---
title: Get legal consent
sidebar_label: Get legal consent
sidebar_position: 12
description: Read which terms the signed-in practitioner accepted, when, and whether the acceptance is still active, with GET /v1/me/consent/legal.
---

# Get legal consent

| Method | Path |
| --- | --- |
| `GET` | `/v1/me/consent/legal` |

[Authentication](/authentication) · [Account routes](/authentication#account-routes) · [Access policies](/access-policies)

Returns the signed-in practitioner's legal consent: which terms they accepted, when, and whether the acceptance is still active. Use it on app load to decide whether to ask for the terms again.

:::note
This is an account-level route. It has no `/auth/tenant/` variant. Use the access token that a [tenant sign-in](/authentication) returns.
:::

**Auth:** Bearer token of a practitioner session (the profile must be a `Practitioner`). The caller's access policy must grant `Consent:read` and `Consent:search`. Project admins skip the access policy check.
**Scope:** The caller's practitioner profile in the project of the token.

## Request

No parameters.

## Behaviour

- `legal` is `null` when the practitioner has never accepted the terms in this project.
- `status` is `active` or `revoked`. Publishing new terms revokes every acceptance of an older version, with `revokedReason` set to `tos-updated`. Withdrawing the acceptance revokes it with `withdrawn`. Both `revokedAt` and `revokedReason` are `null` while the consent is active.
- `revokedAt` is when the revoke happened. For `tos-updated` it is when the new terms were published, or `null` when that time is not known.
- `termsUrl` is the terms page the practitioner accepted. It is `null` unless it is an `http(s)` URL or an app-relative path.
- `termsUpdatedAt` is when the accepted terms were last updated, or `null` when that is not known.
- `acceptedAt` is when the practitioner accepted the terms.
- The published terms version is the one of the root project of your project tree: a child project follows its parent's terms. Without one, the platform-wide version applies.
- Answers are cached for up to one day. A consent write by the practitioner and the publication of new terms refresh them right away.
- To change the answer, use [Accept or withdraw the terms](/authentication/account/update-legal-consent). The older [Get terms and conditions consent](/slim-apis/user/get-terms-and-conditions-consent) route returns only a boolean for the same acceptance.

## Example

```bash
curl -X GET 'https://api.sandbox.ovok.com/v1/me/consent/legal' \
  -H "Authorization: Bearer ${OVOK_TOKEN}"
```

## Successful response

`200` — The legal consent. This example is an acceptance that new terms revoked.

```json
{
  "legal": {
    "consentId": "0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b",
    "status": "revoked",
    "termsUrl": "https://app.example.com/legal/terms-and-conditions",
    "termsUpdatedAt": "2026-09-01T08:00:00.000Z",
    "acceptedAt": "2026-09-02T07:30:00.000Z",
    "revokedAt": "2026-10-01T09:00:00.000Z",
    "revokedReason": "tos-updated"
  }
}
```

| Field | Type | Description |
| --- | --- | --- |
| `legal` | `object \| null` | The legal consent. `null` before the practitioner ever accepted the terms in this project. |
| `legal.consentId` | `string` | Id of the Consent resource that holds the acceptance. |
| `legal.status` | `"active"` \| `"revoked"` | Whether the acceptance still counts. |
| `legal.termsUrl` | `string \| null` | The terms page the practitioner accepted. |
| `legal.termsUpdatedAt` | `string \| null` | When the accepted terms were last updated. ISO 8601. |
| `legal.acceptedAt` | `string \| null` | When the terms were accepted. ISO 8601. |
| `legal.revokedAt` | `string \| null` | When the acceptance was revoked. `null` while active. |
| `legal.revokedReason` | `"tos-updated"` \| `"withdrawn"` \| `null` | Why it was revoked. `null` while active. |

## Errors

| Status | Meaning |
| --- | --- |
| `401` | The bearer token is missing or invalid. |
| `403` | The session is not a practitioner session, has no project, or its access policy lacks `Consent:read` or `Consent:search`. |
| `429` | Too many requests. |
| `503` | The access policy cannot be read for the moment. Retry shortly. |