Consents — share a report safely - Swippee

Let the statement owner share a parsed report with a third party (a lender, CA, or landlord) without handing over an API key. You grant a scoped, expiring consent; the grantee redeems an opaque token and sees only the views you allowed. Every read is audit-logged, and you can revoke at any time.

curl -X POST https://api.swippee.com/v1/consents \
  -H "Authorization: Bearer swippee_sk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "report_id": "cl_abc123",
    "scopes": ["identity", "income", "verify"],
    "grantee_label": "Nabil Bank loan desk",
    "expires_in_days": 7
  }'

# → { "id": "...", "token": "swcon_…", "data_url": "…/v1/consents/:id/data?token=…",
#     "scopes": [...], "expires_at": "..." }

Valid scopes: identity, income, liabilities, verify, transactions. Expiry defaults to 30 days (max 365).

Redeem (grantee — token only, no API key)

curl 'https://api.swippee.com/v1/consents/:id/data?token=swcon_…'
# → { "scopes": [...], "data": { "identity": {...}, "income": {...} } }

List & revoke (owner)

curl https://api.swippee.com/v1/consents \
  -H "Authorization: Bearer swippee_sk_live_xxx"

curl -X POST https://api.swippee.com/v1/consents/:id/revoke \
  -H "Authorization: Bearer swippee_sk_live_xxx"
# after revoke, redeem returns 403 consent_inactive