# User Consent Lifecycle

```mermaid {align="center" zoom="true"}
stateDiagram-v2
    [*] --> PENDING: PUT users/{userId}
    state PENDING {
        PENDING_TOS --> PENDING_IMAGE: PUT users/{userId}/termsOfService
        PENDING_IMAGE --> PENDING_CONSENT: POST users/{userId}/image
    }
    PENDING --> ACTIVE: PUT users/{userId}/consent
    PENDING --> [*]: DELETE users/{userId}<br>DELETE users/{userId}/consent
    ACTIVE --> [*]: DELETE users/{userId}<br>DELETE users/{userId}/consent
```

## States

Each state is left by calling the endpoint below.

### User level

These are set when the user first enrolls into the Salto Enrollment Service

- **PENDING_TOS** — TOS is contained within the Salto End User Licence Agreement, accept the terms of service with
  [`PUT /features/{featureId}/users/{userId}/termsOfService`](App/_api) ([Enrollment API](App/_api)) to
  move to `PENDING_IMAGE`.
- **PENDING_IMAGE** — Upload a valid image with
  [`POST /features/{featureId}/users/{userId}/image`](App/_api) ([Enrollment API](App/_api)) to move to
  `PENDING_CONSENT`.

### Site / Customer Level

These are set on a per-site / customer basis.

- **PENDING_CONSENT** — Grant consent with
  [`PUT /features/{featureId}/users/{userId}/consent`](App/_api) ([Enrollment API](App/_api)) to move to
  `ACTIVE`.
- **ACTIVE** — The user is enrolled. Remove them with
  [`DELETE /features/{featureId}/users/{userId}`](MMS/_api) ([Users API](MMS/_api)).

From **any** state the user leaves the lifecycle when their consent is revoked
with [`DELETE /features/{featureId}/users/{userId}/consent`](App/_api) ([Enrollment API](App/_api)) or
they are removed with [`DELETE /features/{featureId}/users/{userId}`](MMS/_api)
([Users API](MMS/_api)).

> [!important]
> Revoking consent removes the user — it does not return them to an earlier
> state. Once revoked, `GET users/{userId}` responds `400` with the error code
> `E002` (resource does not exist), and the user must be added again with
> [`PUT users/{userId}`](MMS/_api) to start a fresh enrollment. There is no
> status value representing a revoked user.