Update a cookie

Update an existing cookie.

Access: an API key with global:write (or a master above it: global:all, admin:all). In published mode (the default) it goes live too, so the key also needs global:publish (or a master above it); send aposMode=draft (or a draft _id and no aposMode) to change only the draft. A signed-in person may call it as far as their own permissions allow; anyone else gets 403.

Rate limit: the key’s own writes-per-minute limit, set when the key is created (default 120); over it, 429 with Retry-After.

PATCH

{_id}

cURL

curl --request PATCH \
  --url https://{host}/api/v1/cookie/{_id} \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "title": "",
  "provider": "This website",
  "category": "necessary",
  "purpose": ""
}
'

{
  "title": "",
  "provider": "This website",
  "category": "necessary",
  "purpose": "",
  "_id": "<string>",
  "type": "<string>",
  "sortOrder": 50,
  "slug": "",
  "visibility": "public",
  "storageType": "cookie",
  "firstParty": true,
  "domain": "",
  "duration": "Session",
  "privacyPolicyUrl": "<string>",
  "disclosure": {
    "items": [
      {
        "type": "@apostrophecms/rich-text",
        "content": "<p>Hello from the API.</p>"
      }
    ]
  },
  "builtInKey": "",
  "embedScriptId": "",
  "archived": false,
  "createdAt": "2023-11-07T05:31:56Z",
  "updatedAt": "2023-11-07T05:31:56Z",
  "aposShareKey": "k3v9x2m7q1z8w4p6"
}

{
  "name": "<string>",
  "message": "<string>",
  "data": {}
}

{
  "name": "<string>",
  "message": "<string>",
  "data": {}
}

{
  "name": "<string>",
  "message": "<string>",
  "data": {}
}

{
  "name": "<string>",
  "message": "<string>",
  "data": {}
}

{
  "name": "<string>",
  "message": "<string>",
  "data": {}
}

Authorizations

Authorization

string

header

required

Paste your API key as the CMS showed it: fsk_<site>_<key id>_<secret> (issued under API Keys). ApiKey in front of it works too. Leave it empty to read as the public.

Scopes

global:write

Path Parameters

_id

string

required

The document’s _id: a full id names its own locale and mode (the draft’s …:en:draft, the published one’s …:en:published; no aposMode needed), a bare aposDocId takes the request’s (aposLocale, aposMode).

Query Parameters

aposMode

enum<string>

default:published

published (the default) or draft. Drafts need a credential that may see them: an API key with the type’s write scope (content:<type>:write), or a signed-in editor. The public and a key with only the read scope get 403.

Available options:

draft,

published

aposLocale

string

The locale to read or write, e.g. en (default: the site’s default locale).

Example:

"fr"

Body

application/json

Cookie content type

title

string

default:""

required

What a visitor would see in their browser — the cookie’s exact name (fetchski_vid), or the tool’s name where it isn’t a cookie (Google Maps).

provider

string

default:This website

required

Who receives the data. Name the legal entity for a third party (e.g. “Google LLC”) — a reader is entitled to know who that is.

category

enum<string>

default:necessary

required

Which consent switch controls this. “Strictly necessary” cannot be declined, so only put something here if the site genuinely cannot work without it.

Available options:

necessary,

functional,

analytics,

marketing

purpose

string

default:""

required

The one-sentence summary shown in the policy table and the banner’s details list. Say what it does for the visitor, not how it works.

sortOrder

integer | null

default:50

Order WITHIN its category, lowest first. Categories themselves always appear in consent order.

slug

string

default:""

The URL name: lowercase words joined by hyphens (letters outside a–z, even emoji, are kept).

visibility

enum<string> | null

default:public

Who may see it on the site: public (everyone) or loginRequired (signed-in people only).

Available options:

public,

loginRequired,

null

storageType

enum<string> | null

default:cookie

Not everything in a cookie policy is a cookie — an embedded map or a hot-linked image stores nothing but still sends data to someone else.

Available options:

cookie,

localStorage,

sessionStorage,

script,

embed,

pixel,

null

firstParty

boolean | null

default:true

On when this site sets and reads it itself. Off when it belongs to another company.

domain

string | null

default:""

Optional. The domain it is set on or sent to (e.g. google.com), where that differs from this site.

duration

string | null

default:Session

How long it lasts, in plain words — “Session”, “6 months”, “1 year”, or “No cookie set”.

privacyPolicyUrl

string | null

Optional but expected for a third party — the policy page links to it. When set, a URL; empty or null when not.

disclosure

Disclosure · object

The fuller explanation shown under this entry on the Cookie Policy page. Plain language, no legalese — what is collected, why, and what declining costs the visitor. Widgets, top to bottom: send { "items": [ … ] }, one object per widget with its type. Writing it replaces the whole area.

