An authorisation expires at the earliest of: dashboard withdrawal; alternative-method withdrawal (when given effect, or 2 business days after receipt); the consumer ceasing to be eligible; receipt of a notice under rule 4.18AA or 4.20P of withdrawal of the related collection consent; 12 months after it was given; after the single disclosure for a single-occasion authorisation; the end of the authorised period as last amended; or expiry under another rule (for example clause 7.2 of Schedule 3). All authorisations to an accredited person expire when the data holder is notified of revocation or surrender of its accreditation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.