Disclosure consent vs. CDR arrangements: what developers need to know

A common point of confusion when building on openfeed is the relationship between the CDR Arrangement (the CDR Consumer’s consent to a CDR Data Holder) and the onward disclosure (the user’s agreement to share with your app, technically called a “grant”). They are deliberately independent.

Two consents, one tap

1. CDR Arrangement: established once per holder, through the full CDR flow, complies with the CDR Rules. Heavy by design.
2. Onward Disclosure: granted per app, in a single screen, because the data is already in openfeed. Governed by the Privacy Act and therefore the Australian Privacy Principles.

The key invariant: revoking an onward disclosure does not cascade to the CDR arrangement. A consumer can turn off your app without losing their underlying connection.

What this means for your integration

• Track the current status and definition of your apps grants by using the GET /v1/app/grants endpoint to track changes
• Poll changed grants through GET /v1/grants/{grantId} to synchronise downstream state
• Handle 403 disclosure_grant_required by triggering grant information updates when encountered
• Treat consent as revocable at any time — design for graceful loss of access.

See the quickstart for the full flow, and Grant management & lifecycle for querying, amending and revoking grants.