Step 4: Generate Consent Request Payload
Before calling the Consent Creation API, you must construct a Consent Request Payload in your backend application.
This payload defines:
- Who is requesting consent
- For whom the consent is (Data Principal), and whether they are an adult or a minor
- For a minor, whether the request must be routed to a verified parent or guardian (delegation)
- Which service the consent is for
- Purpose of processing
- Data categories involved
- Retention period
- Any additional metadata
🛠️ Using the Payload Builder UI
To simplify payload creation, you can use the provided UI:
- Configure company details, service information, purposes, and data categories
- Add multi-language consent content
- View a live preview of the consent notice as it will appear to users
- Once completed, download the generated JSON payload
This helps ensure correctness and reduces manual errors while creating the payload.
⚠️ Even when using the UI, always validate the payload in your backend before sending it to the API.
📌 Important
- The payload must strictly follow the Consent Request JSON Schema defined by Consent Manager.
- Payload creation must happen on your backend server.
- This payload will be used in Step 5: Call Consent Creation API.
- Version, RequestId, Fiduciary and Data Principal details must be properly set in the payload before calling the consent creation API.
- For a minor, set
subjectTypetoMINORand includedelegation. IfsubjectTypeis omitted, the Data Principal is treated as anADULT. - Note: Do not include Data Principal PII in the consent request payload; instead, send only the Data Principal Hash (DP Hash).
What Should Be Included?
The Consent Request Payload typically contains:
- Unique request reference ID
- Data Fiduciary (DF) details
- Data Principal hash
- Subject type (
subjectType):ADULTorMINOR; optional, defaults toADULT - Delegation (
delegation), only when the subject type isMINOR:required(route the request to a verified parent or guardian) andtype(currently onlyPARENT) - Service Details
- Notice Content in different languages (purposes & data categories)
- Retention period
- Optional metadata
📄 Consent Request JSON Schema
{
"$schema": "http://json-schema.org/draft-04/schema#",
"$id": "https://www.indiaconsent.com/schema/consent-request-v1.json",
"title": "ConsentRequest",
"description": "Schema for a Data Fiduciary to request consent from a Consent Manager",
"type": "object",
"required": [
"version",
"requestId",
"fiduciary",
"dataPrincipal",
"service",
"content",
"supersedesPrevious"
],
"properties": {
"version": {
"type": "string",
"description": "Version of schema"
},
"requestId": {
"type": "string",
"description": "Unique ID for this consent request generated by DF (idempotency key)"
},
"fiduciary": {
"type": "object",
"required": [
"fidId"
],
"properties": {
"fidId": {
"type": "string"
}
}
},
"dataPrincipal": {
"type": "object",
"required": [
"dpHash"
],
"properties": {
"dpHash": {
"type": "string",
"description": "DF-generated pseudonymous hash for the DP"
},
"subjectType": {
"type": "string",
"enum": [
"ADULT",
"MINOR"
],
"default": "ADULT",
"description": "Whether the DF asserts this Data Principal is an adult or a minor. Optional; defaults to ADULT when absent, for backward compatibility with existing integrations."
},
"delegation": {
"type": "object",
"description": "Present only when subjectType is MINOR",
"properties": {
"required": {
"type": "boolean",
"description": "Whether CM must route this request to a verified guardian before it can be viewed or actioned"
},
"type": {
"type": "string",
"enum": [
"PARENT"
],
"description": "Only PARENT is supported in this release"
}
}
}
}
},
"service": {
"type": "object",
"required": [
"id",
"name"
],
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string",
"description": "service name"
}
}
},
"content": {
"type": "object",
"required": [
"defaultLanguage",
"languages",
"company"
],
"properties": {
"defaultLanguage": {
"type": "string",
"description": "default language in which notice to be shown to DP"
},
"languages": {
"type": "array",
"minItems": 1,
"items": [
{
"type": "object",
"required": [
"lang",
"label",
"purposes"
],
"properties": {
"lang": {
"type": "string",
"description": "language code"
},
"label": {
"type": "string",
"description": "language label shown to the DP in notice"
},
"purposes": {
"type": "array",
"minItems": 1,
"items": [
{
"type": "object",
"required": [
"purposeId",
"purposeText",
"description",
"dataCategories",
"retention"
],
"properties": {
"purposeId": {
"type": "string",
"description": "Machine-readable ID for the purpose."
