Skip to main content
In the first phase, focus only on consent authorisation and the Pushed Authorisation Request (PAR) endpoint. The consents you create here are the CDR arrangements you use in every later phase. Watch the demo before you begin:
When an ADR wants a new consent, it calls the PAR endpoint with a set of parameters that describe the authorisation: The scope changes based on the data sets the ADR requests. For the full list of data sets and their scopes, see Authorisation Scopes in the Consumer Data Standards (CDS). This example scope includes all Common, Banking, and Energy data sets:
Example scope
Remove the scopes for data sets you don’t hold. For example, an energy retailer can remove all bank: scopes.
1

Open the PAR page

In the Mock Data Recipient sidebar, under Consent, select PAR.
2

Enter the PAR parameters

Complete the form:
  • Registration: select the registration for your Data Holder.
  • CDR Arrangement: select Create new arrangement.
  • SharingDuration (in Seconds): enter the consent period, for example 10000000 (about 116 days).
  • Scope: enter the scopes to request.
  • Use PKCE: leave this selected.
  • Response Type: enter code.
  • Response Mode: enter jwt.
Pushed Authorisation Request form with SharingDuration set to 10000000, a full scope string, Use PKCE selected, Response Type set to code and Response Mode set to jwt

An example PAR request. Response Type must be code and Response Mode must be jwt.

3

Initiate the PAR

Select Initiate PAR. The Mock Data Recipient returns an authorisation URL, a request_uri, and an expires_in value.
PAR response showing an authorisation URL link followed by the request_uri and an expires_in value of 89

The PAR response. Select the authorisation URL to start the consent flow.

The request_uri expires after the expires_in period, in seconds. If it expires, initiate a new PAR.
4

Complete the consent flow as the persona

Select the authorisation URL. Enter the persona’s email address, then enter the one-time password (OTP) sent to that inbox. Select the accounts to share and authorise the consent.
The new consent appears under Consent > Consents in the Mock Data Recipient.

​
What to validate

Repeat these checks for each test persona.
  • Each persona can authenticate by entering their email address and the OTP they receive.
  • After authentication, the consent flow lists the accounts that belong to the persona.
  • The consent period on the authorisation screens changes to match the sharing duration you pass. Re-run the consent flow with different values to check:
  • When you change the scope, the consent language changes to match, in line with the CDS Consumer Experience Standards.
Confirm that the consent authorisation screens show:
  • The name of the ADR software product that requested the consent, with its accreditation number, on the first screen
  • The period for which data will be accessed
  • The types of data being requested
  • A statement that consumers should not share their passwords in the CDR consent process
  • A statement that the consumer can withdraw the consent at any time
  • A clear, branded email containing the OTP
  • Every account that belongs to the customer, so the customer can choose which accounts to share when they have more than one
When every persona has an active consent and the screens meet the checks above, continue to Phase 2: Data validation.