> ## Documentation Index > Fetch the complete documentation index at: https://docs.fetchski-attract.com/llms.txt > Use this file to discover all available pages before exploring further. # Replace a cookie > Replaces the whole document: every field left out is reset to its default. ```ts AdonisJS wrap theme={"dark"} import app from '@adonisjs/core/services/app' import { SiteClient } from '@fetchski/attract-cms-sdk' const site = await app.container.make(SiteClient) const cookie = await site.cookies().replaceCookie({ id: 'clx8m2k4p0000a1b2c3d4e5f6', title: 'Example title', provider: 'This website', category: 'necessary', purpose: 'Example purpose' }) ``` ```json 200 wrap theme={"dark"} { "title": "Example title", "provider": "This website", "category": "necessary", "purpose": "Example purpose", "sortOrder": 50, "slug": "example-slug", "visibility": "public", "storageType": "cookie", "firstParty": true, "domain": "Example domain", "duration": "Session", "privacyPolicyUrl": "https://acme.example/example", "disclosure": { "metaType": "area", "_id": "clx8m2k4p0000a1b2c3d4e5f6", "items": [ { "type": "@apostrophecms/rich-text", "_id": "clx8m2k4p0000a1b2c3d4e5f6", "metaType": "widget", "content": "

Hello from the API.

", "sectionCss": { "slots": { "key": "Example value" }, "css": "Example css", "mark": "Example mark" } } ] }, "builtInKey": "Example built in key", "embedScriptId": "clx8m2k4p0000a1b2c3d4e5f6", "archived": false, "_id": "clx8m2k4p0000a1b2c3d4e5f6", "type": "Example type", "createdAt": "2026-10-24T09:30:00.000Z", "updatedAt": "2026-10-24T09:30:00.000Z", "aposShareKey": "k3v9x2m7q1z8w4p6" } ``` ## In your app A controller answers a route on your app: it calls `replaceCookie()` and returns the answer. **1. Add the controller** ```ts app/controllers/replace_cookie_controller.ts theme={"dark"} import { inject } from '@adonisjs/core' import type { HttpContext } from '@adonisjs/core/http' import { SiteClient } from '@fetchski/attract-cms-sdk' @inject() export default class ReplaceCookieController { constructor(protected site: SiteClient) {} async handle({ params }: HttpContext) { return this.site.cookies().replaceCookie({ id: params.id, title: 'Example title', provider: 'This website', category: 'necessary', purpose: 'Example purpose' }) } } ``` The other values are the example’s: take yours from the request, a form or your database. **2. Add the route** ```ts start/routes.ts theme={"dark"} import router from '@adonisjs/core/services/router' const ReplaceCookieController = () => import('#controllers/replace_cookie_controller') router.put('/cookie/:id', [ReplaceCookieController]) ``` Put it behind your auth middleware (`.use(middleware.auth())`): it acts with your key’s access. **3. Call it** Your own page’s form or script sends `PUT /cookie/clx8m2k4p0000a1b2c3d4e5f6` and gets back its answer as JSON. Test it, below, calls it. PATCH changes only the fields sent. Update an existing cookie. ## Find the id `id` is the document’s `_id`, from a list. Ask the list for only the fields you need: each row is a document’s `id` and those fields. ```ts AdonisJS wrap theme={"dark"} import app from '@adonisjs/core/services/app' import { SiteClient } from '@fetchski/attract-cms-sdk' const site = await app.container.make(SiteClient) const row = (await site.cookies().listCookiesPick(['title', 'slug'])).find((each) => each.slug === 'getting-started') // { id, title, slug }, or undefined ``` Pass `row.id` as `id`. Drafts: list with `{ aposMode: 'draft' }` to get the draft’s id ([Find an id](https://docs.fetchski-attract.com/find-an-id.md)). > [accordion] Required parameters > > One object, e.g. `replaceCookie({ id })`; leave out the optional fields. > > **id** `string` *required* > > **Required.** The document’s `_id`: a full id names its own locale and mode (the draft’s `…:en:draft`, the published one’s `…:en:published`; no `aposMode` needed), a bare `aposDocId` takes the request’s (`aposLocale`, `aposMode`). > > **title** `string` *required* > > **Required.** What a visitor would see in their browser — the cookie’s exact name (fetchski\_vid), or the tool’s name where it isn’t a cookie (Google Maps). > > **provider** `string` *required* > > **Required.