The consent section of BAP specifies a WebTokenID. This might be too specific as it is possible to use a smaller ID as long as is is a unique reference for the ReceiptService.

The larger web token also has the possibility of containing a subject ID - this is not a problem if it is encrypted and we don't have a key but we may need to specify this.

Also, we may want to consider the more generic reference to a ConsentRecord where a consent receipt is an example.