POST /profiles/{user_id}/consents

User actively consents to data collection and processing of specific fields. Publishes consent grant event for auditing. Reference: GDPR Art 7 (Conditions for consent).

Request Parameters

Name	In	Type	Required	Default	Example	Constraints	Description
user_id	path	string	Yes				User ID

Request Body

Schema: dto.GrantConsentRequest

Field	Type	Required	Example	Constraints	Description
field_keys	array of string	Yes	['["health_data"', '"biometric_data"]']

Responses

Status	Description	Schema
200	Updated consent field list	dto.ConsentListDetailResponse
400	Invalid request parameters	dto.Problem
401	Unauthenticated or token expired	dto.Problem
403	No permission to operate this user's consent records	dto.Problem
404	User profile not found	dto.Problem
500	Internal server error	dto.Problem

Referenced Schemas

dto.ConsentField

Field	Type	Required	Example	Constraints	Description
consented	boolean	No	True
data_classification	string	No	sensitive
display_name	string	No	Health Data
field_key	string	No	health_data
requires_consent	boolean	No	True

dto.ConsentListDetailResponse

Field	Type	Required	Example	Constraints	Description
code	integer	No
data	dto.ConsentListResponse	No
message	string	No
timestamp	string	No

dto.ConsentListResponse

Field	Type	Required	Example	Constraints	Description
fields	array of See dto.ConsentField	No

dto.FieldViolation

Field	Type	Required	Example	Constraints	Description
code	string	No			Code is the error code (optional) Used for programmatic identification of error types, such as "required", "format", "range"
description	string	No			Description is a human-readable error description Should explain what rule was violated, such as "Must be a valid email address"
field	string	No			Field is the path to the error field Use dot notation for nested fields, such as "user.email" or "addresses[0].city"
value	object	No			Value is the value that caused the error (optional, used in development mode) May not be returned in production to avoid leaking sensitive information

dto.Problem

Field	Type	Required	Example	Constraints	Description
code	integer	No			Code is the business error code Used for programmatic handling of specific error scenarios Example: 30101001
detail	string	No			Detail is a human-readable explanation for this specific error instance Can include specific error details, such as "Field 'email' is required"
errors	array of See dto.FieldViolation	No			Errors is a list of field-level validation errors (extension field) Follows Web API standard practices, each error contains field name and error message
i18n_args	object	No			I18nArgs are internationalization parameters Used to dynamically fill translation templates
i18n_key	string	No			I18nKey is the internationalization key Used for client-side localization of error messages Example: "error.user_not_found"
instance	string	No			Instance is the specific URI reference where the problem occurred Usually the request URL, may include query parameters Example: "/api/v1/users?limit=invalid"
request_id	string	No			RequestID is the unique request identifier Used for log correlation and issue tracking Example: "req_550e8400-e29b-41d4-a716-446655440000"
retry_after	integer	No			RetryAfter is used for 429 Too Many Requests responses Indicates how many seconds the client should wait before retrying (RFC 6585)
service	string	No			Service is the service name Used in microservice architectures to locate the error source Example: "auth-service"
span_id	string	No			SpanID is the current span identifier Used to precisely locate the current node in a distributed trace
status	integer	No			Status is the HTTP status code generated Used by clients to distinguish problem types, does not change with Accept-Language Example: 400, 401, 403, 404, 500
timestamp	string	No			Timestamp is the error occurrence time ISO 8601 format Example: "2026-04-03T12:00:00Z"
title	string	No			Title is a short, human-readable summary of the problem type The same Type should always have the same Title (does not change per instance) Example: "Invalid Request Parameters"
trace_id	string	No			TraceID is the distributed tracing identifier Follows W3C Trace Context standard Example: "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01"
type	string	No			Type is a URI reference that identifies the problem type When dereferenced, should provide human-readable documentation Example: "https://api.example.com/errors/invalid-request"