List a user's consents

GET /v1/users/{user_id}/consents · permission users:read

Lists the OAuth consents the user has granted to applications, newest first. Only active consents are returned: a consent that was revoked, or replaced by a newer consent of the same application, is not listed. The list pages forward only and returns no total count. The response does not include the text of the consent screen the user saw.

Request

Parameter In Required Description
user_id path yes User id, prefixed usr_.
limit query no Items per page, 1-100 (default 20).
after query no Cursor from list_metadata.after of the previous page of the same user.

before and order=asc are not supported and return 422.

Response

200 OK. Empty fields are null.

{
  "data": [
    {
      "id": "cns_01jb2k8m5c3f6t9w2y4b7d0g3k",
      "user_id": "usr_0a1b2c3d4e5f6g7h8j9k0m1n2p",
      "application_id": "app_0a1b2c3d4e5f6g7h8j9k0m1n2p",
      "api_id": "api_0a1b2c3d4e5f6g7h8j9k0m1n2p",
      "org_id": null,
      "scopes": ["openid", "profile", "orders:read"],
      "authorization_details_types": [],
      "granted_at": "2026-10-20T09:00:00Z",
      "consent_screen_version": "3",
      "locale": "en",
      "prompt_reason": "scope_expansion"
    }
  ],
  "list_metadata": {"before": null, "after": null}
}
Field Description
id Consent id, prefixed cns_.
application_id The application the consent was granted to.
api_id The API the consent is bound to, if any.
org_id The organization context the consent was granted in, if any.
scopes The granted scopes, sorted and unique.
authorization_details_types Granted rich authorization request types; empty when none.
consent_screen_version, locale The version and language of the consent screen the user accepted.
prompt_reason Why consent was asked: first, scope_expansion, prompt_consent or skip_consent (first-party application without a consent screen).

Errors

Every error is an application/problem+json body with a stable code.

HTTP code When
400 invalid_cursor The cursor is malformed or belongs to another list.
422 validation_failed limit is out of range, or before or an ascending order was sent.
404 not_found The user does not exist in this environment (or the id is malformed).
401 unauthenticated The API key is missing, invalid or revoked.
403 insufficient_permissions The key lacks the users:read permission.
429 rate_limited The rate limit was exceeded; honor Retry-After.
503 service_unavailable A dependency is temporarily unavailable; retry later.

Example

curl "https://api.eu.keenauth.com/v1/users/usr_0a1b2c3d4e5f6g7h8j9k0m1n2p/consents?limit=50" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

CLI: keenauth users consents list usr_0a1b2c3d4e5f6g7h8j9k0m1n2p --limit 50

Personal data

This endpoint carries personal data: consent records. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.