[ARCHIVE] Amending Consent Scope

Archived 26/02/2024. Please see the CDS Guide on Authorisation and Consent.

Question

Is it possible to change the scope of a consent during an amendment? For example, if the original consent was created with an Account scope and then amended to include Transaction scope.

Answer

Scope amendment cannot occur once the Accredited Data Recipient (ADR) has commenced the authorisation process with the Data Holder (DH), meaning once the request object is sent to the DH via PAR or the Authorisation endpoint. The only actions that occur on the scopes from this point are either acceptance or rejection.

Question

Can an ADR change the scope of an authorisation from any combination to any new combination before the request object is created and sent to the DH for an amendment?

Answer

Yes, this is possible. The customer can manipulate the scopes in the UI provided by the ADR before the request object is sent to the DH for authorisation (but not afterward). The CDR rules require the ADR to allow opt-in of scopes that they wish to seek data for, so the customer can manipulate the scopes on the ADR side. Once redirected to the DH the consumer experience is required to show the scopes requested, but the customer cannot change these scopes at that point.