Skip to content
Elara One docs
Consent and privacy

Get the cookie table

GET
/v1/privacy/cookies

Every identifier the store's analytics and conversion tracking keep, on the device or on the servers, with its purpose, lifetime, consent category and when it is deleted; the ad click IDs and their windows; what is never used; and the register's version history. Render it as the store's cookie table (the page the consent banner links to). register_version is the version consent records store. Cache it for 5 minutes; revalidate with If-None-Match for a bodyless 304.

Authorization

tenantKey
headerX-Tenant-Key<token>

The public store key (pk_live_…). Required on every call.

Header Parameters

X-Client-IP?string

Optional. IP address of the shopper (one IPv4/IPv6, no port, no list). Honoured only together with a valid X-Tenant-Secret; ignored otherwise. Used for rate limits and recorded with form submissions.

X-Tenant-Secret?string

Optional here. Server secret of the store: server-to-server only, never from a browser. Enables X-Client-IP.

If-None-Match?string

Optional. The ETag of an answer you already hold. While it is still current the answer is 304 Not Modified with no body (the ETag and Cache-Control headers are repeated); otherwise a normal 200 with the new ETag.

Response Body

Success.

application/json
  1. response
data*
Example Request
curl -X GET 'https://api.elaraone.app/api/v1/privacy/cookies' \  -H 'X-Tenant-Key: pk_live_…' \  -H 'X-Tenant-Secret: your-server-secret'
Example Response
{  "data": {    "register_version": "string",    "status": "string",    "updated": "string",    "categories": [      {        "key": "string",        "label": "string",        "consent_required": true,        "summary": "string"      }    ],    "identifiers": [      {        "key": "string",        "source": "platform",        "name": "string",        "mechanism": "string",        "cookie": {          "name": "string",          "first_party": true,          "http_only": true,          "secure": true,          "same_site": "string",          "max_age_months": 0,          "idle_timeout_minutes": 0        },        "set_by": "string",        "lifetime": "string",        "purpose": "string",        "category": "string",        "category_note": "string",        "stored_server_side": "string",        "deleted_when": "string"      }    ],    "click_ids": [      {        "parameter": "string",        "platform": "string",        "window_days": 0,        "note": "string"      }    ],    "never": [      {        "key": "string",        "title": "string",        "text": "string"      }    ],    "changelog": [      {        "version": "string",        "date": "string",        "change": "string",        "signed_off_by": "string",        "signed_off_on": "string"      }    ]  }}

Record a consent choice PUT

Records the shopper's choice from the banner, the "Cookie settings" link or the account page: a new consent record (the previous one is kept, marked superseded). Withdrawing is the same call with the category set to false. Answers `201` with the consent now in force, like `GET consent`, plus `consent_token`: keep it in the HttpOnly `consent` cookie for 12 months and forward it as `X-Consent-Token` from then on. A visitor id (`X-Visitor-Id`) is linked only when analytics is granted.

Confirm marketing consent POST

Next Page