},
"purposeText": {
"type": "string",
"description": "Human-readable purpose label to be shown to DP."
},
"description": {
"type": "string",
"description": "Human-readable purpose description to be shown to DP."
},
"dataCategories": {
"type": "array",
"minItems": 1,
"items": [
{
"type": "object",
"required": [
"id",
"label"
],
"properties": {
"id": {
"type": "string",
"description": "Machine-readable category ID (DF-defined)"
},
"label": {
"type": "string",
"description": "User-visible text (CM will render as toggle label)"
},
"required": {
"type": "boolean",
"default": false,
"description": "If true, CM must disable toggle & show as mandatory"
}
}
}
]
},
"retention": {
"type": "object",
"required": [
"duration",
"unit"
],
"properties": {
"duration": {
"type": "integer",
"description": "Data retention duration for this purpose. DF-defined value, to be interpreted by the CM. E.g. if unit is 'month' and duration is 6, CM can show '6 Months' as retention period to DP. Its value can be 1 to 11 for unit 'month' and 1 to 5 for unit 'year'."
},
"unit": {
"type": "string",
"enum": [
"month",
"year"
]
}
}
}
}
}
]
}
}
}
]
},
"company": {
"type": "object",
"required": [
"companyName",
"privacyPolicyUrl",
"contactEmail",
"grievanceOfficer"
],
"properties": {
"companyName": {
"type": "string"
},
"logo": {
"type": "string"
},
"privacyPolicyUrl": {
"type": "string"
},
"termsOfServiceUrl": {
"type": "string"
},
"contactEmail": {
"type": "string",
"description": "contact email of company"
},
"grievanceOfficer": {
"type": "object",
"required": [
"name",
"email"
],
"properties": {
"name": {
"type": "string"
},
"email": {
"type": "string"
}
}
}
}
}
}
},
"supersedesPrevious": {
"type": "boolean",
"default": true
}
}
}
📄 Consent Request JSON Sample Payload
{
"version": "1.0",
"requestId": "3c14b629-ae66-48f1-b5d7-cafc2078c1a4",
"fiduciary": {
"fidId": "c8ab306d-0a53-4af1-9f3c-c4662df39500"
},
"dataPrincipal": {
"dpHash": "68fb2ced2daaf430ebd5c9eb",
"subjectType": "MINOR",
"delegation": {
"required": true,
"type": "PARENT"
}
},
"service": {
"id": "shopping.order.fulfilment",
"name": "Online Shopping & Order Fulfilment"
},
"content": {
"defaultLanguage": "en",
"company": {
"companyName": "AlignMyCareer",
"logo": "https://www.alignmycareer.com/app/favicon.ico",
"privacyPolicyUrl": "https://www.alignmycareer.com/privacy-policy",
"termsOfServiceUrl": "https://www.alignmycareer.com/terms",
"contactEmail": "contact@alignmycareer.com",
"grievanceOfficer": {
"name": "Charanjeet",
"email": "charanjeet@alignmycareer.com"
}
},
"languages": [{
"lang": "en",
"label": "English",
"purposes": [{
"purposeId": "order.placement",
"purposeText": "Order Placement & Fulfilment",
"description": "To place, process, ship, and deliver your orders purchased on our platform",
"dataCategories": [{
"id": "contact.fullname",
"label": "Full Name"
}, {
"id": "contact.email",
"label": "Email Address"
}, {
"id": "contact.address",
"label": "Shipping Address"
