TagConsent API Documentation

DPDP Act 2023 compliant consent management platform API

The TagConsent API allows you to programmatically manage consent collection, track analytics, configure webhooks, and generate compliance reports. All API endpoints are served over HTTPS from https://tagconsent.com/api.

Authentication

All API requests require authentication via a Bearer token in the Authorization header.

Authorization: Bearer YOUR_API_TOKEN

Obtain your token by logging in via the dashboard or the login endpoint:

{
  "email": "[email protected]",
  "password": "your_password"
}

Quick Start

Add the TagConsent banner to your website with one line of code:

<script src="https://tagconsent.com/sdk/consent.js"
  data-domain-id="YOUR_DOMAIN_ID"></script>

That's it! The consent banner will automatically appear for new visitors. You can customize the banner's appearance, position, and behavior from the dashboard.

Consent API

Domains API

{
  "domain": "example.com",
  "framework": "dpdp"
}

{
  "primaryColor": "#D97706",
  "theme": "light",
  "position": "bottom",
  "layout": "box",
  "language": "en",
  "showDeclineAll": true,
  "showPreferences": true,
  "respectGPC": true,
  "autoBlockCookies": true
}

Analytics API

Available periods: 7d, 30d, 90d, 12m

Webhooks API

{
  "url": "https://your-app.com/webhook",
  "description": "My integration",
  "events": ["consent.given", "consent.withdrawn"]
}

Supported Events

Billing API

Audit Reports API

JavaScript SDK

The TagConsent JavaScript SDK provides a simple way to integrate consent management into your website.

Installation

<script src="https://tagconsent.com/sdk/consent.js"
  data-domain-id="YOUR_DOMAIN_ID"></script>

Programmatic API

// Check if user has given consent
TagConsent.hasConsent('analytics'); // true/false

// Get all consent preferences
TagConsent.getPreferences();
// { necessary: true, analytics: true, marketing: false, preferences: true }

// Listen for consent changes
TagConsent.on('consent', function(data) {
  console.log('Consent updated:', data.action, data.categories);
});

// Show the consent banner programmatically
TagConsent.show();

// Withdraw consent
TagConsent.withdraw();

Webhook Security

Every webhook delivery includes a signature header for verification:

X-TagConsent-Signature: v1=<hmac_sha256_hex>
X-TagConsent-Timestamp: <unix_timestamp>
X-TagConsent-Event: consent.given

Verifying Signatures (Node.js)

const crypto = require('crypto');

function verifyWebhook(payload, signature, timestamp, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(timestamp + '.' + payload)
    .digest('hex');
  return 'v1=' + expected === signature;
}

// In your Express handler:
app.post('/webhook', (req, res) => {
  const sig = req.headers['x-tagconsent-signature'];
  const ts = req.headers['x-tagconsent-timestamp'];

  if (!verifyWebhook(JSON.stringify(req.body), sig, ts, WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  // Process the event
  console.log('Event:', req.body.event);
  res.status(200).send('OK');
});

Error Codes

Rate Limits