# Create Consents
source: https://developer.mastercard.com/consent-management/documentation/tutorials-and-guides/card-consents-tutorial/create-consents/index.md

## Overview {#overview}

This step creates a card consent by calling `POST /consents` with the cardholder's card details and a `notification` consent type. The API response determines whether 3DS authentication is required.

## Enter Card Details {#enter-card-details}

When the reference app is running, open <http://localhost:8081> and select **Card Consent Management API**. The form displays fields for the cardholder name, PAN, expiry date, and CVC.

![Card Consent Management API form with test case drop-down and card detail fields](https://static.developer.mastercard.com/content/consent-management/img/ref-app-card-consent.png)

Select a test case from the drop-down to pre-fill the form fields, or enter the card details manually. Select **Create Consent** to submit the form.

## Create Consent Request {#create-consent-request}

When the form is submitted, the reference app calls its own `/create-consents` endpoint, which sends a `POST /consents` request to the Consent Management \& Enrollment API.
* Java
* Python

```java
// ConsentsController.java

  @PostMapping("/create-consents")
  public String postConsents(CardDetails cardDetails, Model model) {

    ConsentsCreate request = new ConsentsCreate();
    request.setCardDetails(cardDetails);
    ConsentCreate consent = new ConsentCreate();
    consent.setName("notification");
    request.setConsents(Collections.singletonList(consent));

    try {

      Consents response = apiService.getApiClient().createConsents(request);
      log.info("Card reference: " + response.getCardReference());

      this.cardRef = response.getCardReference();
      String authType = response.getAuth().getType();

      StartAuthReq authReq = new StartAuthReq();
      authReq.setAuth(new Auth());

      if ("THREEDS" .equals(authType)) {
        // For 3DS we need to do fingerprinting in browser before we can start authentication
        Map<String, Object> params = response.getAuth().getParams();
        model.addAttribute("params", params);
        return "fingerprint";
      }

    } catch (ApiException e) {
      model.addAttribute(ERROR_MSG, e.getResponseBody());
    } catch (Exception e) {
      model.addAttribute(ERROR_MSG, e.getMessage());
    }

    return ERROR_TEMPLATE;
  }
```

```python
@app.route("/create-consents", methods=['GET', 'POST'])
def create_consents():
    """ handle create consent form """

    if request.method == 'POST':

        session["test_card_details"] = {
            "cardholderName": request.form["cardholderName"],
            "pan": request.form["pan"],
            "expiryMonth": request.form["expiryMonth"],
            "expiryYear": request.form["expiryYear"],
            "cvc": request.form["cvc"],
        }

        try:
            resp = api_create_consent(session["test_card_details"])

            session["card_ref"] = resp["cardReference"]
            session["auth_type"] = resp["auth"]["type"]
            session["auth_status"] = resp["auth"]["status"]

            if session["auth_type"] == 'THREEDS':
                # For 3DS we need to do fingerprinting in browser
                # before we can start authentication
                params = resp["auth"]["params"]

                return render_template('fingerprint.html', **params)

            if session["auth_status"] == 'AUTHENTICATED':
                return redirect(url_for('consents_info'))

        except:
            error_msg = resp
            return render_template('error.html', error_msg=error_msg)

    is_prod = configs.get("isProd").data in ["true", "True", "1"]
    return render_template('create-consent.html', is_prod=is_prod)
```

The reference app builds a `ConsentsCreate` request with the card details and a consent named `notification`, then calls the Consent Management \& Enrollment API `POST /consents`.

## API Response {#api-response}

![Example response in the reference app](https://static.developer.mastercard.com/content/consent-management/img/ref-app-card-consent-response.png)

The response contains the `cardReference` and an `auth` object that indicates whether authentication is required.

If the card is being enrolled for the first time, a new `cardReference` is returned. If consents already exist for this card, the existing `cardReference` is returned.

Consents that require authentication have a status of `REQAUTH`. The `auth.type` field indicates the authentication method.

```json
{
    "cardReference": "c851a2e6-1h6d-47f7-46d5-2489a8c29c86",
    "auth": {
        "status": "READY_TO_START",
        "type": "THREEDS",
        "params": { }
    },
    "consents": [
        {
            "id": "12345",
            "status": "REQAUTH",
            "name": "notification"
        }
    ]
}
```

When the `auth.type` is `THREEDS`, the response includes fingerprinting parameters in `auth.params`. The reference app renders the fingerprint page to begin the 3DS authentication flow.

The next step is [Handling 3DS Authentication](https://developer.mastercard.com/consent-management/documentation/tutorials-and-guides/card-consents-tutorial/handling-3ds-auth/index.md).