Hosted consent

FCRA §604(b)(2) requires a clear, standalone disclosure and the consumer's written authorization before a consumer report for employment. Hosted consent gives you a page that gets it right; the result is a consentId you attach to orders and monitors.

curl -X POST https://api.primarycheck.com/v1/consents \
  -H "Authorization: Bearer pc_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "person": {
      "firstName": "Amy",
      "lastName": "Kowalski",
      "email": "amy@example.com"
    },
    "purpose": "employment",
    "state": "CA",
    "customerName": "Mercy Staffing"
  }'

{ "id": "cons_…", "status": "pending", "url": "https://primarycheck.com/consent/<token>",
  "disclosureVersion": "disclosure-2026-11-03.1", "stateAddons": ["CA"], "expiresAt": "…" }

Consent flow

1. Create the consent; send the url to the candidate (or embed it).
2. The candidate reads the disclosure, state add-ons and Summary of Rights, types their name and signs. IP, user agent, time and the exact text version are captured as evidence.
3. You receive consent.signed; GET /v1/consents/{id} shows status: signed.
4. Pass consent: { "consentId": "cons_…" } on verifications and monitors.

State add-ons

Added automatically from state: California (ICRAA/CCRAA check box for a free copy and file inspection rights), New York, Washington, Minnesota, Oklahoma, Massachusetts, New Jersey. Others are added as laws change; the text version is pinned per consent.

Your own consent flow

If you collect the disclosure and authorization yourself, send consent: { "disclosureVersion": "…", "signedAt": "…", "signerIp": "…" } instead. You remain responsible for the text and its standalone presentation.