Consent
Let Verifisha ask the subject, or attest consent you already hold.
Reports are gated on the subject's consent by default (requireConsent
defaults to true). You choose how that consent is obtained with
consent.mode on each report.
| Mode | Who asks the subject | Use it when |
|---|---|---|
VERIFISHA_HOSTED | Verifisha, through a consent link | You have no consent flow of your own. |
CUSTOMER_ATTESTED | You did, before calling the API | Consent is already part of your onboarding. |
Hosted consent
Create the report with hosted consent
"consent": {
"mode": "VERIFISHA_HOSTED",
"redirectUrl": "https://example.com/onboarding/complete"
}The report enters PENDING_CONSENT. The response's consentState carries
consentUrl — the link the subject approves on — and expiresAt.
The subject decides
The link opens a Verifisha consent page showing who is asking, the purpose
you gave, and every check that will run. The subject approves or declines, and
is returned to your redirectUrl.
The report proceeds, or stops
On approval the checks run. On refusal they do not.
After approving, the subject can see a summary of their own report — narrower than your view of it.
Write purpose for the subject, not for your own records. It is the sentence
they read before deciding.
Attested consent
If your own flow already collects consent, attest to it and the report runs without Verifisha contacting the subject:
"consent": {
"mode": "CUSTOMER_ATTESTED",
"obtained": true,
"obtainedAt": "2026-09-09T10:30:00Z",
"method": "CUSTOMER_WEB_FORM",
"policyVersion": "employment-screening-v3",
"evidenceReference": "consent-1042"
}These fields are your record of the consent. policyVersion names the wording
the subject agreed to; evidenceReference identifies where you keep the
underlying record, so it can be produced if the consent is ever questioned.
Attesting consent you have not obtained is not a shortcut. The attestation is retained against the report as the basis on which the checks ran.
Knowing where a report stands
GET /reports/{reportId}/consent/state
returns status — PENDING, APPROVED, DECLINED, EXPIRED or
NOT_REQUIRED — along with consentUrl and expiresAt.
A hosted link stops working at expiresAt, and the state becomes EXPIRED.
For progress without polling, subscribe to report.ready and report.failed
webhooks.