docs · for developers
REST API
Everything the dashboard can do to a site, over HTTPS. 71 routes under /v1, authenticated with workspace tokens, described by an OpenAPI 3.1 document.
Authentication and scopes
curl https://api.cookiecrumbs.eu/v1/sites \
-H "Authorization: Bearer cc_…"Create tokens under Workspace settings → Developers (the secret is shown once) or with cookiecrumbs tokens create. Every route declares the scope it needs: sites:read, sites:write, banner:read, banner:write, banner:publish, scans:read, scans:run, logs:read, logs:export, analytics:read. Tokens can be bound to one site or environment and expire on a date you set.
The surface
| Group | What it covers |
|---|---|
| sites | List, create, read and update sites (PATCH /sites/:id: name, retention, settings), their domains and domain verification. |
| config | Read and write the draft (GET/PUT /sites/:id/config/draft), server-side validation (POST …/config/validate). |
| versions | Publish (POST /sites/:id/versions), list, roll back, promote preview to production. |
| scans | Queue and read scans, findings as JSON, CSV or SARIF (GET /scans/:id/findings?format=…), the diff against the previous run, the scan schedule (GET/PATCH /sites/:id/scan-schedule) and install checks (GET/POST /sites/:id/install-checks). |
| services | The recorded trackers: list, create, update, delete; compliance issues and their suppression (POST /issues/:id/suppress). |
| declaration | The public cookie list as .json, .html or .md, per language. |
| consents | Read consent records; subject IDs are masked without logs:export. |
| exports | Create and download signed proof exports. Downloads carry X-Content-SHA256, X-Signature-Ed25519 and X-Signing-Kid so anyone can verify the file against the published keys. |
| alerts · webhooks · templates · tokens | The alert inbox and alert channels, webhook endpoints and deliveries, banner templates (list, read, save, update, delete, apply), token management. |
| me · r | GET /v1/me describes the token; GET /v1/r resolves a visitor's country to a regime (used by the runtime). |
Billing endpoints exist but accept a signed-in user only, never a cc_* token.
Limits and errors
600 requests per minute per token. Errors are RFC 9457 problem+json with a stable type, so match on that rather than the message text.
The OpenAPI document
GET https://api.cookiecrumbs.eu/v1/openapi.json is the machine-readable contract, suitable for generating clients. The dashboard's Developers page links a rendered copy.