REST API
Everything the dashboard does with sites, banners, scans and consent records is available over a REST API with JSON bodies.
Authentication
Create an API key under Organisation → API keys (admins only). The key is shown once. Send it as a bearer token:
curl -H "Authorization: Bearer ccs_…" https://consent.pxl.as/api/v1/sitesA key belongs to one organisation and acts with admin rights in it. It cannot be used for account operations (passwords, passkeys, two-factor), to reach other organisations, or for anything that gives access or sends data elsewhere: creating API keys, inviting or changing members, and adding or changing notification channels. Those need a signed-in person. A key also never sees webhook signing secrets. Revoke a key from the same page; requests with it fail immediately.
Reference
The full, generated reference with every operation and schema is at /api/v1/docs, and the OpenAPI document at /api/v1/openapi.json.
Common tasks
| Task | Request |
|---|---|
| Create a site | POST /api/v1/sites |
| Register a domain | POST /api/v1/sites/{id}/domains |
| Publish a banner | POST /api/v1/sites/{id}/config/publish |
| Start a scan | POST /api/v1/sites/{id}/scans |
| All sites at a glance | GET /api/v1/portfolio |
| Look up a consent ID | GET /api/v1/sites/{id}/consents/{consent_id} |
| Export consent records | GET /api/v1/sites/{id}/consents/export.csv?from=…&to=… |
Errors
Errors use HTTP status codes with a JSON body listing each error's code and message. Plan limits answer 402 with PLAN_LIMIT or PLAN_FEATURE; a banner that fails the publish checks answers 422 with the findings.