Consents

Search consents

Searches contact-grain consent observations for the credential’s scope, ordered by created_at (newest first). Filters combine with AND. Email and SMS consents for the same guest are separate rows. The API returns individual observations; when multiple rows exist for the same contact×purpose within a property group, effective eligibility is the most restrictive status among them. Paginated via limit/cursor. Requires scope read:consents.

GET

consents

Search consents

curl --request GET \
  --url https://api.casa-layer.com/v1/consents \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.casa-layer.com/v1/consents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.casa-layer.com/v1/consents",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.casa-layer.com/v1/consents"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.casa-layer.com/v1/consents")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "next_cursor": "<string>",
  "has_more": true,
  "data": [
    {
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "property_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "property_group_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "integration_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "source_id": "<string>",
      "source_version": "<string>",
      "contact_method": "email",
      "contact_value": "<string>",
      "status": "granted",
      "purpose": "marketing",
      "source_field": "<string>",
      "observed_at": "2023-11-07T05:31:56Z",
      "source_payload": {},
      "created_at": "2023-11-07T05:31:56Z",
      "updated_at": "2023-11-07T05:31:56Z",
      "guest_profile_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "source_updated_at": "2023-11-07T05:31:56Z"
    }
  ]
}

{
  "error": "invalid_cursor"
}

{
  "error": "unauthorized"
}

{
  "error": "forbidden",
  "scope": "read:guests"
}

Authorizations

Authorization

string

header

required

Authorization: Bearer <token>. Token types resolve to the same scoped credential: a user-generated API key (casa_…, from Account settings — recommended for machines and MCP clients), a WorkOS AuthKit session JWT (the web app; org and role come from verified token claims), or a static token. API keys are group-scoped, optionally pinned to one property at creation. MCP OAuth connector tokens authenticate the MCP server only and are rejected on these REST routes.

Headers

X-Property-Id

string<uuid>

Optional single-property drill-down. When set, narrows the request to this property; it must belong to the caller's group, else 403. A property-pinned API key is already narrowed and ignores this header.

Query Parameters

contact_value

string

Exact match on normalized contact value (e.g. email address or E.164 phone).

contact_method

enum<string>

Available options:

email,

sms,

phone,

postal,

whatsapp,

unknown

purpose

enum<string>

Available options:

marketing,

marketing_partner,

transactional,

payment_storage,

biometric_capture,

other

status

enum<string>

Available options:

granted,

denied,

withdrawn

integration_id

string<uuid>

guest_profile_id

string<uuid>

Filter to observations linked to this guest profile at ingest time (provenance only).

limit

integer

default:100

Page size — rows returned per call (1–500). This is NOT a cap on the total dataset: follow next_cursor to retrieve every matching row.

Required range: 1 <= x <= 500

cursor

string

Opaque pagination token from a previous response's next_cursor. Omit for the first page. A malformed token returns 400 invalid_cursor.

Response

Matching consent observations.

Keyset-pagination fields present on every list/search response. When has_more is true, re-request with cursor set to next_cursor; repeat until next_cursor is null to retrieve the full result set.

next_cursor

string | null

required

Opaque cursor for the next page, or null on the last page.

has_more

boolean

required

Whether another page exists.

data

object[]

required

Show child attributes

Search consents

curl --request GET \
  --url https://api.casa-layer.com/v1/consents \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.casa-layer.com/v1/consents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.casa-layer.com/v1/consents",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.casa-layer.com/v1/consents"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.casa-layer.com/v1/consents")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "next_cursor": "<string>",
  "has_more": true,
  "data": [
    {
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "property_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "property_group_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "integration_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "source_id": "<string>",
      "source_version": "<string>",
      "contact_method": "email",
      "contact_value": "<string>",
      "status": "granted",
      "purpose": "marketing",
      "source_field": "<string>",
      "observed_at": "2023-11-07T05:31:56Z",
      "source_payload": {},
      "created_at": "2023-11-07T05:31:56Z",
      "updated_at": "2023-11-07T05:31:56Z",
      "guest_profile_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "source_updated_at": "2023-11-07T05:31:56Z"
    }
  ]
}

{
  "error": "invalid_cursor"
}

{
  "error": "unauthorized"
}

{
  "error": "forbidden",
  "scope": "read:guests"
}

API documentation

Endpoints

Search consents

Authorizations

Headers

Query Parameters

Response