** Who receives the data. Name the legal entity for a third party (e.g. “Google LLC”) — a reader is entitled to know who that is. > > **category** `Category` *required* > > **Required.** Which consent switch controls this. “Strictly necessary” cannot be declined, so only put something here if the site genuinely cannot work without it. One of `necessary`, `functional`, `analytics`, `marketing`. > > **purpose** `string` *required* > > **Required.** The one-sentence summary shown in the policy table and the banner’s details list. Say what it does for the visitor, not how it works. > [accordion] Optional parameters > > **aposMode** `AposMode | null | undefined` > > **Optional.** Leave it out and the site uses `"published"`. `published` (the default) or `draft`. Drafts need a credential that may see them: an API key with the type’s write scope (`content::write`), or a signed-in editor. The public and a key with only the read scope get 403. One of `draft`, `published`. > > **aposLocale** `string | null | undefined` > > **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The locale to read or write, e.g. `en` (default: the site’s default locale). > > **sortOrder** `number | null | undefined` > > **Optional.** Leave it out and the site uses `50`. Order WITHIN its category, lowest first. Categories themselves always appear in consent order. > > **slug** `string | null | undefined` > > **Optional.** Leave it out and the site uses `""`. The URL name: lowercase words joined by hyphens (letters outside a–z, even emoji, are kept). Left out, it’s made from the title. > > **visibility** `Visibility | null | undefined` > > **Optional.** Leave it out and the site uses `"public"`. Who may see it on the site: `public` (everyone) or `loginRequired` (signed-in people only). One of `public`, `loginRequired`. > > **storageType** `StorageType | null | undefined` > > **Optional.** Leave it out and the site uses `"cookie"`. Not everything in a cookie policy is a cookie — an embedded map or a hot-linked image stores nothing but still sends data to someone else. One of `cookie`, `localStorage`, `sessionStorage`, `script`, `embed`, `pixel`. > > **firstParty** `boolean | null | undefined` > > **Optional.** Leave it out and the site uses `true`. On when this site sets and reads it itself. Off when it belongs to another company. > > **domain** `string | null | undefined` > > **Optional.** Leave it out and the site uses `""`. Optional. The domain it is set on or sent to (e.g. google.com), where that differs from this site. > > **duration** `string | null | undefined` > > **Optional.** Leave it out and the site uses `"Session"`. How long it lasts, in plain words — “Session”, “6 months”, “1 year”, or “No cookie set”. > > **privacyPolicyUrl** `string | null | undefined` > > **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. Optional but expected for a third party — the policy page links to it. When set, a URL; empty or null when not. > > **disclosure** `RichTextMax1Area | null | undefined` > > **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The fuller explanation shown under this entry on the Cookie Policy page. Plain language, no legalese — what is collected, why, and what declining costs the visitor. Widgets, top to bottom: send `{ "items": [ … ] }`, one object per widget with its `type`. Writing it replaces the whole area. > > **RichTextMax1Area** > > **metaType** `AfterContentAreaMetaType` > > Always `area`. One of `area`. > > **id** `string` > > The area’s id, set by the site: leave it out when you write one. > > **items** `readonly RichTextWidget[]` > > A list of `RichTextWidget`. The widgets, top to bottom. Each is an object with its `type` and that widget’s own fields; `_id` and `metaType` may be left out (the site sets them). At most 1 items. > > **RichTextWidget** > > A `@apostrophecms/rich-text` widget: its `type` and its own fields. A field left out takes its default. > > **type** `RichTextWidgetType` *required* > > **Required.** The widget’s type: always `@apostrophecms/rich-text`. One of `@apostrophecms/rich-text`. > > **id** `string` > > The widget’s id, unique on the page. Leave it out for a new widget (the site sets one); keep it to change a widget that is there. > > **metaType** `MetaType` > > Always `widget`. One of `widget`. > > **content** `string` > > The text as HTML, e.g. `

Our story

It began with one idea.

