03 · Consent

Start an authentication.

Intake only writes a pending record; the factor is chosen and run later, inside the hosted surface that collection.url opens. Which payer's rules apply comes from selection_ref, never from the body.

Keep from the response: authentication_id, collection.url

Taught in: 03 · Consent

Read an authentication.

Poll this as the safety net; the callback is the primary path. A pending record has no factor and no expires_at; a failed one carries error_code and error_detail.

Keep from the response: status, expires_at

Taught in: 03 · Consent

Send the passcode.

Part of the hosted surface: a form post that answers with an HTML fragment, not JSON. contact_id must be one the consent decision offered for this member. The surface re-runs that decision on each send, so unique_patient_id, purpose and callback_url must be posted with it, and selection_ref too when the authentication was raised with one. Failures come back HTTP 200 with the message in the fragment.

Keep from the response: the re-rendered verify slot

Taught in: 03 · Consent

Verify the passcode.

Checks the passcode the member read back. Reads only authentication_id, contact_id and otp; the consent decision is not re-run. Answers with the receipt fragment on success, and HTTP 200 with the refusal in the fragment otherwise (PASSCODE_INCORRECT, PASSCODE_ATTEMPTS_EXHAUSTED, AUTHN_CONTACT_REQUIRED).

Keep from the response: the receipt fragment

Taught in: 03 · Consent