The API
The API lets your own tools do what you would otherwise do in the dashboard: read choices, answer a visitor who asks what they agreed to, and publish a site. It is part of the Agency Plus plan.
Keys
An owner or admin makes keys under Settings, API keys. A key starts with cmk_ and belongs to one organisation. We show it once and store only a fingerprint, so copy it straight away. Revoke a key there as well; tools that use it stop working at once.
Send the key with every request:
curl https://cookiemark.com/api/v1/sites \
-H "Authorization: Bearer cmk_..."A key may make 120 requests a minute. Above that you get status 429; wait a minute and carry on.
List your sites
GET /api/v1/sites returns every site of the organisation with its ID, domain, script key, status and live version.
Read the consent log
GET /api/v1/sites/{id}/consents returns choices, newest first. It takes these parameters:
| Parameter | What it does |
|---|---|
since, until | Only choices in this period, as ISO dates such as 2026-10-01. |
limit | How many choices, up to 1,000. The default is 100. |
before | For the next page: the value of next_before from the previous answer. |
Each choice has the consent ID, the action, the three categories, the country, the language, the page, the banner version and the time. Shortened IP addresses and browser details stay in the dashboard.
Look up a consent ID
GET /api/v1/consents/{consent_id} returns every choice made under one consent ID, on any site of the organisation. Use it when a visitor quotes the ID from their preferences window and asks what they agreed to.
See the latest scan
GET /api/v1/sites/{id}/scan returns the findings, the checks and the cookies of the last finished scan.
Publish a site
POST /api/v1/sites/{id}/publish makes the current draft live, the same as the Publish button. You may send a note, which shows in the site's list of versions:
curl -X POST https://cookiemark.com/api/v1/sites/{id}/publish \
-H "Authorization: Bearer cmk_..." \
-H "Content-Type: application/json" \
-d '{"note": "New cookie list after the October scan"}'The answer holds the new version number.
Errors
Every error comes as JSON with an error field in plain English. 401 means the key is missing or revoked, 403 that the organisation is not on Agency Plus, 404 that the site is not in this organisation.