`. The site keeps the tags and styles this area’s editor offers (paragraphs, headings, bold, italic, links, lists…) and removes the rest. > > **sectionCss** `CustomCSS | null` > > A `CustomCSS`. CSS for this one section, typed into the slot of the part it styles. It wins over Site design → Custom CSS. Nested rules like &:hover, @media (width >= 48rem) and \[data-theme="light"] & work inside a slot. > > **CustomCSS** > > **slots** `Readonly\\>` > > The CSS typed into each part slot, by slot name. > > **css** `string` > > The compiled CSS (read only: rebuilt from `slots`). > > **mark** `string` > > The site’s check mark for `css` (read only). > > **fields** `Readonly\\>` > > Optional: any keys not listed above, by their wire names; they are sent with the rest. > > **fields** `Readonly\\>` > > Optional: any keys not listed above, by their wire names; they are sent with the rest. > > **archived** `boolean | null | undefined` > > **Optional.** Leave it out and the site uses `false`. In the archive: kept, but out of every list and off the site until it is restored. `false` (or null) for a live document. > [accordion] Returns > > A `Cookie`. Cookie content type. Read its properties (`cookie.title`): each says whether the site always sends it. The example answer is the site’s wire JSON: one key differs from the property names (`_id` → `id`). > > **title** `string` > > **Always sent.** What a visitor would see in their browser — the cookie’s exact name (fetchski\_vid), or the tool’s name where it isn’t a cookie (Google Maps). > > **provider** `string` > > **Always sent.** Who receives the data. Name the legal entity for a third party (e.g. “Google LLC”) — a reader is entitled to know who that is. > > **category** `Category` > > **Always sent.** Which consent switch controls this. “Strictly necessary” cannot be declined, so only put something here if the site genuinely cannot work without it. One of `necessary`, `functional`, `analytics`, `marketing`; a newer site may send others, so keep a fallback. > > **purpose** `string` > > **Always sent.** The one-sentence summary shown in the policy table and the banner’s details list. Say what it does for the visitor, not how it works. > > **slug** `string` > > **Always sent.** The URL name: lowercase words joined by hyphens (letters outside a–z, even emoji, are kept). > > **id** `string` > > **Always sent.** The document’s id. On a type with drafts it ends in its locale and mode (`…:en:published`, `…:en:draft`): the part before the first colon is its `aposDocId`, shared by both copies. The `{_id}` the type’s routes take. > > **type** `string` > > **Always sent.** The document type’s name: always this type’s. > > **sortOrder** `number | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. Order WITHIN its category, lowest first. Categories themselves always appear in consent order. > > **visibility** `Visibility | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. Who may see it on the site: `public` (everyone) or `loginRequired` (signed-in people only). One of `public`, `loginRequired`; a newer site may send others, so keep a fallback. > > **storageType** `StorageType | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. Not everything in a cookie policy is a cookie — an embedded map or a hot-linked image stores nothing but still sends data to someone else. One of `cookie`, `localStorage`, `sessionStorage`, `script`, `embed`, `pixel`; a newer site may send others, so keep a fallback. > > **firstParty** `boolean | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. On when this site sets and reads it itself. Off when it belongs to another company. > > **domain** `string | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. Optional. The domain it is set on or sent to (e.g. google.com), where that differs from this site. > > **duration** `string | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. How long it lasts, in plain words — “Session”, “6 months”, “1 year”, or “No cookie set”. > > **privacyPolicyUrl** `string | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. Optional but expected for a third party — the policy page links to it. When set, a URL; empty or null when not. > > **disclosure** `RichTextMax1Area` > > **Sometimes sent:** `undefined` when the site leaves it out. A `RichTextMax1Area`. The fuller explanation shown under this entry on the Cookie Policy page. Plain language, no legalese — what is collected, why, and what declining costs the visitor. Widgets, top to bottom: send `{ "items": [ … ] }`, one object per widget with its `type`. Writing it replaces the whole area. > > **RichTextMax1Area** > > **metaType** `AfterContentAreaMetaType` > > **Sometimes sent:** `undefined` when the site leaves it out. Always `area`. One of `area`; a newer site may send others, so keep a fallback. > > **id** `string` > > **Sometimes sent:** `undefined` when the site leaves it out. The area’s id, set by the site: leave it out when you write one. > > **items** `readonly RichTextWidget[]` > > **Sometimes sent:** `undefined` when the site leaves it out. A list of `RichTextWidget`. The widgets, top to bottom. Each is an object with its `type` and that widget’s own fields; `_id` and `metaType` may be left out (the site sets them). At most 1 items. > > **RichTextWidget** > > A `@apostrophecms/rich-text` widget: its `type` and its own fields. A field left out takes its default. > > **type** `RichTextWidgetType` > > **Always sent.** The widget’s type: always `@apostrophecms/rich-text`. One of `@apostrophecms/rich-text`; a newer site may send others, so keep a fallback. > > **id** `string` > > **Sometimes sent:** `undefined` when the site leaves it out. The widget’s id, unique on the page. Leave it out for a new widget (the site sets one); keep it to change a widget that is there. > > **metaType** `MetaType` > > **Sometimes sent:** `undefined` when the site leaves it out. Always `widget`. One of `widget`; a newer site may send others, so keep a fallback. > > **content** `string` > > **Sometimes sent:** `undefined` when the site leaves it out. The text as HTML, e.g. `

Our story

It began with one idea.

