> ## Documentation Index
> Fetch the complete documentation index at: https://holder.docs.fiskil.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Phase 1: Consent authorisation

> Create CDR consents with a Pushed Authorisation Request (PAR) and validate your consent authorisation screens.

In the first phase, focus only on **consent authorisation** and the **Pushed Authorisation Request (PAR)** endpoint. The consents you create here are the CDR arrangements you use in every later phase.

Watch the demo before you begin:

[Demo of creating a consent authorisation in the Fiskil UAT environment](https://www.loom.com/embed/d8b1adef46cd42e1917e68845ad23f5c)

***

## How a consent request works

When an ADR wants a new consent, it calls the PAR endpoint with a set of parameters that describe the authorisation:

| Parameter | Description |
| - | - |
| **Sharing duration** | The consent period, in seconds, that applies if the consumer grants the consent. The maximum is 12 months (31,536,000 seconds). |
| **Scope** | The data sets the ADR will access if the consumer grants the consent. |
| **Response type** | The OAuth response type. Must be `code`. |
| **Response mode** | How the authorisation response is returned. Must be `jwt`. |

The scope changes based on the data sets the ADR requests. For the full list of data sets and their scopes, see [Authorisation Scopes](https://consumerdatastandardsaustralia.github.io/standards/#authorisation-scopes) in the Consumer Data Standards (CDS).

This example scope includes all Common, Banking, and Energy data sets:

```text Example scope theme={null}
openid profile common:customer.basic:read common:customer.detail:read bank:accounts.basic:read bank:accounts.detail:read bank:transactions:read bank:regular_payments:read bank:payees:read energy:accounts.basic:read energy:accounts.detail:read energy:accounts.concessions:read energy:accounts.paymentschedule:read energy:billing:read energy:electricity.servicepoints.basic:read energy:electricity.servicepoints.detail:read energy:electricity.der:read energy:electricity.usage:read
```

> [!TIP]
>
> Remove the scopes for data sets you don't hold. For example, an energy retailer can remove all `bank:` scopes.

***

## Create a consent

**1. Open the PAR page**

In the Mock Data Recipient sidebar, under **Consent**, select **PAR**.

**2. Enter the PAR parameters**

Complete the form:

* **Registration**: select the registration for your Data Holder.
* **CDR Arrangement**: select **Create new arrangement**.
* **SharingDuration (in Seconds)**: enter the consent period, for example `10000000` (about 116 days).
* **Scope**: enter the scopes to request.
* **Use PKCE**: leave this selected.
* **Response Type**: enter `code`.
* **Response Mode**: enter `jwt`.

![Pushed Authorisation Request form with SharingDuration set to 10000000, a full scope string, Use PKCE selected, Response Type set to code and Response Mode set to jwt](https://mintcdn.com/fiskil/bIha5bMxYOZihIVl/img/cdr-testing/par-request.png?fit=max\&auto=format\&n=bIha5bMxYOZihIVl\&q=85\&s=6abea35a3b994072d31e26dee67cb087)

An example PAR request. Response Type must be code and Response Mode must be jwt.

**3. Initiate the PAR**

Select **Initiate PAR**. The Mock Data Recipient returns an authorisation URL, a `request_uri`, and an `expires_in` value.

![PAR response showing an authorisation URL link followed by the request\_uri and an expires\_in value of 89](https://mintcdn.com/fiskil/bIha5bMxYOZihIVl/img/cdr-testing/par-response.png?fit=max\&auto=format\&n=bIha5bMxYOZihIVl\&q=85\&s=e4c282170d7cda30f4c8dd5ca12a66e4)

The PAR response. Select the authorisation URL to start the consent flow.

> [!NOTE]
>
> The `request_uri` expires after the `expires_in` period, in seconds. If it expires, initiate a new PAR.

**4. Complete the consent flow as the persona**

Select the authorisation URL. Enter the persona's email address, then enter the one-time password (OTP) sent to that inbox. Select the accounts to share and authorise the consent.

> [!TIP]
>
> The new consent appears under **Consent** > **Consents** in the Mock Data Recipient.

***

## What to validate

Repeat these checks for each [test persona](https://holder.docs.fiskil.dev/api-reference/cdr/testing/test-personas.md).

* Each persona can authenticate by entering their email address and the OTP they receive.
* After authentication, the consent flow lists the accounts that belong to the persona.
* The consent period on the authorisation screens changes to match the sharing duration you pass. Re-run the consent flow with different values to check:

  | Sharing duration passed | Expected result |
  | - | - |
  | Greater than `31536000` (one year) | The consent period is capped at 12 months |
  | Between `86401` and `31536000` | The consent period matches the value passed |
  | Between `1` and `86400` (24 hours) | A one-time collection is assumed |
  | `0` or absent | Once-off access is assumed, and only an access token (no refresh token) is issued |
  | A negative number | The authorisation fails |
* When you change the scope, the consent language changes to match, in line with the CDS [Consumer Experience Standards](https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience).

### Review the consent screens

Confirm that the consent authorisation screens show:

* The name of the ADR software product that requested the consent, with its accreditation number, on the first screen
* The period for which data will be accessed
* The types of data being requested
* A statement that consumers should not share their passwords in the CDR consent process
* A statement that the consumer can withdraw the consent at any time
* A clear, branded email containing the OTP
* Every account that belongs to the customer, so the customer can choose which accounts to share when they have more than one

> [!TIP]
>
> When every persona has an active consent and the screens meet the checks above, continue to [Phase 2: Data validation](https://holder.docs.fiskil.dev/api-reference/cdr/testing/data-validation.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.