API reference
Workspace
Workspace settings, branding and retention.
GET
/v1/workspaceThis workspace's name and address
Needs: A signed-in panel session, sent as Authorization: Bearer <access token>.
| Status | Body | When |
|---|---|---|
| 200 | WorkspaceDto |
| Field | Type | What it is |
|---|---|---|
| id required | string | |
| name required | string | |
| slug required | string | The subdomain this workspace answers on. |
| url required | string | The workspace's own sign-in URL. |
| consentRetentionMonths required | number | Months a consent record is kept before it is deleted automatically. Records are never deleted any other way. |
| shareTrackerEvidence required | boolean | Whether this workspace's tracker observations are shared. What is shared is a fact about a tracker (its name, the hosts it talks to, what it is for), with nothing that identifies the workspace. Turning it off costs nothing: scans still use what is already shared. |
GET
/v1/workspace/brandingThis workspace's branding for client-facing documents
Needs: A signed-in panel session, sent as Authorization: Bearer <access token>.
| Status | Body | When |
|---|---|---|
| 200 | BrandingDto |
| Field | Type | What it is |
|---|---|---|
| allowed required | boolean | Whether this workspace's plan may brand client-facing documents. True on Agency and Enterprise; false on Starter and Professional. |
| senderName required | string | null | Who a document says it is from. Null falls back to the workspace name. |
| accentColor required | string | null | #rrggbb, or null for the default rule colour. |
| headingColor required | string | null | #rrggbb for headings, or null for the documents' own ink. |
| logo required | string | null | The stored logo as a data: URL, or null. |
| logoType required | string | null | |
| updatedAt required | string | null |
PATCH
/v1/workspace/brandingSet the logo, accent colour and sender name
Agency and Enterprise only. A logo is a base64 data URL of a PNG or a JPEG, at most 256 KB, and is checked by its magic bytes rather than by the media type it declares. Send logo: null to remove it.
Needs: A signed-in panel session, sent as Authorization: Bearer <access token>.
| Field | Type | What it is |
|---|---|---|
| senderName | string | null | |
| accentColor | string | null | Six-digit hex only. The accent colours rules and a bar on the cover, never text, so a customer cannot pick a colour that makes their own report unreadable — which is the usual way a colour field goes wrong. |
| headingColor | string | null | The second brand colour, used for headings. Six-digit hex. Because it is used for text, a colour without at least 4.5:1 contrast on white is refused, so reports stay readable. |
| logo | string | null | The logo as a data:image/png;base64,… or data:image/jpeg;base64,… URL, at most 256 KB, or null to remove it. The file's contents are checked, not only the media type it declares. |
| Status | Body | When |
|---|---|---|
| 200 | BrandingDto |
| Field | Type | What it is |
|---|---|---|
| allowed required | boolean | Whether this workspace's plan may brand client-facing documents. True on Agency and Enterprise; false on Starter and Professional. |
| senderName required | string | null | Who a document says it is from. Null falls back to the workspace name. |
| accentColor required | string | null | #rrggbb, or null for the default rule colour. |
| headingColor required | string | null | #rrggbb for headings, or null for the documents' own ink. |
| logo required | string | null | The stored logo as a data: URL, or null. |
| logoType required | string | null | |
| updatedAt required | string | null |
PATCH
/v1/workspace/consent-retentionHow long this workspace keeps its consent records
Changes the setting only. Nothing is deleted by this call. Records older than the period are removed by the nightly clean-up, and records are never deleted any other way.
Needs: A signed-in panel session, sent as Authorization: Bearer <access token>.
| Field | Type | What it is |
|---|---|---|
| months required | number | Months a consent record is kept before the nightly purge removes it. Three years by default. Never shorter than the consent it proves, so the floor is twelve months; "forever" is not a retention policy, so the ceiling is ten years. Example: 36 |
| Status | Body | When |
|---|---|---|
| 200 | WorkspaceDto |
| Field | Type | What it is |
|---|---|---|
| id required | string | |
| name required | string | |
| slug required | string | The subdomain this workspace answers on. |
| url required | string | The workspace's own sign-in URL. |
| consentRetentionMonths required | number | Months a consent record is kept before it is deleted automatically. Records are never deleted any other way. |
| shareTrackerEvidence required | boolean | Whether this workspace's tracker observations are shared. What is shared is a fact about a tracker (its name, the hosts it talks to, what it is for), with nothing that identifies the workspace. Turning it off costs nothing: scans still use what is already shared. |
PATCH
/v1/workspace/nameChange the workspace name
The name shown in the workspace switcher, in every notification email and in the operator console. Does not move the workspace — the address is unchanged.