`. The site keeps the tags and styles this area’s editor offers (paragraphs, headings, bold, italic, links, lists…) and removes the rest. > > **sectionCss** `CustomCSS | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. A `CustomCSS`. CSS for this one section, typed into the slot of the part it styles. It wins over Site design → Custom CSS. Nested rules like &:hover, @media (width >= 48rem) and \[data-theme="light"] & work inside a slot. > > **CustomCSS** > > **slots** `Readonly\\>` > > **Sometimes sent:** `undefined` when the site leaves it out. The CSS typed into each part slot, by slot name. > > **css** `string` > > **Sometimes sent:** `undefined` when the site leaves it out. The compiled CSS (read only: rebuilt from `slots`). > > **mark** `string` > > **Sometimes sent:** `undefined` when the site leaves it out. The site’s check mark for `css` (read only). > > **fields** `Readonly\\>` > > **Always there:** `{}` when there are none. Any keys the site sent that aren’t listed above (such as one added after this SDK was built), by their wire names, as sent. Pass this model to a write and they are sent too. > > **fields** `Readonly\\>` > > **Always there:** `{}` when there are none. Any keys the site sent that aren’t listed above (such as one added after this SDK was built), by their wire names, as sent. Pass this model to a write and they are sent too. > > **builtInKey** `string | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. Set for entries that ship with Fetchski CMS. Blank means this site added it. > > **embedScriptId** `string | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. Set for entries added by an Embed Script. They appear on the Cookie Policy only while that script is enabled. > > **archived** `boolean | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. In the archive: kept, but out of every list and off the site until it is restored. `false` (or null) for a live document. > > **createdAt** `Date | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. When it was created (ISO 8601). Format: an ISO 8601 date and time. > > **updatedAt** `Date | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. When it last changed (ISO 8601). Format: an ISO 8601 date and time. > > **aposShareKey** `string | null` > > **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. The draft’s preview share key, while its share link is on: the link is the draft’s `_url` with `aposShareKey` and `aposShareId` (the draft’s `_id`) in its query. Absent otherwise, and on published documents. > [accordion] Errors > > Nothing to catch: the SDK retries what is safe, and throws the rest as the classes below. Your exception handler turns them into your app’s own answers, once for every call (see [Map SDK errors to responses](https://docs.fetchski-attract.com/adonisjs/calling-the-api.md#map-sdk-errors-to-responses)); catch only what you want to react to here. > > **ValidationFailed** `400` > > The site refused what was sent: `errors` lists each field’s problem, `siteMessage` the first. > > **Retried first:** No. **Read:** `errors` (field → messages), `siteMessage`. > > **AuthenticationFailed** `401` > > The API key is missing or refused (malformed, revoked, expired), or a signature its signing mode needs is missing or stale. > > **Retried first:** No. **Read:** `siteMessage`, `errorName`, `data`. > > **Forbidden** `403` > > The key may not do this: a scope it lacks, or an address outside its allowlist. `siteMessage` names it. > > **Retried first:** No. **Read:** `siteMessage`, `errorName`, `data`. > > **NotFound** `404` > > Nothing matches, or the caller may not see it. > > **Retried first:** No. **Read:** `siteMessage`, `errorName`, `data`. > > **SiteError** `500` > > The site failed. Its logs say why. > > **Retried first:** No: a write may have landed. **Read:** `siteMessage`, `errorName`, `data`. > > **SiteUnreachable** `no answer` > > No answer: DNS, a refused connection, TLS, or the timeout (15 s per attempt by default). > > **Retried first:** Only when nothing reached the site (`neverConnected()`); never after a timeout, when it may have landed. **Read:** `reason`, `neverConnected`. > > **RequestNotSent** `not sent` > > The client refused to send it (e.g. a path segment of `..