Synq Docs
Management APIConsents

What a user allowed apps

What they allowed each app that isn't the brand's own, oldest first: signing in to it again doesn't ask them again for that. Needs `org.users.view`.

GET/v1/orgs/{org}/brands/{brand}/users/{user}/consents

What they allowed each app that isn't the brand's own, oldest first: signing in to it again doesn't ask them again for that. Needs org.users.view.

Authorization

bearer
AuthorizationBearer <token>

An org API key (sk_live_…, sk_test_…), or an access token from the Synq issuer (the synq brand, on the accounts host) for this API.

In: header

Path Parameters

org*string
brand*string
user*string

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X GET "https://example.com/v1/orgs/string/brands/string/users/string/consents"
{  "data": [    {      "id": "string",      "app": {        "client_id": "string",        "name": "string"      },      "scopes": [        "string"      ],      "claims": [        "string"      ],      "apis": [        {          "identifier": "string",          "scopes": [            "string"          ]        }      ],      "allowed_at": "2019-08-24T14:15:22Z",      "updated_at": "2019-08-24T14:15:22Z"    }  ]}

Withdraw what a user allowed an app DELETE

The app's grants and tokens for them end, its refresh tokens included, and each session it was signed in to that registered a `backchannel_logout_uri` gets a logout token; their next sign-in to it asks them again. Needs `org.users.edit`. Recorded as `user.consent_revoked`.

Delete a sending domain DELETE

Its name is free at once, and Synq removes it from its email provider. Refused while a brand sends from it. On any plan, so an org that moved down can clean up. Needs `org.emailDomains.edit`. Recorded as `email_domain.deleted`.