# Confirm marketing consent

URL: /docs/api/storefront/consent-and-privacy/confirm-marketing-consent

## POST /v1/marketing/confirm

```http
POST https://api.elaraone.app/api/v1/marketing/confirm
```

### Parameters

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `X-Client-IP` | header | string |  | Optional. IP address of the shopper (one IPv4/IPv6, no port, no list). Honoured only together with a valid X-Tenant-Secret; ignored otherwise. Used for rate limits and recorded with form submissions. |
| `X-Tenant-Secret` | header | string |  | Optional here. Server secret of the store: server-to-server only, never from a browser. Enables X-Client-IP. |
| `Idempotency-Key` | header | string |  | Optional; recommended (a UUID made once per user action, reused only to retry that action). Only a success is stored (24 hours): the same key with the same body, URI and credentials (Authorization, X-Cart-Token, X-Chat-Token) replays it (`Idempotent-Replayed: true`); anything else under that key is 422 `IDEMPOTENCY_KEY_REUSED`. An error is never stored: after a 4xx or 5xx, retrying with the same key runs the request again. |

### Request body (`application/json`)

| Field | Type | Required | Description |
|---|---|---|---|
| `token` | string (nullable) |  | The single-use token from the confirmation email link (64 hex characters). |
| `phone` | string (nullable) |  | The phone number the form was submitted with, in any common format (e.g. 07700 900123 or +447700900123). |
| `code` | string (nullable) |  | The 6-digit code from the confirmation text message (spaces are ignored). |

### Responses

- **200**: See the schema.
- **402**: Payment required. Branch on `error.code`: - `TENANT_PAYMENT_REQUIRED`: this store is on payment hold. Show a "store temporarily unavailable" page; do not retry the request.
- **404**: Not found: `FEATURE_NOT_ENABLED` when this store does not have the CRM feature on.
- **409**: `IDEMPOTENCY_IN_PROGRESS`: a request with this Idempotency-Key is still being processed; retry shortly with the same key.
- **422**: Validation error Also 422 `CONSENT_CONFIRMATION_INVALID`: the link token or code is unknown, expired, already used or wrong, the number has nothing pending, or too many wrong codes were tried. One answer for every reason: it never tells whether an address is on the do-not-contact list. Ask the person to submit the form again for a new link or code. Also 422 `IDEMPOTENCY_KEY_REUSED`: this Idempotency-Key already belongs to a different request (body, URI or credentials).