API reference · Credit

Credit consent

POST/credit-scoring/consentRecord a subject's consent for this tenant, for one purpose
GET/credit-scoring/consent/subject/{subjectReference}List this tenant's consents for one subject
DELETE/credit-scoring/consent/{reference}Withdraw a consent

POST Record a subject's consent for this tenant, for one purpose

POST /credit-scoring/consent

There is deliberately no blanket purpose: **consent given to be lent to is not consent to be marketed at.** A tenant wanting two purposes asks twice. Consent decays. Omitting expiresAt gives the platform maximum; asking for longer is refused. A permission that outlives the reason it was given stops being a permission and becomes a standing arrangement the subject has forgotten agreeing to. grantedVia and evidenceReference are not paperwork. The platform cannot observe whether consent was really obtained; what it can do is make the tenant state how, durably, so a subject disputing it later has something to point at.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live
`Content-Type`	application/json

Example

Request body: CreditConsentRequest · Response: CreditConsentResponse

curl -X POST "https://api.bridgemoni.com/credit-scoring/consent" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV" \
  -H "Content-Type: application/json" \
  -d '{
    "subjectReference": "text",
    "purpose": "LENDING",
    "expiresAt": "2027-03-14T14:30:01",
    "grantedVia": "text",
    "evidenceReference": "text"
  }'

{
  "subjectReference": "text",
  "purpose": "LENDING",
  "expiresAt": "2027-03-14T14:30:01",
  "grantedVia": "text",
  "evidenceReference": "text"
}

{
  "data": {
    "reference": "text",
    "subjectReference": "text",
    "purpose": "LENDING",
    "status": "ACTIVE",
    "grantedAt": "2027-03-14T14:30:01",
    "expiresAt": "2027-03-14T14:30:01",
    "revokedAt": "2027-03-14T14:30:01",
    "grantedVia": "text",
    "evidenceReference": "text"
  },
  "description": "Record a subject's consent for this tenant, for one purpose"
}

Responses

Status	When
`200`	Consent recorded
`400`	The requested term exceeds the maximum
`404`	This tenant holds no link to that subject - the same answer as for a subject that does not exist
`409`	A live consent for that purpose already exists

GET List this tenant's consents for one subject

GET /credit-scoring/consent/subject/{subjectReference}

Including spent ones, so the history of what was permitted is visible. Scoped to the calling tenant: no tenant can see the permissions a subject has given anybody else, because that a person is being credit-checked by four lenders is itself information about them.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`subjectReference`

Example

Response: List<CreditConsentResponse>

curl -X GET "https://api.bridgemoni.com/credit-scoring/consent/subject/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": [
    {
      "reference": "text",
      "subjectReference": "text",
      "purpose": "LENDING",
      "status": "ACTIVE",
      "grantedAt": "2027-03-14T14:30:01",
      "expiresAt": "2027-03-14T14:30:01",
      "revokedAt": "2027-03-14T14:30:01",
      "grantedVia": "text",
      "evidenceReference": "text"
    }
  ],
  "description": "List this tenant's consents for one subject"
}

Responses

Status	When
`200`	Consents, newest first

DELETE Withdraw a consent

DELETE /credit-scoring/consent/{reference}

**Immediate and unconditional.** A subject withdrawing consent does not have to explain why, and nothing about the withdrawal is recorded as adverse. Revoking an already spent consent succeeds quietly rather than erroring - withdrawal must never feel like something that can fail. The row is kept, not deleted: the subject is entitled to see that the permission existed and when it ended, and every access-log entry that relied on it would otherwise point at nothing.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`

Example

Response: CreditConsentResponse

curl -X DELETE "https://api.bridgemoni.com/credit-scoring/consent/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "reference": "text",
    "subjectReference": "text",
    "purpose": "LENDING",
    "status": "ACTIVE",
    "grantedAt": "2027-03-14T14:30:01",
    "expiresAt": "2027-03-14T14:30:01",
    "revokedAt": "2027-03-14T14:30:01",
    "grantedVia": "text",
    "evidenceReference": "text"
  },
  "description": "Withdraw a consent"
}

Responses

Status	When
`200`	Withdrawn

Generated from the OpenAPI document. Branch on the HTTP status: there is no machine-readable error code on the wire. Errors