Qscore consent granted by the holder
A consent link created with POST /v1/qscore/consents was granted: the holder opened the public page, connected their bank through open finance and authorized the request (their verified document matched the subject document). The consent now unlocks the positive banking data of the subject in new Qscore reports. previous_status is pending in practice; it is carried so a replay is easy to reconcile.
Every delivery includes X-Webhook-Event, X-Webhook-Event-ID, X-Webhook-Delivery-ID, X-Webhook-Timestamp and X-Webhook-Signature = hex(HMAC-SHA256(secret, timestamp + "." + body)). Respond 2xx; up to 5 attempts with incremental backoff.
Authorizations
Session JWT (from register/login) or API key (pk_...).
X-API-Key: <token> is accepted as an alternative header.
Body
person, company credit_evaluation, tenant_screening, hiring, supplier_onboarding, other granted Response
Return any 2xx to acknowledge the delivery.