# Disclosure consent vs. CDR arrangements: what developers need to know

> The two-consent model that lets consumers share in one tap — and how it keeps onward sharing clean, scoped and revocable.

- Category: guides
- Audience: developers
- Updated: 2026-06-22
- Canonical: https://openfeed.au/resources/onward-disclosure-explained

---

A common point of confusion when building on openfeed is the relationship between the **CDR Arrangement** (the CDR Consumer's consent to a CDR Data Holder) and the **onward disclosure** (the
user's agreement to share with *your* app, technically called a _"grant"_). They are **deliberately** independent.

## Two consents, one tap

1. **CDR Arrangement**: established once per holder, through the full CDR flow, complies with the CDR Rules. Heavy by design.
2. **Onward Disclosure**: granted per app, in a single screen, because the data is already in
   openfeed. Governed by the Privacy Act and therefore the Australian Privacy Principles.

The key invariant: **revoking an onward disclosure does not cascade to the CDR arrangement.** A
consumer can turn off your app without losing their underlying connection.

## What this means for your integration

- Track the current status and definition of your apps grants by using the `GET /v1/app/grants` endpoint to track changes
- Poll changed grants through `GET /v1/grants/{grantId}` to synchronise downstream state
- Handle `403 disclosure_grant_required` by triggering grant information updates when encountered
- Treat consent as revocable at any time — design for graceful loss of access.

See the [quickstart](/resources/quickstart) for the full flow, and
[Grant management & lifecycle](/resources/grant-management-and-lifecycle) for querying,
amending and revoking grants.