Re-identification

Initiate Cross-DUID Re-identification by MPxN

Initiates a re-identification flow against an existing Identity Record for the given MPxN, without exposing the ir key. Used when a Data User wants to create an Access Record linked to an Identity Record originally created by another Data User.

The register resolves the ir internally. The Data User never sees it. The customer is challenged via magic link or passkey — the challenge displays the initiating Data User’s name so the customer knows who is requesting access.

On successful customer completion, the returned token-ref is passed as reidentification-token in POST /access-records. The register validates the token is confirmed, single-use, and was initiated by the same Data User before linking the new Access Record to the existing Identity Record.

Security: Without customer completion of the re-identification ceremony, the token cannot be used. A Data User cannot manufacture a valid token or re-use one after consumption.

POST

identity-records

reidentify

Initiate Cross-DUID Re-identification by MPxN

curl --request POST \
  --url https://api.central.consent/v1/identity-records/reidentify \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "mpxn": "1234567890123",
  "redirect-url": "<string>",
  "passkey-return-url": "<string>"
}
'

import requests

url = "https://api.central.consent/v1/identity-records/reidentify"

payload = {
    "mpxn": "1234567890123",
    "redirect-url": "<string>",
    "passkey-return-url": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    mpxn: '1234567890123',
    'redirect-url': '<string>',
    'passkey-return-url': '<string>'
  })
};

fetch('https://api.central.consent/v1/identity-records/reidentify', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.central.consent/v1/identity-records/reidentify",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'mpxn' => '1234567890123',
    'redirect-url' => '<string>',
    'passkey-return-url' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.central.consent/v1/identity-records/reidentify"

	payload := strings.NewReader("{\n  \"mpxn\": \"1234567890123\",\n  \"redirect-url\": \"<string>\",\n  \"passkey-return-url\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.central.consent/v1/identity-records/reidentify")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"mpxn\": \"1234567890123\",\n  \"redirect-url\": \"<string>\",\n  \"passkey-return-url\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.central.consent/v1/identity-records/reidentify")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"mpxn\": \"1234567890123\",\n  \"redirect-url\": \"<string>\",\n  \"passkey-return-url\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "magic-link": {
    "dispatched-to": "c*****r@example.com",
    "expires-at": "2026-03-24T09:15:00Z",
    "token-ref": "mlr_9f8e7d6c5b4a9f8e7d6c5b4a",
    "redirect-url": "https://app.bright-energy.com/renew/confirmed"
  },
  "passkey": {
    "redirect-url": "https://id.central.consent/passkey/assert?session=pks_a1b2c3d4e5f6a1b2c3d4e5f6",
    "token-ref": "mlr_1a2b3c4d5e6f1a2b3c4d5e6f",
    "expires-at": "2026-03-24T09:05:00Z",
    "return-url": "https://app.bright-energy.com/renew/confirmed"
  }
}

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}

Authorizations

Authorization

string

header

required

JWT from GET /auth/token. Pass as Authorization: Bearer <token>. Expires after 7200s.

Body

application/json

mpxn

string

required

Meter Point Administration Number (MPAN) or Meter Point Reference Number (MPRN).

Pattern: ^(?:[0-9A-HJ-NPR-Z]{2}[0-9]{8,10}|[0-9]{10})$

Example:

"1234567890123"

method

enum<string>

required

The re-identification method to use.

magic-link — single-step. The register dispatches a signed link to the stored email address. Optionally supply redirect-url to send the customer back to the Data User's app after clicking; otherwise the customer lands on central.consent. Poll or check GET /identity-records/{ir}/re-identify/{token-ref} to confirm.

passkey-assert — two-step redirect. The response contains a passkey-redirect with a short-lived URL to id.central.consent. Redirect the customer there; the register runs the WebAuthn assertion against the stored public key on its own origin, then redirects back with ?dar-passkey-token={token-ref}. Call GET /identity-records/{ir}/re-identify/{token-ref} once to confirm.

passkey-register — two-step redirect for new device enrolment. Same flow as passkey-assert but runs a registration ceremony instead of assertion. Stores a new public key credential on the Identity Record and confirms re-identification on success.

Available options:

magic-link,

passkey-assert,

passkey-register

redirect-url

string<uri> | null

passkey-return-url

string<uri> | null

Response

Re-identification flow initiated. Customer has been challenged.

response

object

required

Show child attributes

method

enum<string>

required

The re-identification method to use.

Available options:

magic-link,

passkey-assert,

passkey-register

magic-link

object | null

Populated for magic-link method; null otherwise.

Show child attributes

passkey

object | null

Populated for passkey-assert and passkey-register methods; null for magic-link. Contains the redirect URL to id.central.consent where the WebAuthn ceremony takes place.

Show child attributes

Last modified on March 25, 2026

Poll Cross-DUID Re-identification StatusPolls the status of a cross-DUID re-identification flow initiated via `POST /identity-records/reidentify`. Used by Data User B who holds a `token-ref` but not the `ir` key. The token-ref is scoped to the initiating Data User — another Data User cannot poll a token they did not initiate.

Initiate Cross-DUID Re-identification by MPxN

curl --request POST \
  --url https://api.central.consent/v1/identity-records/reidentify \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "mpxn": "1234567890123",
  "redirect-url": "<string>",
  "passkey-return-url": "<string>"
}
'

import requests

url = "https://api.central.consent/v1/identity-records/reidentify"

payload = {
    "mpxn": "1234567890123",
    "redirect-url": "<string>",
    "passkey-return-url": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    mpxn: '1234567890123',
    'redirect-url': '<string>',
    'passkey-return-url': '<string>'
  })
};

fetch('https://api.central.consent/v1/identity-records/reidentify', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.central.consent/v1/identity-records/reidentify",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'mpxn' => '1234567890123',
    'redirect-url' => '<string>',
    'passkey-return-url' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.central.consent/v1/identity-records/reidentify"

	payload := strings.NewReader("{\n  \"mpxn\": \"1234567890123\",\n  \"redirect-url\": \"<string>\",\n  \"passkey-return-url\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.central.consent/v1/identity-records/reidentify")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"mpxn\": \"1234567890123\",\n  \"redirect-url\": \"<string>\",\n  \"passkey-return-url\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.central.consent/v1/identity-records/reidentify")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"mpxn\": \"1234567890123\",\n  \"redirect-url\": \"<string>\",\n  \"passkey-return-url\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "magic-link": {
    "dispatched-to": "c*****r@example.com",
    "expires-at": "2026-03-24T09:15:00Z",
    "token-ref": "mlr_9f8e7d6c5b4a9f8e7d6c5b4a",
    "redirect-url": "https://app.bright-energy.com/renew/confirmed"
  },
  "passkey": {
    "redirect-url": "https://id.central.consent/passkey/assert?session=pks_a1b2c3d4e5f6a1b2c3d4e5f6",
    "token-ref": "mlr_1a2b3c4d5e6f1a2b3c4d5e6f",
    "expires-at": "2026-03-24T09:05:00Z",
    "return-url": "https://app.bright-energy.com/renew/confirmed"
  }
}

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}

{
  "response": {
    "resource": "/v1/access-records/ak_691df0c788ca043403b7fa90",
    "timestamp": "2026-03-11T12:00:00Z",
    "transaction-id": "tid_691df0c788ca043403b7fa90"
  },
  "errors": [
    {
      "error-code": "VAL001",
      "message": "Field 'mpxn' does not match the required pattern."
    }
  ]
}