Resolve which audiences a visitor is in
const url = 'https://api.ebitex.io/audience/delivery/v1/resolve';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"ctx":"example","visitor":"example","consent":{"cmp":"example","gpc":true,"dnt":true,"cmpString":"example"},"audiences":["2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"]}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.ebitex.io/audience/delivery/v1/resolve \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "ctx": "example", "visitor": "example", "consent": { "cmp": "example", "gpc": true, "dnt": true, "cmpString": "example" }, "audiences": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ] }'Call this from the presentation app, once when a session starts and again before the token expires or when something may have changed (a form was submitted, a sign-in link was followed). It returns the audiences the visitor is in and a signed audience token that proves them to Content: send it in the X-Ebitex-Audiences header on your Content requests. Content trusts nothing else: a list of audiences the caller assembled itself, in ctx or anywhere, selects and unlocks nothing. Content’s own delivery never calls this. The SDKs do all of this for you.
ctx is a flat object of the session’s own properties: a string, number, boolean or a list of those for each. Members under individual are reserved and refused. visitor is the device’s visitor token and consent its raw consent signals (cmp, gpc, dnt, cmpString); Audience resolves consent itself and uses what it knows about a person only when recognition is granted on that device. Otherwise the context alone decides, and recognised is false with the reason. audiences optionally narrows the answer to the audiences your content uses (read them from GET /content/delivery/v1/audiences; at most 64), which keeps the token small. A request that would need more than 64 is refused, and a token never silently drops one.
Every visitor gets a token, an anonymous one included. Each grant carries an assurance: verified (a stored member who proved control of their email), declared (a stored member) or context (an audience worked out from the context you sent, which anyone can obtain, so treat it as public copy). Only stored audiences can restrict access. An audience flagged for verified access is granted only while the visitor holds a live proof of an email address the person holds.
The token lasts 15 minutes and carries no personal data and no visitor identity. For a visitor who is not recognised the answer is the same for every visitor with the same context, and Audience keeps it briefly; for a recognised person it is theirs alone. The response is private, no-store: do not cache it in a shared cache.
This key is its own kind. With no origin or IP restriction it is a server key; with one it may be used from a browser, and the restriction is enforced on every request.
Key: audience.delivery.read
Authorizations
Section titled “Authorizations”Request Bodyrequired
Section titled “Request Bodyrequired”object
Examplegenerated
{ "ctx": "example", "visitor": "example", "consent": { "cmp": "example", "gpc": true, "dnt": true, "cmpString": "example" }, "audiences": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ]}Responses
Section titled “ Responses ”{ "audiences": [ "<audience id>", … ], "recognised": true, "reason": null, "access": { "token": "a1.…", "expiresAtUtc": "…", "grants": [ { "audienceId": "…", "assurance": "verified" | "declared" | "context" } ] } }. reason is token_invalid, session_token, revoked, recognition_not_granted or no_visitor when a presented visitor was not recognised.
validation_failed: ctx is not a flat object, is too large (8 KiB, 64 members) or names a reserved individual member. too_many_audiences: more than 64 audiences were named, or the visitor holds more than 64 and none were named.
invalid_api_key: the key is missing, revoked, expired or not an Audience delivery key.
missing_api_key or invalid_api_key: no key was sent, or it is unknown, revoked or expired.
origin_denied or ip_denied: the key’s restriction does not admit this request. app_not_available.
scope_denied: the key lacks this route’s scope. origin_denied or ip_denied: a browser-safe key was used from an origin or address outside its restrictions. app_not_available: Content is not enabled for the organization.
rate_limited: the key’s per-minute budget is spent; Retry-After says when it resets.
Quota exceeded; Retry-After says how long to wait. too_many_failed_authentications: too many bad keys from this address.