Ask for a sign-in link
const url = 'https://api.ebitex.io/audience/delivery/v1/sign-in';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"email":"example","audienceId":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","visitor":"example","returnUrl":"example","consent":{"cmp":"example","gpc":true,"dnt":true,"cmpString":"example"}}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.ebitex.io/audience/delivery/v1/sign-in \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "email": "example", "audienceId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "visitor": "example", "returnUrl": "example", "consent": { "cmp": "example", "gpc": true, "dnt": true, "cmpString": "example" } }'Call this when a visitor who is not let in by a verified access audience asks to sign in. It emails the address a single-use link, valid for 15 minutes. Following it and pressing the button on the page it opens proves the address for that visitor token (the one sent here), and the next resolve for it includes the audience as verified. There is no password, and nothing to store: resolve again after the visitor says they have followed the link.
email is the address; audienceId optionally names the audience the visitor is trying to get into, so the link is sent only if the person is in it; visitor is the device’s visitor token (either kind); consent is as for resolve. When the device has granted recognition the proof is remembered for 30 days, otherwise it lasts the session (at most 4 hours). returnUrl is where the page offers to take the visitor back: an https address (or http on localhost) without credentials, and, from a browser, the origin the request came from. It is shown as a link naming the site and is never followed automatically.
The answer never depends on the address. It is always 202 with the same body, whether the address is unknown, a non-member, throttled, or the organization has no email channel, so the route cannot be used to find out who is a member. At most three links are sent to one address in an hour. The response is private, no-store.
Key: audience.delivery.read
Authorizations
Section titled “Authorizations”Request Bodyrequired
Section titled “Request Bodyrequired”object
Examplegenerated
{ "email": "example", "audienceId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "visitor": "example", "returnUrl": "example", "consent": { "cmp": "example", "gpc": true, "dnt": true, "cmpString": "example" }}Responses
Section titled “ Responses ”202 with { "message": "…" }, always the same text.
invalid_api_key: the key is missing, revoked, expired or not an Audience delivery key.
missing_api_key or invalid_api_key: no key was sent, or it is unknown, revoked or expired.
origin_denied or ip_denied: the key’s restriction does not admit this request. app_not_available.
scope_denied: the key lacks this route’s scope. origin_denied or ip_denied: a browser-safe key was used from an origin or address outside its restrictions. app_not_available: Content is not enabled for the organization.
rate_limited: the key’s per-minute budget is spent; Retry-After says when it resets.
Quota exceeded; Retry-After says how long to wait. too_many_failed_authentications: too many bad keys from this address.