SaaSFlow
DevelopersAPIReferenceai_consents

List ai consents

List every AI provider SaaSFlow can send company data to, with the current disclosure for each (which agents use it, which models, what data leaves the account, where it is processed) and whether this company has an active consent. Providers without an active consent are still listed, with a null consent. AI features that need a provider stay blocked until consent is granted.

Authentication

You're not signed in. Either sign in at app.saasflow.com and reload (then pick sessionCookie), or paste a SaaSFlow sf_… API key in the bearerAuth field below.
GET
/companies/{companyId}/ai_consents

Authorization

Authorization<token>

A SaaSFlow API key (format sf_…) or an OAuth bearer token. Paste only the key — the proxy adds the Bearer prefix. Create an API key in Settings → Company settings → API keys — see API keys.

In: header

Path Parameters

companyId*string
Length1 <= length

Response Body

application/json

curl -X GET "https://example.com/companies/string/ai_consents"
[  {    "providerKey": "anthropic",    "providerName": "string",    "processingLocation": "string",    "disclosureVersion": 0,    "agents": [      {        "definitionId": "string",        "title": "string",        "description": "string",        "modelName": "string",        "permissions": [          "subscriptions:read"        ]      }    ],    "consent": {      "grantedAt": "string",      "grantedByUserId": "string",      "grantedByUserEmail": "string",      "disclosureVersion": 0    },    "consented": true,    "canApprove": true  }]

Transcript

Download the full session transcript as JSON Lines: every message and every tool call the agent made, which is the record to read when debugging what an agent actually did. Transcripts run to megabytes, so pass `tailBytes` to take only the end of the run (the cut is aligned to a line start). Without it a transcript that is too large is refused with 413. Content type is `application/x-ndjson`, not JSON.

Create ai consent

Grant this company consent to share data with one AI provider. Only a company owner can do this. Send the `disclosureVersion` that was actually shown to the person accepting: if the disclosure has changed since, the request is refused with 409 and the new disclosure has to be shown again. That keeps every recorded consent tied to the exact text it was given against.