# Update member's consent details

`PUT /api/members/{memberId}/consent`

- **Products:** Operator (`FOH`), Consumer (`CONSUMER`) (any one of these products, not all)
- **Features:** Online Bookings (`ONLINEBOOK`), Online Joining (`ONLINEJOIN`), Front of House Generic Access (`FOHGENERIC`) (any one of these features, not all)

HTML version: [Update member's consent details](https://support.gladstonesoftware.cloud/reference/members/update-members-consent-details)

## Overview

Records the dates on which a member gave the consents the business is legally required to hold: online consent, privacy policy, terms and conditions, and the health commitment statement. It also records the name of the guardian who consented on behalf of a member under the age of consent.

This is a partial update, but the mechanism matters because it is easy to clear a consent by accident:

- **Omitting a field leaves the stored value alone.** An absent date means "no change".
- **Sending an explicit `null` clears the stored value.** Sending `"privacyPolicySignedDate": null` erases the date *and* marks the privacy policy as not signed. There is no other way to withdraw one of these consents through this endpoint, so do not send `null` as a filler.

Campaign and communication-channel consents are **not** part of this call. Use [Update member's campaign consent preferences](update-members-campaign-consent-preferences.md) and [Update member's communication channel consent preferences](update-members-communication-channel-consent-preferences.md) for those.

Send dates in UTC. Every date is rejected if it is in the future.

Linked members are permitted — a token issued for a member linked to `{memberId}` may call this endpoint.

## Endpoint

`PUT {base_url}/api/members/{memberId}/consent`

`{base_url}` is the environment URL issued to your integration. See [Authenticating with Gladstone APIs](../../guides/authenticating-with-gladstone-apis.md).

## Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `memberId` | integer (int32) | Yes | The member whose consent record is updated. Must match the member id in your access token, or be a member linked to it. |

## Request body

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `onlineConsentDate` | string (date-time) | No | When the member agreed to the online terms under which their account operates. Must not be in the future. Omit to leave the stored date alone; send `null` to erase it. If the member is younger than the tenant's marketing age of consent, supplying this date without a `onlineConsentGuardianName` is rejected with `400`. |
| `onlineConsentGuardianName` | string | No | The name of the parent or guardian who gave online consent for a member under the age of consent. Maximum 50 characters. Omit to leave the stored name alone — **but only if you also omit `onlineConsentDate`**: supplying a consent date for a member over the age of consent without a guardian name clears the stored guardian name. Supplying a guardian name without an `onlineConsentDate` (in the request or as a stored value being set) is rejected with `400`. |
| `privacyPolicySignedDate` | string (date-time) | No | When the member accepted the privacy policy. Must not be in the future. Omit to leave it alone. Sending a date also sets the member's privacy-policy indicator to *signed*; sending `null` clears the date **and** sets the indicator to *not signed*, which is how you record a withdrawal. |
| `termsandConditionsSignedDate` | string (date-time) | No | When the member signed the terms and conditions. Must not be in the future. Recorded as a dated agreement against the member rather than as a simple date on the member, so the tenant must have the `TermsAndConditions` agreement type configured — if it is missing the call fails with `500`. Omit to leave the existing agreement untouched. Note the lower-case `a` in `termsand`; the field name is spelled exactly as shown. |
| `healthCommitmentStatementSignedDate` | string (date-time) | No | When the member signed the health commitment statement (the pre-exercise health declaration). Must not be in the future. Recorded as a dated agreement in the same way as `termsandConditionsSignedDate`, with the same configuration requirement. Omit to leave the existing agreement untouched. |

## Sample request

```bash title="cURL"
curl -X PUT '{base_url}/api/members/{memberId}/consent' \
  -H 'Authorization: Bearer {accessToken}' \
  -H 'X-Use-SSO: true' \
  -H 'Content-Type: application/json' \
  -d '{
  "onlineConsentDate": "2026-08-14T19:00:00Z",
  "onlineConsentGuardianName": "string",
  "privacyPolicySignedDate": "2026-08-14T19:00:00Z",
  "termsandConditionsSignedDate": "2026-08-14T19:00:00Z",
  "healthCommitmentStatementSignedDate": "2026-08-14T19:00:00Z"
}'
```

## Errors

A successful call returns `204 No Content`.

| Status | Meaning | When |
|--------|---------|------|
| `400` | Bad request | The member is below the tenant's age of consent and `onlineConsentDate` was supplied without a guardian: `The member is under the age of consent and a guardian name is required.` |
| `400` | Bad request | `onlineConsentGuardianName` was supplied but there is no consent date to attach it to: `A consent date is required to change the guardian name.` |
| `400` | Bad request | A date is in the future, or `onlineConsentGuardianName` exceeds 50 characters (`The maximum length for Guardian Name is 50 characters`). Returned as a model-state object rather than a plain string. |
| `404` | Not found | No member exists with that id: `The member with the ID of {memberId} could not be found` |
| `500` | Internal server error | The tenant is missing the agreement-type configuration needed to record `termsandConditionsSignedDate` or `healthCommitmentStatementSignedDate`. The endpoint reports this as `500` with no body, not `422`. |
| `500` | Internal server error | `onlineConsentDate` was supplied for a member who has no date of birth recorded, or saving the change failed. |