Get legal consent

Method	Path
GET	/v1/me/consent/legal

Authentication · Account routes · Access policies

Returns the signed-in practitioner's legal consent: which terms they accepted, when, and whether the acceptance is still active. Use it on app load to decide whether to ask for the terms again.

note

This is an account-level route. It has no /auth/tenant/ variant. Use the access token that a tenant sign-in returns.

Auth: Bearer token of a practitioner session (the profile must be a Practitioner). The caller's access policy must grant Consent:read and Consent:search. Project admins skip the access policy check. Scope: The caller's practitioner profile in the project of the token.

Request

No parameters.

Behaviour

• legal is null when the practitioner has never accepted the terms in this project.
• status is active or revoked. Publishing new terms revokes every acceptance of an older version, with revokedReason set to tos-updated. Withdrawing the acceptance revokes it with withdrawn. Both revokedAt and revokedReason are null while the consent is active.
• revokedAt is when the revoke happened. For tos-updated it is when the new terms were published, or null when that time is not known.
• termsUrl is the terms page the practitioner accepted. It is null unless it is an http(s) URL or an app-relative path.
• termsUpdatedAt is when the accepted terms were last updated, or null when that is not known.
• acceptedAt is when the practitioner accepted the terms.
• The published terms version is the one of the root project of your project tree: a child project follows its parent's terms. Without one, the platform-wide version applies.
• Answers are cached for up to one day. A consent write by the practitioner and the publication of new terms refresh them right away.
• To change the answer, use Accept or withdraw the terms. The older Get terms and conditions consent route returns only a boolean for the same acceptance.

Example

curl -X GET 'https://api.sandbox.ovok.com/v1/me/consent/legal' \
  -H "Authorization: Bearer ${OVOK_TOKEN}"

Successful response

200 — The legal consent. This example is an acceptance that new terms revoked.

{
  "legal": {
    "consentId": "0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b",
    "status": "revoked",
    "termsUrl": "https://app.example.com/legal/terms-and-conditions",
    "termsUpdatedAt": "2026-09-01T08:00:00.000Z",
    "acceptedAt": "2026-09-02T07:30:00.000Z",
    "revokedAt": "2026-10-01T09:00:00.000Z",
    "revokedReason": "tos-updated"
  }
}

Field	Type	Description
legal	object | null	The legal consent. null before the practitioner ever accepted the terms in this project.
legal.consentId	string	Id of the Consent resource that holds the acceptance.
legal.status	"active" | "revoked"	Whether the acceptance still counts.
legal.termsUrl	string | null	The terms page the practitioner accepted.
legal.termsUpdatedAt	string | null	When the accepted terms were last updated. ISO 8601.
legal.acceptedAt	string | null	When the terms were accepted. ISO 8601.
legal.revokedAt	string | null	When the acceptance was revoked. null while active.
legal.revokedReason	"tos-updated" | "withdrawn" | null	Why it was revoked. null while active.

Errors

Status	Meaning
401	The bearer token is missing or invalid.
403	The session is not a practitioner session, has no project, or its access policy lacks Consent:read or Consent:search.
429	Too many requests.
503	The access policy cannot be read for the moment. Retry shortly.