Replace a cookie

use Fetchski\AttractCmsLaravel\Facades\Attract;

$cookie = Attract::cookies()->replaceCookie(id: 'clx8m2k4p0000a1b2c3d4e5f6', title: 'Example title', provider: 'This website', category: 'necessary', purpose: 'Example purpose');

{
  "title": "Example title",
  "provider": "This website",
  "category": "necessary",
  "purpose": "Example purpose",
  "sortOrder": 50,
  "slug": "example-slug",
  "visibility": "public",
  "storageType": "cookie",
  "firstParty": true,
  "domain": "Example domain",
  "duration": "Session",
  "privacyPolicyUrl": "https://acme.example/example",
  "disclosure": {
    "metaType": "area",
    "_id": "clx8m2k4p0000a1b2c3d4e5f6",
    "items": [
      {
        "type": "@apostrophecms/rich-text",
        "_id": "clx8m2k4p0000a1b2c3d4e5f6",
        "metaType": "widget",
        "content": "<p>Hello from the API.</p>",
        "sectionCss": {
          "slots": {
            "key": "Example value"
          },
          "css": "Example css",
          "mark": "Example mark"
        }
      }
    ]
  },
  "builtInKey": "Example built in key",
  "embedScriptId": "clx8m2k4p0000a1b2c3d4e5f6",
  "archived": false,
  "_id": "clx8m2k4p0000a1b2c3d4e5f6",
  "type": "Example type",
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "aposShareKey": "k3v9x2m7q1z8w4p6"
}

use Fetchski\AttractCmsLaravel\Facades\Attract;

$cookie = Attract::cookies()->replaceCookie(id: 'clx8m2k4p0000a1b2c3d4e5f6', title: 'Example title', provider: 'This website', category: 'necessary', purpose: 'Example purpose');

{
  "title": "Example title",
  "provider": "This website",
  "category": "necessary",
  "purpose": "Example purpose",
  "sortOrder": 50,
  "slug": "example-slug",
  "visibility": "public",
  "storageType": "cookie",
  "firstParty": true,
  "domain": "Example domain",
  "duration": "Session",
  "privacyPolicyUrl": "https://acme.example/example",
  "disclosure": {
    "metaType": "area",
    "_id": "clx8m2k4p0000a1b2c3d4e5f6",
    "items": [
      {
        "type": "@apostrophecms/rich-text",
        "_id": "clx8m2k4p0000a1b2c3d4e5f6",
        "metaType": "widget",
        "content": "<p>Hello from the API.</p>",
        "sectionCss": {
          "slots": {
            "key": "Example value"
          },
          "css": "Example css",
          "mark": "Example mark"
        }
      }
    ]
  },
  "builtInKey": "Example built in key",
  "embedScriptId": "clx8m2k4p0000a1b2c3d4e5f6",
  "archived": false,
  "_id": "clx8m2k4p0000a1b2c3d4e5f6",
  "type": "Example type",
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "aposShareKey": "k3v9x2m7q1z8w4p6"
}

In your app

A controller answers a route on your app: it calls replaceCookie() and returns the answer.

Add the controller

app/Http/Controllers/ReplaceCookieController.php

<?php

declare(strict_types=1);

namespace App\Http\Controllers;

use Fetchski\AttractCmsLaravel\Data\Cookie;
use Fetchski\AttractCmsLaravel\Facades\Attract;

final class ReplaceCookieController
{
    public function __invoke(string $id): Cookie
    {
        return Attract::cookies()->replaceCookie(id: $id, title: 'Example title', provider: 'This website', category: 'necessary', purpose: 'Example purpose');
    }
}

The other values are the example’s: take yours from the request, a form or your database.

Add the route

routes/web.php

use App\Http\Controllers\ReplaceCookieController;
use Illuminate\Support\Facades\Route;

Route::put('/cookie/{id}', ReplaceCookieController::class)->middleware('auth');

It acts with your key’s access, so auth lets only your signed-in users reach it.

Call it

Your own page’s form or script sends PUT /cookie/clx8m2k4p0000a1b2c3d4e5f6 (a form adds @csrf, as every web route checks it, and @method('PUT')), and gets back its answer as JSON. Test it, below, calls it.