`); the site never saw it. > > **Retried first:** No. **Read:** `reason` (what to change). > > **SiteRequestFailed** `any other` > > Any other status, or a success whose JSON doesn’t match this SDK version’s types (update the SDK). > > **Retried first:** No. **Read:** `reason`, `status`. > > **UnknownSite** `setup` > > `sites.forSite('acme')` named a slug `config/attract.ts` doesn’t list (with the keys in the database: no row in `attract_api_keys`). > > **Retried first:** No: nothing was sent. **Read:** `message`, `slug`. > > **SiteConfigurationError** `setup` > > The site’s entry is wrong: a malformed `baseUrl` or key, a key filed under another slug, or no default site. `node ace attract:check` names the fix. > > **Retried first:** No: nothing was sent. **Read:** `message` (what to fix). ## Behavior * **Access:** an API key with `global:write` (or a master above it: `global:all`, `admin:all`). In published mode (the default) it goes live too, so the key also needs `global:publish` (or a master above it); send `aposMode=draft` (or a draft `_id` and no `aposMode`) to change only the draft. A signed-in person may call it as far as their own permissions allow; anyone else gets 403. * **Rate limit:** the key’s own writes-per-minute limit, set when the key is created (default 120); over it, 429 with `Retry-After`. The client waits and retries for you; you see `RateLimited` only if that runs out. * **Retries:** a write is sent again only after a 429 (refused before it acted) or when it never reached the site. After a timeout or a 5xx it may have landed: check before you send it again. * **Timeout:** 15 s per attempt by default; raise `timeout` (milliseconds) in `config/attract.ts` for longer. ## Test it It calls the controller above with the SDK faked: `fakeAttract()` puts the fake in the container for this one test, and it answers every call with a valid example, so nothing leaves your machine and no key is read. Save it as `tests/unit/cookies_replace_cookie.spec.ts`, then run your tests: ```ts tests/unit/cookies_replace_cookie.spec.ts theme={"dark"} import { test } from '@japa/runner' import app from '@adonisjs/core/services/app' import testUtils from '@adonisjs/core/services/test_utils' import { fakeAttract } from '@fetchski/attract-cms-adonis/testing' import ReplaceCookieController from '#controllers/replace_cookie_controller' test('cookies.replaceCookie', async () => { const site = fakeAttract() const ctx = await testUtils.createHttpContext() ctx.params = { id: 'clx8m2k4p0000a1b2c3d4e5f6' } const controller = await app.container.make(ReplaceCookieController) await controller.handle(ctx) site.assertCalled('cookies.replaceCookie', (args) => args.id === 'clx8m2k4p0000a1b2c3d4e5f6') }) ``` ```bash Terminal theme={"dark"} node ace test ``` **Answer with your own values:** fake `cookies.replaceCookie` with `factories.Cookie({...})`, the fields you give over a valid example. ```ts tests/unit/cookies_replace_cookie_answers.spec.ts theme={"dark"} import { test } from '@japa/runner' import { factories, fakeAttract } from '@fetchski/attract-cms-adonis/testing' test('cookies.replaceCookie answers your values', async ({ assert }) => { const site = fakeAttract({ 'cookies.replaceCookie': factories.Cookie({ title: 'Your value' }), }) const cookie = await site.cookies().replaceCookie({ id: 'clx8m2k4p0000a1b2c3d4e5f6', title: 'Example title', provider: 'This website', category: 'necessary', purpose: 'Example purpose' }) assert.containSubset(cookie, { title: 'Your value' }) }) ``` ## Related > [card] [List a cookie’s locales](https://docs.fetchski-attract.com/adonisjs/reference/cookies/get-cookie-locales.md) > > `site.cookies().getCookieLocales()` > [card] [List cookies](https://docs.fetchski-attract.com/adonisjs/reference/cookies/list-cookies.md) > > `site.cookies().listCookies()` > [card] [Create a cookie](https://docs.fetchski-attract.com/adonisjs/reference/cookies/create-cookie.md) > > `site.cookies().createCookie()` > [card] [Get a cookie](https://docs.fetchski-attract.com/adonisjs/reference/cookies/get-cookie.md) > > `site.cookies().getCookie()` > [card] [Delete a cookie](https://docs.fetchski-attract.com/adonisjs/reference/cookies/delete-cookie.md) > > `site.cookies().deleteCookie()` > [card] [Update a cookie](https://docs.fetchski-attract.com/adonisjs/reference/cookies/update-cookie.md) > > `site.cookies().updateCookie()` > [card] [PUT /cookie/\{\_id}](https://docs.fetchski-attract.com/api-reference/cookies/replace-a-cookie.md) > > The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.