reference\": \"Energy Act 2023, s.147\",\n          \"storage-conditions\": {\n            \"location\": \"GB\",\n            \"retention-period\": \"P2Y\"\n          }\n        }\n      ],\n      \"art26-reference\": \"JCA-2024-BrightGrid-001\"\n    },\n    \"identity-record-ref\": \"ir_a3c5e7f9b1d3a3c5e7f9b1d3\"\n  },\n  \"notice\": {\n    \"shared-notice\": {\n      \"terms-url\": \"https://bright-energy.com/privacy-v3.html\",\n      \"notice-version\": \"v3.2\",\n      \"notice-language\": \"en\"\n    },\n    \"notices\": [\n      {\n        \"controller-name\": \"Grid Analytics Ltd\",\n        \"terms-url\": \"https://gridanalytics.com/privacy-v2.html\",\n        \"notice-version\": \"v2.0\",\n        \"notice-language\": \"en\"\n      }\n    ]\n  },\n  \"processing\": {\n    \"legal-basis\": \"uk-consent\",\n    \"purpose\": \"Energy efficiency analysis and tariff recommendations\",\n    \"data-types\": [],\n    \"data-source\": \"National Grid ESO / MPAS\",\n    \"recipients\": [\n      {\n        \"name\": \"Analytics Co Ltd\",\n        \"role\": \"Sub-processor\",\n        \"privacy-url\": \"https://analyticsco.com/privacy\"\n      }\n    ]\n  },\n  \"access-event\": {\n    \"registered-at\": \"2023-11-07T05:31:56Z\",\n    \"expiry\": \"2027-11-10T17:07:01.580Z\",\n    \"controller-reference\": \"REF-00123\",\n    \"consent\": {\n      \"method\": \"Explicit web checkbox\"\n    }\n  },\n  \"reidentification-token\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body
{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "access-token": {
    "key": "ak_691df0c788ca043403b7fa90",
    "expiry": "2023-11-07T05:31:56Z"
  }
}
{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}
{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}
{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}
{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}
{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}
{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}

Authorizations

​
Authorization
string
header
required

JWT from GET /auth/token. Pass as Authorization: Bearer <token>. Expires after 7200s.

Path Parameters

​
ak
string
required

The access key of the record to replace. Unique opaque identifier for an access record, issued by the register on creation. Treat as a secret — possession enables access verification.

Pattern: ^ak_[0-9a-f]{24}$
Example:

"ak_691df0c788ca043403b7fa90"

Body

application/json

Full AccessRecord replacement payload.

A data access record covering all lawful bases. The same schema is used regardless of processing.legal-basis. The notice field and access-event.consent sub-object are null for non-consent records and populated for consent records.

​
record-metadata
object
required

ISO 27560 Section 1 — Record Metadata

record-identifier and created-at are assigned by the register on creation and returned in responses; they must not be supplied in request bodies.

identity-record-ref links this access record to the Identity Record that holds the person-property relationship (PII principal, move-in date, address, and identity verification evidence). Supply the ir key returned when the Identity Record was created. The linked Identity Record must have been registered by the same authenticated Data User.

identity-record-ref is required when registering a new Access Record in the standard flow. It may be omitted when a reidentification-token is supplied in the POST /access-records request body — the register resolves the ir internally from the validated token.

​
notice
object | null
required

Populated for consent-based records; null for all other legal bases.

​
processing
object
required

ISO 27560 Section 3 — Processing Fields

Defines the shared scope and legal basis of data access. These fields apply to the access registration as a whole regardless of how many controllers are involved.

Per-controller compliance fields — privacy-rights-url, lia-reference, statutory-reference, and storage-conditions — are held on each Controller entry within record-metadata.controller-arrangement, where each controller bears individual accountability.

legal-basis applies to all controllers in the arrangement. For joint arrangements, all controllers must share the same legal basis — if purposes or bases differ, separate Access Records are required.

​
access-event
object
required

ISO 27560 Section 4 — Access Event Fields

Records when access was registered, its lifecycle state and duration, and (for consent records) the specific details of how consent was expressed.

registered-at serves as the canonical event timestamp for all record types — for consent records it is the date the customer gave consent; for non-consent records it is the date the Controller registered their access.

revoked-at is set by the register on revocation and must not be supplied in request bodies.

consent is required when legal-basis is uk-consent or uk-explicit-consent. It must be omitted or null for all other legal bases (uk-public-task, uk-legitimate-interests, uk-legal-obligation, uk-contract).

​
reidentification-token
string | null

Cross-DUID only. A confirmed token-ref obtained via POST /identity-records/reidentify. When supplied, identity-record-ref in record-metadata must be omitted — the register resolves the ir internally. The token is single-use, scoped to the initiating Data User, and expires one hour after issuance.

Response

Access record replaced successfully.

​
response
object
required
​
access-token
object
required

The access token issued on successful registration. Pass to Data Providers to enable access verification.

Last modified on March 25, 2026