curl --request POST \
--url https://sandbox.rx.tera.health/v1/enrollments/{enrollment_id}/consents \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"consents": [
{
"document_code": "terms",
"version": "2026-01",
"accepted_at": "2026-10-21T14:57:30Z",
"evidence": {
"ip": "203.0.113.24",
"user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X)",
"checkout_id": "chk_2026_10_000123"
}
}
]
}
'const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
consents: [
{
document_code: 'terms',
version: '2026-01',
accepted_at: '2026-10-21T14:57:30Z',
evidence: {
ip: '203.0.113.24',
user_agent: 'Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X)',
checkout_id: 'chk_2026_10_000123'
}
}
]
})
};
fetch('https://sandbox.rx.tera.health/v1/enrollments/{enrollment_id}/consents', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://sandbox.rx.tera.health/v1/enrollments/{enrollment_id}/consents"
payload = { "consents": [
{
"document_code": "terms",
"version": "2026-01",
"accepted_at": "2026-10-21T14:57:30Z",
"evidence": {
"ip": "203.0.113.24",
"user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X)",
"checkout_id": "chk_2026_10_000123"
}
}
] }
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"data": [
{
"id": "0190f5c8-2b3c-7d4e-8f50-6a7b8c9d0e1f",
"document_code": "terms",
"document_version": "2026-01",
"accepted_at": "2026-10-21T14:57:30Z",
"withdrawn_at": null,
"source": "brand_api"
}
]
}Record consent proof
Proof that the patient accepted legal documents in your checkout, when it was not sent with the enrollment.
Documents still not accepted are shown to the patient on first open (GET /v1/patient/legal-documents).
Recording a document the patient already accepted keeps the first acceptance.
Error code: unknown_legal_document (422).
Scope: enrollments:write.
curl --request POST \
--url https://sandbox.rx.tera.health/v1/enrollments/{enrollment_id}/consents \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"consents": [
{
"document_code": "terms",
"version": "2026-01",
"accepted_at": "2026-10-21T14:57:30Z",
"evidence": {
"ip": "203.0.113.24",
"user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X)",
"checkout_id": "chk_2026_10_000123"
}
}
]
}
'const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
consents: [
{
document_code: 'terms',
version: '2026-01',
accepted_at: '2026-10-21T14:57:30Z',
evidence: {
ip: '203.0.113.24',
user_agent: 'Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X)',
checkout_id: 'chk_2026_10_000123'
}
}
]
})
};
fetch('https://sandbox.rx.tera.health/v1/enrollments/{enrollment_id}/consents', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://sandbox.rx.tera.health/v1/enrollments/{enrollment_id}/consents"
payload = { "consents": [
{
"document_code": "terms",
"version": "2026-01",
"accepted_at": "2026-10-21T14:57:30Z",
"evidence": {
"ip": "203.0.113.24",
"user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X)",
"checkout_id": "chk_2026_10_000123"
}
}
] }
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"data": [
{
"id": "0190f5c8-2b3c-7d4e-8f50-6a7b8c9d0e1f",
"document_code": "terms",
"document_version": "2026-01",
"accepted_at": "2026-10-21T14:57:30Z",
"withdrawn_at": null,
"source": "brand_api"
}
]
}Authorizations
A brand's server, one OAuth client per brand and environment. Get a token with the
client_credentials grant and send it as Authorization: Bearer <token>. Tokens last 1 hour.
A brand server reads status and ids only; it never reads clinical content. A platform partner holds one
client for all its brands and gets one token per brand, naming it with tenant_id.
Headers
A unique key per logical request, for example a UUID. Retrying with the same key and the same body
within 24 hours returns the first response (with Idempotent-Replayed: true) instead of creating a duplicate.
The same key with a different body is refused with 422 idempotency_key_reused.
8 - 255Path Parameters
Body
1 - 20 elementsShow child attributes
Show child attributes
Response
The consent records, one per document.
Show child attributes
Show child attributes