}
],
"retention": {
"duration": 1,
"unit": "year"
}
}, {
"purposeId": "payment.processing",
"purposeText": "Payment Processing & Refunds",
"description": "To process payments, refunds, charges, and transaction confirmations.",
"dataCategories": [{
"id": "payment.method",
"label": "Payment Method"
}, {
"id": "payment.status",
"label": "Payment Status"
}
],
"retention": {
"duration": 1,
"unit": "year"
}
}
]
}, {
"lang": "hi",
"label": "हिंदी",
"purposes": [{
"purposeId": "order.placement",
"purposeText": "ऑर्डर प्लेसमेंट और पूर्ति",
"description": "हमारे प्लेटफॉर्म पर खरीदे गए आपके ऑर्डर को प्लेस करने, प्रोसेस करने, शिप करने और डिलीवर करने के लिए।",
"dataCategories": [{
"id": "contact.fullname",
"label": "पूरा नाम"
}, {
"id": "contact.email",
"label": "मेल पता"
}, {
"id": "contact.address",
"label": "शिपिंग पता"
}
],
"retention": {
"duration": 1,
"unit": "year"
}
}, {
"purposeId": "payment.processing",
"purposeText": "भुगतान प्रसंस्करण और रिफंड",
"description": "पेमेंट, रिफंड, चार्जबैक और ट्रांज़ैक्शन कन्फर्मेशन को प्रोसेस करने के लिए।",
"dataCategories": [{
"id": "payment.method",
"label": "भुगतान विधि"
}, {
"id": "payment.status",
"label": "भुगतान की स्थिति"
}
],
"retention": {
"duration": 1,
"unit": "year"
}
}
]
}, {
"lang": "ta",
"label": "தமிழ்",
"purposes": [{
"purposeId": "order.placement",
"purposeText": "ஆர்டர் செய்தல் மற்றும் நிறைவேற்றுதல்",
"description": "எங்கள் தள த்தில் நீங்கள் வாங்கிய ஆர்டர்களைப் பதிவு செய்யவும், செயலாக்கவும், அனுப்பவும் மற்றும் டெலிவரி செய்யவும்.",
"dataCategories": [{
"id": "contact.fullname",
"label": "முழு பெயர்"
}, {
"id": "contact.email",
"label": "மின்னஞ்சல் முகவரி"
}, {
"id": "contact.address",
"label": "கப்பல் முகவரி"
}
],
"retention": {
"duration": 1,
"unit": "year"
}
}, {
"purposeId": "payment.processing",
"purposeText": "பணம் செலுத்துதல் செயலாக்கம் & பணத்தைத் திரும்பப் பெறுதல்",
"description": "பணம் செலுத்துதல், பணத்தைத் திரும்பப் பெறுதல், கட்டணம் வசூலித்தல் மற்றும் பரிவர்த்தனை உறுதிப்படுத்தல்களைச் செயல்படுத்த.",
"dataCategories": [{
"id": "payment.method",
"label": "பணம் செலுத்தும் முறை"
}, {
"id": "payment.status",
"label": "பணம் செலுத்தும் நிலை"
}
],
"retention": {
"duration": 1,
"unit": "year"
}
}
]
}
]
},
"supersedesPrevious": true
}
⚠️ Validation Requirements
Before sending the payload in Step 5:
- Ensure all required fields are populated.
- Ensure reference IDs are unique.
- Avoid sending null or unexpected attributes.
- Send
delegationonly whensubjectTypeisMINOR, and setdelegation.typetoPARENT(the only supported value).
Failure to follow the schema may result in:
400 Bad Request- Schema validation errors
- Rejected consent creation
🔒 Security Considerations
- Do not generate this payload in frontend/mobile applications.
- Avoid exposing internal identifiers.
- Sanitize user-provided values before embedding them into the payload.
➡ Next Step
In the next step, you will:
- Use this generated payload
- Attach your Access Token
- Call the Consent Creation API