The CMPStack API
170 operations in 23groups, generated from the API’s own OpenAPI document. The same document is served live at /v1/openapi.json, with an interactive copy at /v1/docs.
Calling it
Every route is under https://api.cmpstack.io and answers JSON. A route is called one of three ways, and each operation says which.
- API key
- An API key, sent as
Authorization: Bearer <key>. Create one under Integrations → API keys. This is the way in for your own servers; it is the REST API group. - Public
- No credentials. These are what the tag calls from a visitor’s browser, and the free audit. They are rate-limited, and the tag’s routes only accept a request from the site the Site ID belongs to.
- Panel session
- A signed-in panel session, sent as
Authorization: Bearer <access token>. These are the routes the panel itself uses. They are documented because they are what the product does, not because they are a stable integration surface: for an integration, use an API key.
An error is a problem document (application/problem+json) with a status, a title and a detail written to be read by a person.
What we send an AI provider
Tracker classification may consult an AI provider for trackers our pattern engine cannot name. What it is sent is site-level evidence only: the cookie or storage KEY, the host it is set on, the hosts the page made requests to, script URLs with the query string and fragment removed, and a policy page observed on the site. It is never sent cookie VALUES, and never anything belonging to a visitor — no identifiers, no IP addresses, no page content. The boundary is a schema in the code rather than a rule: an evidence bundle carrying any other field is rejected, and the tracker is recorded as unknown instead. The provider and its processing region are deployment configuration; a deployment may run with no provider at all, in which case classification is pattern-only.
A provider is also asked to EXPLAIN a consent-enforcement finding in plain words. It is sent the finding type, the vendor name, and the page URL reduced to scheme, host and path — never a query string, which is where an identifier would be — together with the list of integrations this deployment can advise about. What comes back is stored separately from the finding, labelled as generated wherever it is shown, and kept out of the PDF report until an operator has read it. No finding, count or verdict is ever produced by a model.
What is shared between customers
A classified tracker is cached platform-wide, so the same tracker on two customers' sites is classified once. The cache key is a hash of the tracker's name, the hosts it talks to and whether it is first or third party — deliberately NOT the cookie's scope, which for a first-party cookie is the customer's own hostname. Nothing identifying a workspace is in the key or the row, which is precisely why two customers with the same tracker produce the same entry. A workspace may switch off contributing to it (Workspace → Shared tracker knowledge) and goes on reading it either way.
Every group
- REST APIFor your own servers, with an API key from Integrations: read consent decisions and domains. 2
- Public endpointsWhat the tag calls from a visitor's browser, and the free audit: no credentials, rate-limited. 8
- DomainsAdd, verify and remove the sites a workspace covers, and read their install instructions. 16
- ClientsGroup domains into clients, which is what a limited member is limited to. 3
- BannersRead, save and publish a domain's banner, and list the languages we ship text for. 9
- Consent recordsThe consent log: search it, read one record, export it. 4
- ComplianceThe compliance score and the rules behind it. 4
- ScannerStart scans and read what they found: cookies, requests, findings, reports. 13
- AnalyticsConsent rates and traffic over time. 5
- PortfolioEvery domain in the workspace at once, and actions across many of them. 10
- IntegrationsAPI keys, webhooks and the integration catalogue. 11
- MembersInvite people, set roles and limit a member to clients. 8
- WorkspaceWorkspace settings, branding and retention. 8
- BillingPlans, checkout and the subscription. 8
- NotificationsRead and mark the workspace's notifications. 2
- SearchOne search across domains, members and cookies. 1
- ActivityThe workspace's recent activity. 1
- SessionWho is signed in, and which workspaces they belong to. 1
- Sign-inRegistration, sign-in, two-factor and the hand-off between the site and a workspace. 18
- AccountA person's own account across workspaces: profile, security, subscriptions. 33
- ContactThe public contact form. 1
- UnsubscribeOne-click and confirmed unsubscribe from our own email. 3
- HealthWhether the API and what it depends on are up. 1