The API
The API lets your own tools do what you would otherwise do in the dashboard: read choices, answer a visitor who asks what they agreed to, and publish a site. It comes with ten paid sites or more.
Keys
An owner or admin makes keys under Settings, API keys. A key starts with cmk_ and belongs to one organisation. We show it once and store only a fingerprint, so copy it straight away. Revoke a key there as well; tools that use it stop working at once.
Send the key with every request:
curl https://cookiemark.com/api/v1/sites \
-H "Authorization: Bearer cmk_..."A key may make 120 requests a minute. Above that you get status 429; wait a minute and carry on.
List your sites
GET /api/v1/sites returns every site of the organisation with its ID, domain, script key, status and live version.
Read the consent log
GET /api/v1/sites/{id}/consents returns choices, newest first. It takes these parameters:
| Parameter | What it does |
|---|---|
since, until | Only choices in this period, as ISO dates such as 2026-10-01. |
limit | How many choices, up to 1,000. The default is 100. |
before | For the next page: the value of next_before from the previous answer, as it came. It is empty on the last page. |
Each choice has the consent ID, the action, the three categories, the country, the language, the page, the banner version and the time. Shortened IP addresses and browser details stay in the dashboard.
Look up a consent ID
GET /api/v1/consents/{consent_id} returns every choice made under one consent ID, on any site of the organisation. Use it when a visitor quotes the ID from their preferences window and asks what they agreed to.
See the latest scan
GET /api/v1/sites/{id}/scan returns the findings, the checks, the cookies and the tracking IDs (such as Tag Manager and Google tag IDs) of the last finished scan.
Publish a site
POST /api/v1/sites/{id}/publish makes the current draft live, the same as the Publish button. You may send a note, which shows in the site's list of versions:
curl -X POST https://cookiemark.com/api/v1/sites/{id}/publish \
-H "Authorization: Bearer cmk_..." \
-H "Content-Type: application/json" \
-d '{"note": "New cookie list after the October scan"}'The answer holds the new version number.
Errors
Every error comes as JSON with an error field in plain English.
- 400: a date, cursor or consent ID is not in the right form.
- 401: the key is missing, wrong or revoked.
- 403: the organisation does not have the API; it comes with ten paid sites or more.
- 404: the site is not in this organisation.
- 409: the site cannot be published, because it is archived or all paid sites are live already.
- 429: more than 120 requests in a minute.
- 500: something went wrong on our side; try again in a minute.