> ## Documentation Index > Fetch the complete documentation index at: https://docs.timeback.com/llms.txt > Use this file to discover all available pages before exploring further. # Initiate the consent flow for a student and guardian > Machine-to-machine entry point for a partner system to start TimeBack's email consent flow for an explicit student and guardian: generates the DocuSign envelope and emails the guardian an HMAC-protected signing link. Gated on the consent.write scope and the caller owning the student's org. Returns 400 if the student's consent is already granted, or if a named guardian has no active relationship to the student. ## OpenAPI ````yaml /openapi/learn-with-ai/platform-api.yaml post /consent/1.0/students/{studentId}/consent-requests openapi: 3.1.1 info: title: TimeBack Platform API description: >- RESTful API for the TimeBack Platform. Covers authentication, rostering, curriculum, insights, assessments, content grading, and more. version: 2026.09.10.1 servers: - url: https://platform.dev.timeback.com description: integration security: [] tags: - name: Auth description: Authentication and authorization endpoints - name: Organizations description: Organizations module contains all endpoints around organization management - name: Applications description: Applications module contains all endpoints for managing LTI applications - name: Users description: >- Users module contains all endpoints around user creation, update and consultation - name: Students description: Students module contains all endpoints around student management - name: Demographics description: >- Demographics module contains all endpoints around demographics consultation - name: Consent description: >- Initiate and query TimeBack parental consent for a student, backed by an immutable audit trail. - name: Classes description: Classes module contains all endpoints around class management - name: Courses description: Courses module contains all endpoints around course management - name: Enrollments description: Enrollments module contains all endpoints around enrollment consultation - name: CASE description: Competency and Academic Standards Exchange (CASE) 1.1 API - name: Curriculum description: Curriculum module contains endpoints for managing curriculum data - name: Competency Track description: Competency track endpoints - name: Content Grading description: >- Registration and management of graders for free-response content items — bring-your-own external graders (Tier 2) and, once shipped, platform-managed grading prompts (Tier 1). - name: Caliper description: The Caliper module contains all endpoints around Caliper Analytics - name: Insights description: Coaching insights and session analytics endpoints paths: /consent/1.0/students/{studentId}/consent-requests: post: tags: - Consent summary: Initiate the consent flow for a student and guardian description: >- Machine-to-machine entry point for a partner system to start TimeBack's email consent flow for an explicit student and guardian: generates the DocuSign envelope and emails the guardian an HMAC-protected signing link. Gated on the consent.write scope and the caller owning the student's org. Returns 400 if the student's consent is already granted, or if a named guardian has no active relationship to the student. operationId: createConsentRequest parameters: - name: studentId in: path description: Unique identifier of the student required: true schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ConsentRequestInput' responses: '202': description: Consent request accepted '400': $ref: '#/components/responses/BadRequest11' '403': description: >- Caller does not own the student's organization, or consent management is disabled for it content: application/json: schema: $ref: '#/components/schemas/ApiError3' '404': description: Student or guardian not found content: application/json: schema: $ref: '#/components/schemas/ApiError3' '500': $ref: '#/components/responses/InternalError4' security: - CognitoUserPoolAuthorizer: - https://timeback-platform.trilogy.com/consent/scope/consent.write components: schemas: ConsentRequestInput: type: object properties: guardians: type: array minItems: 1 description: >- The parent/guardians to request consent from. Each entry carries the guardian's UUID and may optionally carry a corrected legal name. items: $ref: '#/components/schemas/GuardianConsentRequest' returnUrl: type: string format: uri description: >- URL the guardian's browser is redirected to after they finish signing in DocuSign. Applies to every guardian in this