Update member's consent details

PUT /api/members/{memberId}/consent

Products: Operator (FOH), Consumer (CONSUMER) (any one of these products, not all)
Features: Online Bookings (ONLINEBOOK), Online Joining (ONLINEJOIN), Front of House Generic Access (FOHGENERIC) (any one of these features, not all)

Overview

Records the dates on which a member gave the consents the business is legally required to hold: online consent, privacy policy, terms and conditions, and the health commitment statement. It also records the name of the guardian who consented on behalf of a member under the age of consent.

This is a partial update, but the mechanism matters because it is easy to clear a consent by accident:

Omitting a field leaves the stored value alone. An absent date means "no change".
Sending an explicit null clears the stored value. Sending "privacyPolicySignedDate": null erases the date and marks the privacy policy as not signed. There is no other way to withdraw one of these consents through this endpoint, so do not send null as a filler.

Campaign and communication-channel consents are not part of this call. Use Update member's campaign consent preferences and Update member's communication channel consent preferences for those.

Send dates in UTC. Every date is rejected if it is in the future.

Linked members are permitted — a token issued for a member linked to {memberId} may call this endpoint.

Endpoint

PUT {base_url}/api/members/{memberId}/consent

{base_url} is the environment URL issued to your integration. See Authenticating with Gladstone APIs.

Path parameters

Name	Type	Required	Description
`memberId`	integer (int32)	Yes	The member whose consent record is updated. Must match the member id in your access token, or be a member linked to it.

Request body

Field	Type	Required	Description
`onlineConsentDate`	string (date-time)	No	When the member agreed to the online terms under which their account operates. Must not be in the future. Omit to leave the stored date alone; send `null` to erase it. If the member is younger than the tenant's marketing age of consent, supplying this date without a `onlineConsentGuardianName` is rejected with `400`.
`onlineConsentGuardianName`	string	No	The name of the parent or guardian who gave online consent for a member under the age of consent. Maximum 50 characters. Omit to leave the stored name alone — but only if you also omit `onlineConsentDate`: supplying a consent date for a member over the age of consent without a guardian name clears the stored guardian name. Supplying a guardian name without an `onlineConsentDate` (in the request or as a stored value being set) is rejected with `400`.
`privacyPolicySignedDate`	string (date-time)	No	When the member accepted the privacy policy. Must not be in the future. Omit to leave it alone. Sending a date also sets the member's privacy-policy indicator to signed; sending `null` clears the date and sets the indicator to not signed, which is how you record a withdrawal.
`termsandConditionsSignedDate`	string (date-time)	No	When the member signed the terms and conditions. Must not be in the future. Recorded as a dated agreement against the member rather than as a simple date on the member, so the tenant must have the `TermsAndConditions` agreement type configured — if it is missing the call fails with `500`. Omit to leave the existing agreement untouched. Note the lower-case `a` in `termsand`; the field name is spelled exactly as shown.
`healthCommitmentStatementSignedDate`	string (date-time)	No	When the member signed the health commitment statement (the pre-exercise health declaration). Must not be in the future. Recorded as a dated agreement in the same way as `termsandConditionsSignedDate`, with the same configuration requirement. Omit to leave the existing agreement untouched.

Sample request

cURL

curl -X PUT '{base_url}/api/members/{memberId}/consent' \
  -H 'Authorization: Bearer {accessToken}' \
  -H 'X-Use-SSO: true' \
  -H 'Content-Type: application/json' \
  -d '{
  "onlineConsentDate": "2026-08-14T19:00:00Z",
  "onlineConsentGuardianName": "string",
  "privacyPolicySignedDate": "2026-08-14T19:00:00Z",
  "termsandConditionsSignedDate": "2026-08-14T19:00:00Z",
  "healthCommitmentStatementSignedDate": "2026-08-14T19:00:00Z"
}'

Errors

A successful call returns 204 No Content.

Status	Meaning	When
`400`	Bad request	The member is below the tenant's age of consent and `onlineConsentDate` was supplied without a guardian: `The member is under the age of consent and a guardian name is required.`
`400`	Bad request	`onlineConsentGuardianName` was supplied but there is no consent date to attach it to: `A consent date is required to change the guardian name.`
`400`	Bad request	A date is in the future, or `onlineConsentGuardianName` exceeds 50 characters (`The maximum length for Guardian Name is 50 characters`). Returned as a model-state object rather than a plain string.
`404`	Not found	No member exists with that id: `The member with the ID of {memberId} could not be found`
`500`	Internal server error	The tenant is missing the agreement-type configuration needed to record `termsandConditionsSignedDate` or `healthCommitmentStatementSignedDate`. The endpoint reports this as `500` with no body, not `422`.
`500`	Internal server error	`onlineConsentDate` was supplied for a member who has no date of birth recorded, or saving the change failed.

This page as markdown · All pages · llms.txt