To keep the call in an Action instead, this writes app/Actions/Attract/ReplaceCookie.php (an invokable Action that calls replaceCookie()) and its test under tests/Feature/Actions/Attract/ (Pest when your app has it):

Terminal

php artisan make:attract-action cookies.replaceCookie

Call it from the terminal

Terminal

php artisan attract:call cookies.replaceCookie \
  id=clx8m2k4p0000a1b2c3d4e5f6 \
  'title=Example title' \
  'provider=This website' \
  category=necessary \
  'purpose=Example purpose'

It calls replaceCookie() on your default site and prints its answer as JSON. It writes, so it asks first: add --force to skip the question in a script. See Call any method from the terminal for every argument type. PATCH changes only the fields sent. Update an existing cookie.

Find the id

id is the document’s _id, from a list. Ask the list for only the fields you need: each row is a document’s id and those fields.

Laravel

use Fetchski\AttractCmsLaravel\Facades\Attract;

$row = Attract::cookies()->listCookiesPick(fields: ['title', 'slug'])->firstWhere('slug', 'getting-started'); // ['id' => …, 'title' => …, 'slug' => …], or null

Terminal

php artisan attract:call cookies.listCookiesPick fields=title,slug

Pass $row['id'] as id. Drafts: list with aposMode: 'draft' to get the draft’s id (Find an id).

Required parameters

Named arguments, e.g. replaceCookie(id: …); leave out the optional ones.

string

required

Required. The document’s _id: a full id names its own locale and mode (the draft’s …:en:draft, the published one’s …:en:published; no aposMode needed), a bare aposDocId takes the request’s (aposLocale, aposMode).

string

required

Required. What a visitor would see in their browser — the cookie’s exact name (fetchski_vid), or the tool’s name where it isn’t a cookie (Google Maps).

string

required

Required. Who receives the data. Name the legal entity for a third party (e.g. “Google LLC”) — a reader is entitled to know who that is.

Enums\Category|string

required

Required. Which consent switch controls this. “Strictly necessary” cannot be declined, so only put something here if the site genuinely cannot work without it. One of necessary, functional, analytics, marketing.

string

required

Required. The one-sentence summary shown in the policy table and the banner’s details list. Say what it does for the visitor, not how it works.

Optional parameters

Enums\AposMode|string|null

Optional. Leave it out and the site uses "published". published (the default) or draft. Drafts need a credential that may see them: an API key with the type’s write scope (content:<type>:write), or a signed-in editor. The public and a key with only the read scope get 403. One of draft, published.

?string

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. The locale to read or write, e.g. en (default: the site’s default locale).

?int

Optional. Leave it out and the site uses 50. Order WITHIN its category, lowest first. Categories themselves always appear in consent order.

?string

Optional. Leave it out and the site uses "". The URL name: lowercase words joined by hyphens (letters outside a–z, even emoji, are kept). Left out, it’s made from the title.

Enums\Visibility|string|null

Optional. Leave it out and the site uses "public". Who may see it on the site: public (everyone) or loginRequired (signed-in people only). One of public, loginRequired.

Enums\StorageType|string|null

Optional. Leave it out and the site uses "cookie". Not everything in a cookie policy is a cookie — an embedded map or a hot-linked image stores nothing but still sends data to someone else. One of cookie, localStorage, sessionStorage, script, embed, pixel.

?bool

Optional. Leave it out and the site uses true. On when this site sets and reads it itself. Off when it belongs to another company.

?string

Optional. Leave it out and the site uses "". Optional. The domain it is set on or sent to (e.g. google.com), where that differs from this site.

?string

Optional. Leave it out and the site uses "Session". How long it lasts, in plain words — “Session”, “6 months”, “1 year”, or “No cookie set”.

?string

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. Optional but expected for a third party — the policy page links to it. When set, a URL; empty or null when not.