request. Required: the platform hosts no landing page, so the caller must supply where the guardian lands after signing. forceResend: type: boolean default: false description: >- Explicit signal that a repeat call is an intentional resend. With the default (false), a repeat call for a guardian who was already emailed reuses the envelope and sends no further email, regardless of elapsed time. Set true to re-email; a forced resend is still debounced by a short server-side window, so a double-click or retry cannot double-send. Applies to every guardian in this request. required: - guardians - returnUrl ApiError3: type: object properties: error: type: string description: Error name/type message: type: string description: Human-readable error message fields: type: array description: Validation errors for specific fields items: type: object properties: field: type: string message: type: string required: - error - message GuardianConsentRequest: type: object properties: id: type: string format: uuid description: UUID of the parent/guardian to request consent from. correctedFirstName: type: string minLength: 1 pattern: \S description: >- Corrected legal first name for the guardian. Must be supplied together with correctedLastName (both-or-neither); supplying only one field rejects the whole request with 400. When the corrected name differs from the guardian's stored name, it is written back to the system of record before the envelope is generated; any live pending envelope for that guardian is voided and a new one is issued and emailed, so the guardian must use the newest signing link. An identical name is a no-op. correctedLastName: type: string minLength: 1 pattern: \S description: >- Corrected legal last name for the guardian. Must be supplied together with correctedFirstName (both-or-neither); supplying only one field rejects the whole request with 400. required: - id imsxStatusInfoDType1: type: object properties: imsx_codeMajor: type: string imsx_severity: type: string imsx_description: type: string imsx_CodeMinor: type: object responses: BadRequest11: description: Bad request content: application/json: schema: $ref: '#/components/schemas/imsxStatusInfoDType1' InternalError4: description: Internal server error content: application/json: schema: $ref: '#/components/schemas/imsxStatusInfoDType1' securitySchemes: CognitoUserPoolAuthorizer: type: oauth2 description: >- OAuth 2.0 client credentials flow. Contact timeback@trilogy.com to request credentials for your application. flows: clientCredentials: tokenUrl: https://platform.dev.timeback.com/auth/1.0/token scopes: https://purl.imsglobal.org/spec/or/v1p2/scope/roster.readonly: roster readonly https://purl.imsglobal.org/spec/or/v1p2/scope/roster-core.readonly: roster-core readonly https://purl.imsglobal.org/spec/or/v1p2/scope/roster.createput: roster createput https://purl.imsglobal.org/spec/lti/v1p3/scope/lti.readonly: lti readonly https://purl.imsglobal.org/spec/or/v1p2/scope/roster-demographics.readonly: roster-demographics readonly https://timeback-platform.trilogy.com/consent/scope/consent.write: consent write https://timeback-platform.trilogy.com/consent/scope/consent.read: consent read https://purl.imsglobal.org/spec/or/v1p2/scope/roster-core.createput: roster-core createput https://purl.imsglobal.org/spec/or/v1p2/scope/roster.delete: roster delete https://purl.imsglobal.org/spec/or/v1p2/scope/roster-core.delete: roster-core delete https://purl.imsglobal.org/spec/case/v1p0/scope/case.readonly: case readonly https://purl.imsglobal.org/spec/case/v1p0/scope/case.createput: case createput https://purl.imsglobal.org/spec/case/v1p0/scope/case.delete: case delete https://timeback-platform.trilogy.com/competency-track/scope/competency-track.readonly: competency-track readonly https://timeback-platform.trilogy.com/competency-track/scope/competency-track.write: competency-track write https://timeback-platform.trilogy.com/competency-track/scope/competency-track.delete: competency-track delete https://timeback-platform.trilogy.com/content/scope/content.write: content write https://timeback-platform.trilogy.com/content/scope/content.read: content read https://purl.imsglobal.org/spec/caliper/v1p2/scope/events.write: events write https://purl.imsglobal.org/spec/caliper/v1p2/scope/events.readonly: events readonly https://timeback-platform.trilogy.com/webhooks/scope/webhooks.write: webhooks write https://timeback-platform.trilogy.com/webhooks/scope/webhooks.read: webhooks read https://timeback-platform.trilogy.com/webhooks/scope/webhooks.delete: webhooks delete ````