Get or refresh a visitor token and the consent state
const url = 'https://api.ebitex.io/audience/delivery/v1/visitors/session';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"visitor":"example","consent":{"cmp":"example","gpc":true,"dnt":true,"cmpString":"example"}}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.ebitex.io/audience/delivery/v1/visitors/session \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "visitor": "example", "consent": { "cmp": "example", "gpc": true, "dnt": true, "cmpString": "example" } }'Call this when a page loads, and again whenever your consent tool’s answer changes. It tells you whether this device may be recognised and gives you the token to use from now on. Nothing about the visitor is stored by this call.
visitor is the token the device already holds, if any. consent is what you know about the visitor’s consent: cmp (granted or denied, from your own consent banner), gpc and dnt (the browser’s Global Privacy Control and Do Not Track settings, which are also read from the request’s Sec-GPC and DNT headers) and cmpString (your banner’s own consent string, kept as evidence). Send what you saw; ebitex decides. The organization’s default applies when nothing is sent, and until an owner changes it that default is not to recognise.
Store the token only while consent.recognition is granted, and remove it as soon as it is not. When recognition is granted you receive a long-lived recognition token. When it is not, you receive a session token that expires a few hours after it was issued, whatever the visitor does, and that must not be kept across visits. A token that has been forgotten, has expired or does not verify is never an error: the response carries a fresh token instead.
consent.messages holds the organization’s own wording, in the visitor’s language, for a notice (recognitionDeclined), a confirmation (forgetConfirm) and a result (forgetDone). The response is private, no-store.
Key: audience.delivery.read
Authorizations
Section titled “Authorizations”Request Body
Section titled “Request Body”Examplegenerated
{ "visitor": "example", "consent": { "cmp": "example", "gpc": true, "dnt": true, "cmpString": "example" }}Responses
Section titled “ Responses ”{ "visitor": "v1.…", "consent": { "recognition": "granted" | "denied", "source": "cmp" | "globalPrivacyControl" | "doNotTrack" | "organizationDefault", "policyVersion", "tokenKind": "recognition" | "session", "tokenLifetimeSeconds", "messages": { … } } }.
invalid_api_key: the key is missing, revoked, expired or not an Audience delivery key.
missing_api_key or invalid_api_key: no key was sent, or it is unknown, revoked or expired.
origin_denied or ip_denied: the key’s restriction does not admit this request. app_not_available.
scope_denied: the key lacks this route’s scope. origin_denied or ip_denied: a browser-safe key was used from an origin or address outside its restrictions. app_not_available: Content is not enabled for the organization.
The body is larger than 16 KiB.
rate_limited: the key’s per-minute budget is spent; Retry-After says when it resets.
Quota exceeded; Retry-After says how long to wait. too_many_failed_authentications: too many bad keys from this address.