RichTextMax1Area|array<string, mixed>|null

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. The fuller explanation shown under this entry on the Cookie Policy page. Plain language, no legalese — what is collected, why, and what declining costs the visitor. Widgets, top to bottom: send { "items": [ … ] }, one object per widget with its type. Writing it replaces the whole area.

Show RichTextMax1Area (Fetchski\AttractCmsLaravel\Data\RichTextMax1Area)

Enums\AfterContentAreaMetaType|string|null

Always area. One of area.

?string

The area’s id, set by the site: leave it out when you write one.

Collection<int, RichTextWidget>|null

A list of RichTextWidget. The widgets, top to bottom. Each is an object with its type and that widget’s own fields; _id and metaType may be left out (the site sets them). At most 1 items.

Show RichTextWidget (Fetchski\AttractCmsLaravel\Data\RichTextWidget)

A @apostrophecms/rich-text widget: its type and its own fields. A field left out takes its default.

Enums\RichTextWidgetType|string

required

Required. The widget’s type: always @apostrophecms/rich-text. One of @apostrophecms/rich-text.

?string

The widget’s id, unique on the page. Leave it out for a new widget (the site sets one); keep it to change a widget that is there.

Enums\MetaType|string|null

Always widget. One of widget.

?string

The text as HTML, e.g. <h2>Our story</h2><p>It began with <strong>one</strong> idea.</p>. The site keeps the tags and styles this area’s editor offers (paragraphs, headings, bold, italic, links, lists…) and removes the rest.

?CustomCSS

A CustomCSS. CSS for this one section, typed into the slot of the part it styles. It wins over Site design → Custom CSS. Nested rules like &:hover, @media (width >= 48rem) and [data-theme=“light”] & work inside a slot.

Show CustomCSS (Fetchski\AttractCmsLaravel\Data\CustomCSS)

array<string, string>|null

The CSS typed into each part slot, by slot name.

?string

The compiled CSS (read only: rebuilt from slots).

?string

The site’s check mark for css (read only).

array<string, mixed>

Optional: any keys not listed above, by their wire names; they are sent with the rest.

array<string, mixed>

Optional: any keys not listed above, by their wire names; they are sent with the rest.

?bool

Optional. Leave it out and the site uses false. In the archive: kept, but out of every list and off the site until it is restored. false (or null) for a live document.

Returns

A Cookie (Fetchski\AttractCmsLaravel\Data\Cookie). Cookie content type. Read its properties ($cookie->title): each says whether the site always sends it. The example answer is the site’s wire JSON: one key differs from the property names (_id → id).

string

Always sent. What a visitor would see in their browser — the cookie’s exact name (fetchski_vid), or the tool’s name where it isn’t a cookie (Google Maps).

string

Always sent. Who receives the data. Name the legal entity for a third party (e.g. “Google LLC”) — a reader is entitled to know who that is.

Enums\Category|string

Always sent. Which consent switch controls this. “Strictly necessary” cannot be declined, so only put something here if the site genuinely cannot work without it. One of necessary, functional, analytics, marketing; a newer site may send others, so keep a fallback.

string

Always sent. The one-sentence summary shown in the policy table and the banner’s details list. Say what it does for the visitor, not how it works.

string

Always sent. The URL name: lowercase words joined by hyphens (letters outside a–z, even emoji, are kept).

string

Always sent. The document’s id. On a type with drafts it ends in its locale and mode (…:en:published, …:en:draft): the part before the first colon is its aposDocId, shared by both copies. The {_id} the type’s routes take.

string

Always sent. The document type’s name: always this type’s.

?int

Sometimes sent: null when the site leaves it out. Order WITHIN its category, lowest first. Categories themselves always appear in consent order.

Enums\Visibility|string|null

Sometimes sent: null when the site leaves it out. Who may see it on the site: public (everyone) or loginRequired (signed-in people only). One of public, loginRequired; a newer site may send others, so keep a fallback.

Enums\StorageType|string|null

Sometimes sent: null when the site leaves it out. Not everything in a cookie policy is a cookie — an embedded map or a hot-linked image stores nothing but still sends data to someone else. One of cookie, localStorage, sessionStorage, script, embed, pixel; a newer site may send others, so keep a fallback.

