When your end user withdraws the access they gave you to their bank data, revoke the bank consent of their session. Neonomics asks the bank to revoke the consent and stops using it. The session is kept, so the end user can grant a new consent on it later.

🚧
Beta
Consent revocation is a beta feature. It is only available for the Danish banks listed under Supported banks, and it may still change. Every other bank answers with error 1063.

How it works

You call DELETE /ics/v3/session/{sessionId}/consent.
Neonomics checks that the session exists and belongs to your application.
Neonomics asks the bank to revoke the consent.
Only when the bank confirms, or reports that the consent is already gone, does Neonomics drop the consent's bank token and mark the consent revoked. You get 200 OK.

If the bank cannot or will not revoke the consent, you get an error and nothing changes: the consent stays usable.

Request

DELETE /ics/v3/session/{sessionId}/consent

Header	Required	Description
`Authorization`	yes	`Bearer {access_token}`
`x-device-id`	yes	The device id the session was created with.

Query parameter	Required	Description
`scope`	no	The consent scope to revoke. Only `accounts` is accepted, and it is the default; any other value is rejected with error `1051`.
`customer-type`	no	`PERSONAL`, `BUSINESS` or `CORPORATE`: the category of accounts the consent was granted for. Only needed for a consent granted before consent revocation was available; otherwise the recorded one is used, and `PERSONAL` when neither is known. Any other value is rejected with error `1002`.

curl -X DELETE "https://sandbox.neonomics.io/ics/v3/session/{sessionId}/consent" \
  -H "Authorization: Bearer {access_token}" \
  -H "x-device-id: {deviceId}"

Response

{
  "sessionId": "3f7c0a52-6b1e-4f1c-9a43-0e9d2c7b5a10",
  "outcome": "BANK_CONFIRMED",
  "revokedAt": "2026-10-16T12:00:00Z"
}

Field	Description
`sessionId`	The session the consent was granted through.
`outcome`	`BANK_CONFIRMED` when this call revoked the consent at the bank. `ALREADY_REVOKED` when there was nothing left to revoke: the bank reported the consent already gone, or an earlier call revoked it.
`revokedAt`	When the consent was revoked, as an ISO-8601 UTC instant. It may include fractional seconds.

Both outcomes mean the consent is revoked. Treat them the same way.

Repeating the call

Revoking is safe to repeat. A second call for a revoked consent returns 200 with outcome: ALREADY_REVOKED and the revokedAt of the original revocation, without calling the bank again.

Errors

HTTP	Code	When	What to do
510	1002	`customer-type` is not `PERSONAL`, `BUSINESS` or `CORPORATE`.	Send a valid value, or leave it out.
510	1020	The session does not exist, was deleted, or was created with a different `x-device-id`.	Check the session id and the device id.
510	1049	The session belongs to another application.	Use the application that created the session.
510	1051	The scope is not `accounts`.	Send `scope=accounts`, or leave scope out.
510	1062	There is no bank consent to revoke: the session holds none, or the bank never issued one because the consent flow was not completed.	Nothing to revoke. Nothing changed.
510	1063	Consent revocation is not supported for this bank.	Ask the end user to withdraw the consent in their bank's online banking.
520		Internal Neonomics error.	Retry later. Nothing changed.
530	bank error	The bank call failed.	Retry later. Nothing changed.

See Error codes for the full list.

After revocation

The session stays valid. Account requests with it fail with error 1426 until the end user grants a new consent.
If your application has detailed session status enabled, GET /ics/v3/session/{sessionId} with the header x-detailed-info: true returns the revocation time as consentExpiresAt, in epoch milliseconds.
To get a new consent, start the consent flow again with GET /ics/v3/consent/{sessionId}.

🚧
One consent per session
A session holds one bank consent at a time. When the end user grants a new consent on the same session, it replaces the previous one, which can then no longer be revoked through Neonomics. To end a consent, revoke it before starting a new one on the same session.

Supported banks

Consent revocation is available in Denmark, for these banks:

Banks on the BEC platform: Andelskassen Fælleskassen, Arbejdernes Landsbank, Coop Bank, Danske Andelskassers Bank, FasterOikos, Frørup Andelskasse, Frøslev-Mollerup Sparekasse, Fynske Bank, Hvidbjerg Bank, Lollands Bank, Lægernes Bank, Maj Bank, Merkur Andelskasse, Møns Bank, Nykredit Spar Nord, PenSam, SEB and Vestjysk Bank
Banks on the Bankdata platform: Djurslands Bank, Jyske Bank, Kreditbanken, Ringkjøbing Landbobank, SJF Bank, Skjern Bank and Sydbank
Danske Bank
Lunar
Nordea

Other banks, including the banks on the SDC platform, answer with error 1063. More banks will be added.