From a1828fa607b825a42b871c19174925115c3c2c9e Mon Sep 17 00:00:00 2001 From: Rob Brackett Date: Fri, 23 Sep 2016 16:09:40 -0700 Subject: [PATCH] Clarify how ask_user and allow_access work (#36) After all the discussion in #36, this attempts to improve the README for compliance server to explain how `/allow_access`, `/remove_access`, and `callbacks.ask_user` are intended to work together. NOTE the current code does not reflect this documentation; it still needs to be updated to fix #36. --- readme_compliance.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/readme_compliance.md b/readme_compliance.md index 15ec000..23cc158 100644 --- a/readme_compliance.md +++ b/readme_compliance.md @@ -116,7 +116,7 @@ Returns [`ReceiveResponse`](). ### POST :internal_port/allow_access -Allows access to users data for external user or FI. +Marks a particular transaction sender or sending domain as allowed to receive user data when they post to the [auth endpoint](#post-external_port-auth-endpoint) with the `need_info` parameter. If you have not marked the sender as allowed using this endpoint, the [`ask_user` callback](#callbacksask_user) will be called to determine whether user data can be sent. #### Request Parameters @@ -133,7 +133,7 @@ Will response with `200 OK` if saved. Any other status is an error. ### POST :internal_port/remove_access -Allows access to users data for external user or FI. +Remove a user or domain from list of allowed senders (as above in `:internal_port/allow_access`). #### Request Parameters @@ -183,7 +183,11 @@ When `202 Accepted` is returned the response body should contain JSON object wit ### `callbacks.ask_user` -If set in the config file, this callback will be called when the sender needs your customer KYC info to send a payment. If not set then the customer information won't be given to the other FI. +If set in the config file, this callback will be called when the sender of a transaction has requested information about the receiver of the transaction. The result of this callback indicates whether you are willing to share the receiver’s information (the `fetch_info` callback is used to actually retrieve the information that will be shared). + +If you have previously marked the transaction’s sender as allowed using the [`/allow_access` endpoint](#post-internal_portallow_access), this callback will be skipped. + +In cases where a person must manually approve information sharing, this callback should return a `202 Accepted` response with a `pending` time for the sender to retry (see below for details). #### Request