Show child attributes

Example:

{
  "items": [
    {
      "type": "@apostrophecms/rich-text",
      "content": "<p>Hello from the API.</p>"
    }
  ]
}

archived

boolean | null

default:false

In the archive: kept, but out of every list and off the site until it is restored. false (or null) for a live document.

Response

Success

Cookie content type

title

string

default:""

required

What a visitor would see in their browser — the cookie’s exact name (fetchski_vid), or the tool’s name where it isn’t a cookie (Google Maps).

provider

string

default:This website

required

Who receives the data. Name the legal entity for a third party (e.g. “Google LLC”) — a reader is entitled to know who that is.

category

enum<string>

default:necessary

required

Which consent switch controls this. “Strictly necessary” cannot be declined, so only put something here if the site genuinely cannot work without it.

Available options:

necessary,

functional,

analytics,

marketing

purpose

string

default:""

required

The one-sentence summary shown in the policy table and the banner’s details list. Say what it does for the visitor, not how it works.

_id

string

required

read-only

The document’s id. On a type with drafts it ends in its locale and mode (…:en:published, …:en:draft): the part before the first colon is its aposDocId, shared by both copies. The {_id} the type’s routes take.

type

string

required

read-only

The document type’s name: always this type’s.

sortOrder

integer | null

default:50

Order WITHIN its category, lowest first. Categories themselves always appear in consent order.

slug

string

default:""

The URL name: lowercase words joined by hyphens (letters outside a–z, even emoji, are kept).

visibility

enum<string> | null

default:public

Who may see it on the site: public (everyone) or loginRequired (signed-in people only).

Available options:

public,

loginRequired,

null

storageType

enum<string> | null

default:cookie

Not everything in a cookie policy is a cookie — an embedded map or a hot-linked image stores nothing but still sends data to someone else.

Available options:

cookie,

localStorage,

sessionStorage,

script,

embed,

pixel,

null

firstParty

boolean | null

default:true

On when this site sets and reads it itself. Off when it belongs to another company.

domain

string | null

default:""

Optional. The domain it is set on or sent to (e.g. google.com), where that differs from this site.

duration

string | null

default:Session

How long it lasts, in plain words — “Session”, “6 months”, “1 year”, or “No cookie set”.

privacyPolicyUrl

string | null

Optional but expected for a third party — the policy page links to it. When set, a URL; empty or null when not.

disclosure

Disclosure · object

Show child attributes

Example:

{
  "items": [
    {
      "type": "@apostrophecms/rich-text",
      "content": "<p>Hello from the API.</p>"
    }
  ]
}

builtInKey

string | null

default:""

read-only

Set for entries that ship with Fetchski CMS. Blank means this site added it.

embedScriptId

string | null

default:""

read-only

Set for entries added by an Embed Script. They appear on the Cookie Policy only while that script is enabled.

archived

boolean | null

default:false

In the archive: kept, but out of every list and off the site until it is restored. false (or null) for a live document.

createdAt

string<date-time> | null

read-only

When it was created (ISO 8601).

updatedAt

string<date-time> | null

read-only

When it last changed (ISO 8601).

The draft’s preview share key, while its share link is on: the link is the draft’s _url with aposShareKey and aposShareId (the draft’s _id) in its query. Absent otherwise, and on published documents.

Example:

"k3v9x2m7q1z8w4p6"

cURL

curl --request PATCH \
  --url https://{host}/api/v1/cookie/{_id} \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "title": "",
  "provider": "This website",
  "category": "necessary",
  "purpose": ""
}
'

{
  "title": "",
  "provider": "This website",
  "category": "necessary",
  "purpose": "",
  "_id": "<string>",
  "type": "<string>",
  "sortOrder": 50,
  "slug": "",
  "visibility": "public",
  "storageType": "cookie",
  "firstParty": true,
  "domain": "",
  "duration": "Session",
  "privacyPolicyUrl": "<string>",
  "disclosure": {
    "items": [
      {
        "type": "@apostrophecms/rich-text",
        "content": "<p>Hello from the API.</p>"
      }
    ]
  },
  "builtInKey": "",
  "embedScriptId": "",
  "archived": false,
  "createdAt": "2023-11-07T05:31:56Z",
  "updatedAt": "2023-11-07T05:31:56Z",
  "aposShareKey": "k3v9x2m7q1z8w4p6"
}

{
  "name": "<string>",
  "message": "<string>",
  "data": {}
}

{
  "name": "<string>",
  "message": "<string>",
  "data": {}
}

{
  "name": "<string>",
  "message": "<string>",
  "data": {}
}

{
  "name": "<string>",
  "message": "<string>",
  "data": {}
}

{
  "name": "<string>",
  "message": "<string>",
  "data": {}
}

Get started

How the API works

Pages & Site

Content

Media

Forms

Ads & Conversions

Analytics

Signing in (people)

Update a cookie

Authorizations

Scopes

Path Parameters

Query Parameters

Body

Response