Skip to main content
POST
/
identity-records
/
{ir}
/
re-identify
curl --request POST \
  --url https://api.central.consent/v1/identity-records/{ir}/re-identify \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "method": "magic-link",
  "redirect-url": "https://app.bright-energy.com/renew/confirmed"
}
'
{
  "response": {
    "resource": "/v1/identity-records/ir_a3c5e7f9b1d3a3c5e7f9b1d3/re-identify",
    "timestamp": "2026-03-24T09:00:00Z",
    "transaction-id": "tid_abc123def456abc123def456"
  },
  "method": "magic-link",
  "magic-link": {
    "dispatched-to": "c*****r@example.com",
    "expires-at": "2026-03-24T09:15:00Z",
    "token-ref": "mlr_9f8e7d6c5b4a9f8e7d6c5b4a",
    "redirect-url": "https://app.bright-energy.com/renew/confirmed"
  },
  "passkey": null
}

Authorizations

​
Authorization
string
header
required

JWT from GET /auth/token. Pass as Authorization: Bearer <token>. Expires after 7200s.

Path Parameters

​
ir
string
required

The identity record key for the returning principal. Unique opaque identifier for an Identity Record, issued by the register on creation. Referenced from record-metadata.identity-record-ref on an AccessRecord to link the two resources.

Pattern: ^ir_[0-9a-f]{24}$
Example:

"ir_a3c5e7f9b1d3a3c5e7f9b1d3"

Body

application/json

Request body for POST /identity-records/{ir}/re-identify.

​
method
enum<string>
required

The re-identification method to use.

magic-link — single-step. The register dispatches a signed link to the stored email address. Optionally supply redirect-url to send the customer back to the Data User's app after clicking; otherwise the customer lands on central.consent. Poll or check GET /identity-records/{ir}/re-identify/{token-ref} to confirm.

passkey-assert — two-step redirect. The response contains a passkey-redirect with a short-lived URL to id.central.consent. Redirect the customer there; the register runs the WebAuthn assertion against the stored public key on its own origin, then redirects back with ?dar-passkey-token={token-ref}. Call GET /identity-records/{ir}/re-identify/{token-ref} once to confirm.

passkey-register — two-step redirect for new device enrolment. Same flow as passkey-assert but runs a registration ceremony instead of assertion. Stores a new public key credential on the Identity Record and confirms re-identification on success.

Available options:
magic-link,
passkey-assert,
passkey-register
​
redirect-url
string<uri> | null

Optional. Only valid when method is magic-link. A URL to redirect the customer to after they click the magic link and the register has confirmed their identity. Must exactly match a URL pre-registered for the Data User's DUID. When supplied, the register appends ?dar-reid-token={token-ref} to the URL before redirecting. The Data User reads dar-reid-token from the query string and calls GET /identity-records/{ir}/re-identify/{token-ref} once to confirm status: confirmed — no polling required. When omitted, the customer lands on a confirmation page at central.consent after clicking the link. The Data User must poll GET /identity-records/{ir}/re-identify/{token-ref} to detect confirmation.

Example:

"https://app.bright-energy.com/renew/confirmed"

​
passkey-return-url
string<uri> | null

Optional. Only valid when method is passkey-assert or passkey-register. The URL the register redirects the customer back to after the WebAuthn ceremony completes on id.central.consent. Must exactly match a URL pre-registered for the Data User's DUID. The register appends ?dar-passkey-token={token-ref} on success. When omitted, the customer lands on a completion page at id.central.consent.

Example:

"https://app.bright-energy.com/renew/confirmed"

Response

Re-identification flow initiated.

  • For magic-link: link dispatched, magic-link object populated.
  • For passkey-assert or passkey-register: passkey redirect object populated — redirect the customer to passkey.redirect-url immediately.
​
response
object
required
​
method
enum<string>
required

The re-identification method to use.

magic-link — single-step. The register dispatches a signed link to the stored email address. Optionally supply redirect-url to send the customer back to the Data User's app after clicking; otherwise the customer lands on central.consent. Poll or check GET /identity-records/{ir}/re-identify/{token-ref} to confirm.

passkey-assert — two-step redirect. The response contains a passkey-redirect with a short-lived URL to id.central.consent. Redirect the customer there; the register runs the WebAuthn assertion against the stored public key on its own origin, then redirects back with ?dar-passkey-token={token-ref}. Call GET /identity-records/{ir}/re-identify/{token-ref} once to confirm.

passkey-register — two-step redirect for new device enrolment. Same flow as passkey-assert but runs a registration ceremony instead of assertion. Stores a new public key credential on the Identity Record and confirms re-identification on success.

Available options:
magic-link,
passkey-assert,
passkey-register
​
magic-link
object

Populated for magic-link method; null otherwise.

​
passkey
object

Populated for passkey-assert and passkey-register methods; null for magic-link. Contains the redirect URL to id.central.consent where the WebAuthn ceremony takes place.

Last modified on March 25, 2026