Needs: A signed-in panel session, sent as Authorization: Bearer <access token>.
| Field | Type | What it is |
|---|---|---|
| name required | string | The workspace's display name. Free text with no uniqueness rule — this is the label, not the address. Use PATCH /v1/workspace/slug to move the workspace to a different subdomain. Example: "Acme Inc" |
| Status | Body | When |
|---|---|---|
| 200 | WorkspaceDto |
| Field | Type | What it is |
|---|---|---|
| id required | string | |
| name required | string | |
| slug required | string | The subdomain this workspace answers on. |
| url required | string | The workspace's own sign-in URL. |
| consentRetentionMonths required | number | Months a consent record is kept before it is deleted automatically. Records are never deleted any other way. |
| shareTrackerEvidence required | boolean | Whether this workspace's tracker observations are shared. What is shared is a fact about a tracker (its name, the hosts it talks to, what it is for), with nothing that identifies the workspace. Turning it off costs nothing: scans still use what is already shared. |
GET
/v1/workspace/resolve/{slug}Where does this workspace address point?
Needs: Nothing. This route is public.
| Name | Where | Type | What it is |
|---|---|---|---|
| slug required | path | string |
| Status | Body | When |
|---|---|---|
| 200 | WorkspaceResolutionDto |
| Field | Type | What it is |
|---|---|---|
| exists required | boolean | False for an address no workspace has ever used. |
| slug | string | null | The address this workspace currently answers on. Null when unknown. |
| moved required | boolean | True when the address asked for is a former one — the caller should redirect to url rather than serve the workspace on a stale hostname. |
| url | string | null |
PATCH
/v1/workspace/slugChange the workspace address
The previous address keeps resolving and is never released to another workspace, so existing links and bookmarks continue to work.
Needs: A signed-in panel session, sent as Authorization: Bearer <access token>.
| Field | Type | What it is |
|---|---|---|
| slug required | string | Subdomain for the workspace. Lowercase letters, numbers and single hyphens. Example: "acme" |
| Status | Body | When |
|---|---|---|
| 200 | WorkspaceDto | |
| 409 | — | The address is unavailable. The body carries free alternatives. |
| Field | Type | What it is |
|---|---|---|
| id required | string | |
| name required | string | |
| slug required | string | The subdomain this workspace answers on. |
| url required | string | The workspace's own sign-in URL. |
| consentRetentionMonths required | number | Months a consent record is kept before it is deleted automatically. Records are never deleted any other way. |
| shareTrackerEvidence required | boolean | Whether this workspace's tracker observations are shared. What is shared is a fact about a tracker (its name, the hosts it talks to, what it is for), with nothing that identifies the workspace. Turning it off costs nothing: scans still use what is already shared. |
PATCH
/v1/workspace/tracker-evidenceContribute this workspace’s tracker observations to the shared cache
What would be contributed is a fact about a TRACKER — its name, the hosts it talks to, what it is for — keyed by a hash with nothing of this workspace in it. Turning it off costs nothing: the cache is still read either way, so scans go on being classified from what other workspaces have already established.
Needs: A signed-in panel session, sent as Authorization: Bearer <access token>.
| Field | Type | What it is |
|---|---|---|
| shareTrackerEvidence required | boolean |
| Status | Body | When |
|---|---|---|
| 200 | WorkspaceDto |
| Field | Type | What it is |
|---|---|---|
| id required | string | |
| name required | string | |
| slug required | string | The subdomain this workspace answers on. |
| url required | string | The workspace's own sign-in URL. |
| consentRetentionMonths required | number | Months a consent record is kept before it is deleted automatically. Records are never deleted any other way. |
| shareTrackerEvidence required | boolean | Whether this workspace's tracker observations are shared. What is shared is a fact about a tracker (its name, the hosts it talks to, what it is for), with nothing that identifies the workspace. Turning it off costs nothing: scans still use what is already shared. |
Next groupBilling