Consent tracking

Atlas records a user's acceptance (or withdrawal) of a policy — Terms of Service, privacy, marketing, or any key you define — as versioned, append-only evidence. A new acceptance is a new row, never an update, so the full history survives for audit and DSAR.

Record a consent

curl -X POST "https://<fapi>/v1/users/<user_id>/consents" \
  -H "Authorization: Bearer sk_…" -H "content-type: application/json" \
  -d '{"policy":"tos","version":"2026-09-14","status":"accepted","source":"signup"}'

Scope: users:write. policy and version are required. status is accepted (default) or withdrawn. `ip` and `user_agent` are captured from the request, not the body — the record is evidence. Recording the same (policy, version, status) again is idempotent.

Read a user's consent history

curl "https://<fapi>/v1/users/<user_id>/consents" -H "Authorization: Bearer sk_…"

Scope: users:read. Returns every consent row newest-first:

{ "object": "list", "data": [
  { "object": "consent_record", "id": "con_…", "policy": "tos", "version": "2026-09-14",
    "status": "accepted", "source": "signup", "metadata": {}, "created_at": 1789412514613 }
]}

Pattern

• Record a consent at sign-up and whenever the user re-accepts a new policy version.

• The latest row per (user, policy) is the current standing; older rows are the paper trail.

• A withdrawal is a new status:"withdrawn" row — you never lose the prior acceptance.

• Pull the history into a DSAR export or your compliance store as needed.