Site config

A site's SiteConfig controls everything about how the banner behaves for that property: theme, copy, categories, blocking mode, geo rules, IAB framework, consent persistence policy, and more. This is the same object consent.js fetches at runtime from GET /config/:cbid (the public, unauthenticated embed endpoint) — the /v1 routes below are the authenticated read/write path for managing it programmatically.

Requires the sites scope: sites:read to read, sites:write to save.

GET /v1/sites/:cbid/config

Returns the current config, or the default config if the site has never been configured (this endpoint never 404s for a config that doesn't exist yet — only for an unknown/foreign cbid).

curl https://api.cookiemunch.net/v1/sites/acme-com-9f3k/config \
  -H "Authorization: Bearer fck_…"

{
  "cbid": "acme-com-9f3k",
  "ver": 1,
  "banner": {
    "type": "multilevel",
    "layout": "bottom",
    "theme": { "background": "#0b0f1a", "text": "#f5f5f5", "highlight": "#5b8def" }
  },
  "categories": {},
  "blocking": { "mode": "auto" },
  "i18n": { "defaultCulture": "en", "autoDetect": true },
  "framework": "none",
  "consentMode": { "enabled": true, "mode": "advanced", "waitForUpdate": 500 },
  "defaultMode": "opt-in",
  "bots": { "suppress": true },
  "consent": { "version": 1 }
}

PUT /v1/sites/:cbid/config

Upserts the config. Send a full object or a partial patch — omitted top-level keys are left untouched (deep-merged over the existing config).

curl -X PUT https://api.cookiemunch.net/v1/sites/acme-com-9f3k/config \
  -H "Authorization: Bearer fck_…" \
  -H "Content-Type: application/json" \
  -d '{
    "blocking": { "mode": "auto", "ignoreSelectors": [".fc-first-party"] },
    "defaultMode": "opt-in",
    "framework": "iab"
  }'

{ "cbid": "acme-com-9f3k", "ver": 1, "framework": "iab", "blocking": { "mode": "auto", "ignoreSelectors": [".fc-first-party"] }, "...": "..." }

Key fields

Errors

400 with structured issues when the config fails v2 flow validation:

{
  "error": "invalid_config",
  "issues": [
    { "code": "unknown_start_view", "message": "flow.start references a view id that doesn't exist", "path": "flow.start" }
  ]
}

Note: Plan gating is enforced here too, not just in the dashboard UI. If your org is on the Free or Starter plan and you attempt to set framework: "iab", hide the "Powered by" branding (whiteLabel), or enable an experiment, the server silently strips those fields before saving rather than erroring — so a scoped automation key can never bypass plan limits, but it also won't tell you it happened. Check the response body against what you sent if a premium field doesn't seem to take effect.

Next: cookies, scan & verify to populate the cookie declaration this config's cookieTable element (if any) renders, or consent log, stats & export to read the decisions this config produces.