?bool

Sometimes sent: null when the site leaves it out. On when this site sets and reads it itself. Off when it belongs to another company.

?string

Sometimes sent: null when the site leaves it out. Optional. The domain it is set on or sent to (e.g. google.com), where that differs from this site.

?string

Sometimes sent: null when the site leaves it out. How long it lasts, in plain words — “Session”, “6 months”, “1 year”, or “No cookie set”.

?string

Sometimes sent: null when the site leaves it out. Optional but expected for a third party — the policy page links to it. When set, a URL; empty or null when not.

?RichTextMax1Area

Sometimes sent: null when the site leaves it out. A RichTextMax1Area. The fuller explanation shown under this entry on the Cookie Policy page. Plain language, no legalese — what is collected, why, and what declining costs the visitor. Widgets, top to bottom: send { "items": [ … ] }, one object per widget with its type. Writing it replaces the whole area.

Show RichTextMax1Area (Fetchski\AttractCmsLaravel\Data\RichTextMax1Area)

Enums\AfterContentAreaMetaType|string|null

Sometimes sent: null when the site leaves it out. Always area. One of area; a newer site may send others, so keep a fallback.

?string

Sometimes sent: null when the site leaves it out. The area’s id, set by the site: leave it out when you write one.

Collection<int, RichTextWidget>|null

Sometimes sent: null when the site leaves it out. A list of RichTextWidget. The widgets, top to bottom. Each is an object with its type and that widget’s own fields; _id and metaType may be left out (the site sets them). At most 1 items.

Show RichTextWidget (Fetchski\AttractCmsLaravel\Data\RichTextWidget)

A @apostrophecms/rich-text widget: its type and its own fields. A field left out takes its default.

Enums\RichTextWidgetType|string

Always sent. The widget’s type: always @apostrophecms/rich-text. One of @apostrophecms/rich-text; a newer site may send others, so keep a fallback.

?string

Sometimes sent: null when the site leaves it out. The widget’s id, unique on the page. Leave it out for a new widget (the site sets one); keep it to change a widget that is there.

Enums\MetaType|string|null

Sometimes sent: null when the site leaves it out. Always widget. One of widget; a newer site may send others, so keep a fallback.

?string

Sometimes sent: null when the site leaves it out. The text as HTML, e.g. <h2>Our story</h2><p>It began with <strong>one</strong> idea.</p>. The site keeps the tags and styles this area’s editor offers (paragraphs, headings, bold, italic, links, lists…) and removes the rest.

?CustomCSS

Sometimes sent: null when the site leaves it out. A CustomCSS. CSS for this one section, typed into the slot of the part it styles. It wins over Site design → Custom CSS. Nested rules like &:hover, @media (width >= 48rem) and [data-theme=“light”] & work inside a slot.

Show CustomCSS (Fetchski\AttractCmsLaravel\Data\CustomCSS)

array<string, string>|null

Sometimes sent: null when the site leaves it out. The CSS typed into each part slot, by slot name.

?string

Sometimes sent: null when the site leaves it out. The compiled CSS (read only: rebuilt from slots).

?string

Sometimes sent: null when the site leaves it out. The site’s check mark for css (read only).

array<string, mixed>

Always there: [] when there are none. Any keys the site sent that aren’t listed above (such as one added after this SDK was built), by their wire names, as sent. Pass this model to a write and they are sent too. An object in it that a PHP array would read as a list ({}, {"0": …}) is a stdClass, so it is sent back as an object.

array<string, mixed>

?string

Sometimes sent: null when the site leaves it out. Set for entries that ship with Fetchski CMS. Blank means this site added it.

?string

Sometimes sent: null when the site leaves it out. Set for entries added by an Embed Script. They appear on the Cookie Policy only while that script is enabled.

?bool

Sometimes sent: null when the site leaves it out. In the archive: kept, but out of every list and off the site until it is restored. false (or null) for a live document.

?CarbonImmutable

Sometimes sent: null when the site leaves it out. When it was created (ISO 8601). Format: an ISO 8601 date and time.

