# Consent Management and Enrollment
source: https://developer.mastercard.com/consent-management/documentation/index.md

## Overview {#overview}

Consent Management \& Enrollment APIs enable secure, transparent enrollment into Mastercard services by capturing, storing, and managing explicit consent. They provide a standardized framework for partners and developers to authenticate consumers and enroll cards or users into cross-scenario consent management.

The service supports direct-to-consumer enrollment, partner-mediated enrollment, and bulk onboarding models where prior permission has already been captured through approved channels.

### Who It Is For {#who-it-is-for}

Consent Management \& Enrollment supports issuers, fintechs, and digital banking platforms that need to capture and manage explicit consumer consent before enrolling cards or users into Mastercard services. Common use cases include transaction notifications, expense management, and insights.

### Primary Capabilities {#primary-capabilities}

* **Consent Lifecycle Management:** Create, update, revoke, and audit consents throughout their lifecycle.
* **Enrollment Management:** Enroll cards or users into Mastercard services (such as [Transaction Notifications](https://developer.mastercard.com/transaction-notifications/documentation/)) through secure authentication and explicit consent capture.
* **Multi-Modal Support:** Capture consent and enrollment through API or Mastercard-hosted UI for PCI-sensitive environments.

### Capability Summary {#capability-summary}

The product supports three core patterns that a developer or AI agent can extract directly from the API model:

1. **Card-based enrollment:** A partner authenticates the consumer and collects explicit consent for a specific card. The resulting consent record can be used to enroll that card for transaction notifications or similar card-linked services.
2. **User and geo-based enrollment:** A partner captures a user or session context such as ZIP code, mobile number, or session ID, then receives a `consentToken` that can be reused with supported services such as Insight Tokens.
3. **Consent lifecycle control:** The same platform can manage the consent record over time by creating, updating, or revoking consent when the consumer's authorization changes or a program is no longer active.

These flows are designed to keep authorization explicit, make consent state traceable, and let downstream services consume a consent token without exposing card or personal data outside the approved enrollment context.

### Consent Types {#consent-types}

|        Type        |            Subject Key             |               Best for               |                                     Example                                     |
|--------------------|------------------------------------|--------------------------------------|---------------------------------------------------------------------------------|
| **Card-based**     | PAN                                | Enrollments tied to a specific card. | Cardholder consents to share Transaction Notifications with expense management. |
| **User/Geo-based** | ZIP code, phone number, session ID | Agentic commerce personalization.    | Partner captures a user's ZIP code to tailor recommendations.                   |

### Supported Services {#supported-services}

|                                             Service                                              |                                             Description                                             |      Type      |   Availability    |
|--------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|----------------|-------------------|
| [Transaction Notifications](https://developer.mastercard.com/product/transaction-notifications/) | Real-time notifications for card transactions, enabling users to track spending and receive alerts. | Card-Based     | North America, EU |
| [Insight Tokens](https://developer.mastercard.com/product/insight-tokens/)                       | Aggregated, geography-based insights into spending propensities by category.                        | User/Geo-based | North America     |

## How It Works {#how-it-works}

At a high level, the Consent Management \& Enrollment flow is consistent across models: a partner authenticates, captures explicit consent, creates or updates the consent record, and then receives a token or enrollment result that downstream Mastercard services can use. Card-based flows attach consent to a specific PAN, while user and geo-based flows use a broader identity or session context and return a `consentToken` for a service-specific enrollment.

![Consent Flow](https://static.developer.mastercard.com/content/consent-management/images/how-it-works-consent-api1.png "Consent Flow")

### Card-Based Consent {#card-based-consent}

Card-based consent supports three enrollment approaches to fit different operational contexts:

* **Consents API:** PCI-compliant organizations can integrate directly with the [Consents API](https://developer.mastercard.com/consent-management/documentation/use-cases/transaction-notifications/single-card-enrolment/apis/index.md) to build custom UI for authentication, consent capture, and acceptance.
* **Mastercard-hosted UI:** Organizations that are not PCI-compliant can use [Mastercard's hosted UI](https://developer.mastercard.com/consent-management/documentation/use-cases/transaction-notifications/single-card-enrolment/card-auth-consent-ui/index.md) for a secure, turnkey solution.
* **Bulk Consents API:** The [Bulk Consents API](https://developer.mastercard.com/consent-management/documentation/use-cases/transaction-notifications/bulk-card-enrolment/index.md) enables issuers and fintechs to enroll multiple users and cards when explicit permission has already been collected through card agreements, onboarding, or other approved processes.

### User Consent and Geo Enrollment {#user-consent-and-geo-enrollment}

User Consent / Geo Enrollment enables partners to enroll using geographic and session-level information rather than card credentials. Upon successful enrollment, the API returns a consentToken that represents the enrolled session.
Note: The user consent endpoint is currently in an exploratory phase, intended for testing purposes, and we welcome feedback.

The `consentToken` can then be used with participating Mastercard services that support this enrollment model. For example, Insight Tokens uses the Consent Management \& Enrollment API to enroll a shopping session by submitting a ZIP+4 code and session ID. The returned `consentToken` is then used to retrieve approved, aggregated propensity signals associated with the enrolled geographic area. These privacy-safe signals can help AI commerce agents personalize recommendations without exposing personal or transaction-level data. To learn more, see the [Insight Tokens](https://developer.mastercard.com/product/insight-tokens/) documentation.

### Integration at a Glance {#integration-at-a-glance}

|          Detail          |                                                                            Description                                                                            |
|--------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Authentication**       | OAuth 1.0a                                                                                                                                                        |
| **Transport Encryption** | TLS encryption on all requests                                                                                                                                    |
| **Sandbox Base URL**     | Single-card enrollment: `https://sandbox.api.mastercard.com/openapis/authentication` Bulk-card enrollment: `https://sandbox.api.mastercard.com/openapis/consents` |
| **Production Base URL**  | Single-card enrollment: `https://api.mastercard.com/openapis/authentication` Bulk-card enrollment: `https://api.mastercard.com/openapis/consents`                 |
| **Data Format**          | JSON request and response bodies                                                                                                                                  |

## Next Steps {#next-steps}

#### Use Cases {#use-cases}

Check out the use cases section to capture consent either through third-parties or on behalf of banks.

[Learn more →](https://developer.mastercard.com/consent-management/documentation/use-cases/index.md)

#### Developer Tooling {#developer-tooling}

Use the Consent Management \& Enrollment Postman Collection, Insomnia plug-in, and reference application to accelerate development.

[Learn more →](https://developer.mastercard.com/consent-management/documentation/developer-tools/reference-app/index.md)

#### API Reference {#api-reference}

Check out our API design in full.

[Learn more →](https://developer.mastercard.com/consent-management/documentation/api-reference/index.md)

#### Consent Management \& Enrollment UI {#consent-management--enrollment-ui}

Understand our consent flow, and use Mastercard UX without being PCI compliant.

[Learn more →](https://developer.mastercard.com/consent-management/documentation/use-cases/transaction-notifications/single-card-enrolment/card-auth-consent-ui/index.md)

#### Get Ready for Production {#get-ready-for-production}

Find out about the stages to progress your integration to production.

[Learn more →](https://developer.mastercard.com/consent-management/documentation/tutorials-and-guides/onboarding-checklist/index.md)

#### Talk to Us {#talk-to-us}

More questions? Let us help you.

[Learn more →](https://developer.mastercard.com/consent-management/documentation/support/index.md)