# Get the consent in force

URL: /docs/api/storefront/consent-and-privacy/get-the-consent-in-force

The shopper's consent now: what may be used (`categories`), the Google Consent Mode v2 signals,
whether to show the banner (and why), and the current banner to render. Everything is denied
until the shopper chooses, after 12 months, and after a change of purpose or a new major
storage register version, until they answer again. Call it from the storefront server with the
shopper's `sid`, `vid` and `consent` cookie values; send none of them and the answer is
"no choice yet".

## GET /v1/consent

```http
GET https://api.elaraone.app/api/v1/consent
```

The shopper's consent now: what may be used (`categories`), the Google Consent Mode v2 signals,
whether to show the banner (and why), and the current banner to render. Everything is denied
until the shopper chooses, after 12 months, and after a change of purpose or a new major
storage register version, until they answer again. Call it from the storefront server with the
shopper's `sid`, `vid` and `consent` cookie values; send none of them and the answer is
"no choice yet".

### Parameters

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `X-Client-IP` | header | string |  | Optional. IP address of the shopper (one IPv4/IPv6, no port, no list). Honoured only together with a valid X-Tenant-Secret; ignored otherwise. Used for rate limits and recorded with form submissions. |
| `X-Tenant-Secret` | header | string | yes | Required here. Server secret of the store: this route is server-to-server only, never from a browser. Also enables X-Client-IP. |
| `X-Session-Id` | header | string |  | Optional. The shopper's `sid` cookie value (8-128 of letters, digits, `.` `_` `:` `-`). |
| `X-Visitor-Id` | header | string |  | Optional. The `vid` cookie value, when the shopper has one (it exists only with analytics consent). On `PUT`, linked to the record only when analytics is granted. |
| `X-Consent-Token` | header | string |  | Optional. The `consent` cookie value: the `consent_token` an earlier `PUT consent` returned. Remembers the choice across sessions, including "reject all". |

### Responses

- **200**: Success.
- **402**: Payment required. Branch on `error.code`: - `TENANT_PAYMENT_REQUIRED`: this store is on payment hold. Show a "store temporarily unavailable" page; do not retry the request.
- **403**: `TENANT_SECRET_INVALID`: `X-Tenant-Secret` is missing or wrong. This route is server-to-server only: call it from the storefront server, never from a browser.
- **422**: Validation error