# Callback API - Send Consent Response

#### <mark style="color:green;">Callback API - Send Consent Response (/api/v1/consent/transaction/callback)</mark>

This endpoint will be exposed by the service provider to receive authorization status from UAE PASS once the user accepts or rejects the document sharing contest request.

| API URL                 | {SP\_HOST\_URL}/api/v1/consent/transaction/callback                                                                                                                                                                                                                                                                                                                                                                                                     |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Method                  | POST                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Source                  | UAE PASS                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| Target                  | Service Provider (Data Owner)                                                                                                                                                                                                                                                                                                                                                                                                                           |
| SSL Enabled?            | YES                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Communication Mechanism | HTTPS                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Message Type            | JSON                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Security                | API KEY – needs to be shared with UAEPASS by service provider                                                                                                                                                                                                                                                                                                                                                                                           |
| Headers                 | <p>X-API-Key: refer to section <a href="api-security"><mark style="color:green;">API Authentication – UAEPASS to SP</mark> </a></p><p></p><p>X-Timestamp: \[time this request was generated, used in HMAC token generation] </p><p></p><p>X-UAEPASS-Signature: \[HMAC token] non-repudiation, needs to be implemented by service provider, refer to section <a href="api-security"><mark style="color:green;">API nonrepudiation – HMAC</mark> </a></p> |

#### Request Parameters

| Name                 | Type   | Mandatory/ Optional | Description                             |
| -------------------- | ------ | ------------------- | --------------------------------------- |
| spTransactionID      | String | M                   | Transaction id                          |
| Status               | String | M                   | Expected Values: \[ACCEPTED – REJECTED] |
| uaePassTransactionID | String | O                   |                                         |

#### Sample Request

```
{ 

  "spTransactionID": "m9mf2a64pk21v9nolu", 

  "status": "ACCEPTED", 

  "uaePassTransactionID": "cc8bd6a3-38aa-425b-98db-d3d792d8ce7f" 

} 
```

#### cURL Command

```
curl --location --request POST '/callback-url' \
--header 'X-UAEPASS-Signature;' \
--header 'X-Timestamp;' \
--header 'Authorization;' \
--header 'User-Agent: Apidog/1.0.0 (https://apidog.com)' \
--header 'Content-Type: application/json' \
--data-raw '{
    "spTransactionID": "string",
    "uaePassTransactionID": "string",
    "status": "string"
}'
```

### Response

#### Sample Success Response Format

* Just successful http status (200).&#x20;
* Don’t return http status code 200 with error messages and return proper http status error code like 401, 409 etc.