Skip to content
Elara One docs
Consent and privacy

Confirm marketing consent

POST
/v1/marketing/confirm

Authorization

tenantKey
headerX-Tenant-Key<token>

The public store key (pk_live_…). Required on every call.

Header Parameters

X-Client-IP?string

Optional. IP address of the shopper (one IPv4/IPv6, no port, no list). Honoured only together with a valid X-Tenant-Secret; ignored otherwise. Used for rate limits and recorded with form submissions.

X-Tenant-Secret?string

Optional here. Server secret of the store: server-to-server only, never from a browser. Enables X-Client-IP.

Idempotency-Key?string

Optional; recommended (a UUID made once per user action, reused only to retry that action). Only a success is stored (24 hours): the same key with the same body, URI and credentials (Authorization, X-Cart-Token, X-Chat-Token) replays it (Idempotent-Replayed: true); anything else under that key is 422 IDEMPOTENCY_KEY_REUSED. An error is never stored: after a 4xx or 5xx, retrying with the same key runs the request again.

Request Body

application/json
  1. body

POST /api/v1/marketing/confirm: EITHER {token} (from the confirmation email's link) OR {phone, code} (the number the form was submitted with and the code texted to it). Shape only — whether the token or code is right is answered by the action, uniformly.

token?|

The single-use token from the confirmation email link (64 hex characters).

Lengthlength <= 128
phone?|

The phone number the form was submitted with, in any common format (e.g. 07700 900123 or +447700900123).

Lengthlength <= 32
code?|

The 6-digit code from the confirmation text message (spaces are ignored).

Lengthlength <= 16

Response Body

application/json
  1. response
data*
Example Request
curl -X POST 'https://api.elaraone.app/api/v1/marketing/confirm' \  -H 'X-Tenant-Key: pk_live_…' \  -H 'X-Tenant-Secret: your-server-secret' \  -H 'Content-Type: application/json' \  -d '{}'
Example Response
{  "data": {    "status": "confirmed"  }}

Get the cookie table GET

Every identifier the store's analytics and conversion tracking keep, on the device or on the servers, with its purpose, lifetime, consent category and when it is deleted; the ad click IDs and their windows; what is never used; and the register's version history. Render it as the store's cookie table (the page the consent banner links to). `register_version` is the version consent records store. Cache it for 5 minutes; revalidate with `If-None-Match` for a bodyless `304`.

Get chat settings GET

Next Page