Skip to content
Elara One docs
Consent and privacy

Get the consent in force

GET
/v1/consent

The shopper's consent now: what may be used (categories), the Google Consent Mode v2 signals, whether to show the banner (and why), and the current banner to render. Everything is denied until the shopper chooses, after 12 months, and after a change of purpose or a new major storage register version, until they answer again. Call it from the storefront server with the shopper's sid, vid and consent cookie values; send none of them and the answer is "no choice yet".

Authorization

tenantKey
headerX-Tenant-Key<token>

The public store key (pk_live_…). Required on every call.

Header Parameters

X-Client-IP?string

Optional. IP address of the shopper (one IPv4/IPv6, no port, no list). Honoured only together with a valid X-Tenant-Secret; ignored otherwise. Used for rate limits and recorded with form submissions.

X-Tenant-Secret*string

Required here. Server secret of the store: this route is server-to-server only, never from a browser. Also enables X-Client-IP.

X-Session-Id?string

Optional. The shopper's sid cookie value (8-128 of letters, digits, . _ : -).

X-Visitor-Id?string

Optional. The vid cookie value, when the shopper has one (it exists only with analytics consent). On PUT, linked to the record only when analytics is granted.

Response Body

Success.

application/json
  1. response
data*
Example Request
curl -X GET 'https://api.elaraone.app/api/v1/consent' \  -H 'X-Tenant-Key: pk_live_…' \  -H 'X-Tenant-Secret: string'
Example Response
{  "data": {    "record_id": 0,    "show_banner": true,    "reprompt_reason": "no_choice",    "choice": "accept_all",    "categories": {      "strictly_necessary": true,      "analytics": true,      "advertising": true,      "personalisation": true    },    "consent_mode": {      "ad_storage": "granted",      "ad_user_data": "granted",      "ad_personalization": "granted",      "analytics_storage": "granted",      "personalization_storage": "granted",      "functionality_storage": "granted",      "security_storage": "granted"    },    "recorded_at": "string",    "expires_at": "string",    "record_banner_version": 0,    "record_privacy_notice_version": "string",    "record_register_version": "string",    "consent_token": "string",    "delete_visitor_id": true,    "withdrawn": [      "analytics"    ],    "banner": {      "version": 0,      "privacy_notice_version": "string",      "title": "string",      "body": "string",      "labels": {        "accept_all": "string",        "reject_all": "string",        "manage": "string",        "save": "string",        "settings_link": "string"      },      "links": {        "privacy_notice": "string",        "cookie_table": "string"      },      "strictly_necessary": {        "label": "string",        "description": "string"      },      "categories": [        {          "key": "analytics",          "label": "string",          "description": "string"        }      ]    }  }}

Resolve a redirect GET

Previous Page

Record a consent choice PUT

Records the shopper's choice from the banner, the "Cookie settings" link or the account page: a new consent record (the previous one is kept, marked superseded). Withdrawing is the same call with the category set to false. Answers `201` with the consent now in force, like `GET consent`, plus `consent_token`: keep it in the HttpOnly `consent` cookie for 12 months and forward it as `X-Consent-Token` from then on. A visitor id (`X-Visitor-Id`) is linked only when analytics is granted.