Access Revocation in Parallel Developer Documentation

This is unreleased documentation for Parallel Developer Documentation Next 🚧 version.

For up-to-date documentation, see the latest version (Current – v2.x).

Version: Next 🚧

If you have ever initiated a flow for users to provide identity or accreditation information via our JavaScript SDK, then your records will be updated whenever that user updates their information. The user can, however, indicate that they would like to stop sharing their ongoing updates with you. In that case, you will still have full access to all of your data on the Parallel platform, but any data refreshes from the user will not be visible.

Additionally, partners have the ability to indicate that they no longer want to receive updates from users going forward. If you choose this option, you will still have full access to all of your data on the Parallel platform, but any data refreshes from the user will not be copied into your storage.

If someone at your organization indicates they'd like to remove access to individual or business data in the Parallel admin, or a user decides to stop sharing information, the Case Management API response will contain details about access expiration. This information is segmented by scope, or the type of information shared and appears in the API as fields prefixed with the scope of the expiring data. See the list of scopes for possible values:

• {scope}_link_access_expires_at — timestamp, after which your organization will not be able to access the connected individual or business data for the given scope
• {scope}_link_access_revoked_by — indicates which party has requested the access revocation

For example, if a user who has consented to share identity data revokes consent, the API response for that user's record will contain an identity_link_access_expires_at field with a timestamp value and an identity_link_access_revoked_by field with a value of subject.

Additionally, your organization's webhook(s) (if you have configured any) will receive a call with the connected entity ID and scope for which the access is scheduled to be revoked. Please see the Webhook Support section for more details.

When the access is set to be revoked, your organization will have a certain timeframe in which new updates are still copied to your storage. Generally access is revoked after the following amount of days after it's being scheduled:

• If someone at your organization has requested the revocation, then you will have 7 days before new updates will no longer be copied to your storage
• If the connected entity has requested the revocation, then you will have 30 days before new updates will no longer be copied to your storage.

The requester of access revocation may choose to cancel the revocation. In this case the {scope}_access_expires_at and {scope}access_revoked_by fields in the Case Management API response will return null and the access will not be revoked on the previously scheduled date.