?CarbonImmutable

Sometimes sent: null when the site leaves it out. When it last changed (ISO 8601). Format: an ISO 8601 date and time.

Sometimes sent: null when the site leaves it out. The draft’s preview share key, while its share link is on: the link is the draft’s _url with aposShareKey and aposShareId (the draft’s _id) in its query. Absent otherwise, and on published documents.

Errors

Nothing to catch: the SDK retries what is safe, and Laravel logs and renders the rest (see Errors and testing).

400

The site refused what was sent: errors() lists each field’s problem, siteMessage() the first.Retried first: No. Read: errors() (field → messages), siteMessage().

401

The API key is missing or refused (malformed, revoked, expired), or a signature its signing mode needs is missing or stale.Retried first: No. Read: siteMessage(), errorName(), data().

403

The key may not do this: a scope it lacks, or an address outside its allowlist. siteMessage() names it.Retried first: No. Read: siteMessage(), errorName(), data().

404

Nothing matches, or the caller may not see it.Retried first: No. Read: siteMessage(), errorName(), data().

500

The site failed. Its logs say why.Retried first: No: a write may have landed. Read: siteMessage(), errorName(), data().

no answer

No answer: DNS, a refused connection, TLS, or the timeout (15 s per attempt by default).Retried first: Only when nothing reached the site (neverConnected()); never after a timeout, when it may have landed. Read: reason(), neverConnected().

not sent

The client refused to send it (e.g. a path segment of ..); the site never saw it.Retried first: No. Read: reason() (what to change).

any other

Any other status, or a success whose JSON doesn’t match this SDK version’s types (update the SDK).Retried first: No. Read: reason(), status().

setup

Attract::site('acme') named a slug that isn’t under sites in config/fetchski-attract.php.Retried first: No: nothing was sent. Read: getMessage(), $e->slug.

setup

The site’s config entry is wrong: no url, a malformed api_key, a key filed under another slug, or no default site.Retried first: No: nothing was sent. Read: getMessage() (what to fix).

Behavior

Access: an API key with global:write (or a master above it: global:all, admin:all). In published mode (the default) it goes live too, so the key also needs global:publish (or a master above it); send aposMode=draft (or a draft _id and no aposMode) to change only the draft. A signed-in person may call it as far as their own permissions allow; anyone else gets 403.
Rate limit: the key’s own writes-per-minute limit, set when the key is created (default 120); over it, 429 with Retry-After. The client waits and retries for you; you see RateLimited only if that runs out.
Retries: a write is sent again only after a 429 (refused before it acted) or when it never reached the site. After a timeout or a 5xx it may have landed: check before you send it again.
Timeout: 15 s per attempt by default; raise timeout in config/fetchski-attract.php for longer.

Test it

It calls the route above with the SDK faked: the fake answers every call with a valid example, so nothing leaves your machine and no config or key is needed. Save it as tests/Feature/ReplaceCookieTest.php, then run your tests:

tests/Feature/ReplaceCookieTest.php

<?php

declare(strict_types=1);

namespace Tests\Feature;

use App\Models\User;
use Fetchski\AttractCmsLaravel\Facades\Attract;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

final class ReplaceCookieTest extends TestCase
{
    use RefreshDatabase;

    public function test_replace_cookie(): void
    {
        Attract::fake();

        $this->actingAs(User::factory()->create())
            ->putJson('/cookie/clx8m2k4p0000a1b2c3d4e5f6')
            ->assertOk();

        Attract::assertCalled('cookies.replaceCookie', fn (array $args): bool => $args['id'] === 'clx8m2k4p0000a1b2c3d4e5f6');
    }
}

Terminal

php artisan test

Answer with your own values: fake cookies.replaceCookie with Cookie::factory()->make([...]), the fields you give over a valid example.

tests/Feature/ReplaceCookieAnswerTest.php

<?php

declare(strict_types=1);

namespace Tests\Feature;

use Fetchski\AttractCmsLaravel\Data\Cookie;
use Fetchski\AttractCmsLaravel\Facades\Attract;
use Tests\TestCase;

final class ReplaceCookieAnswerTest extends TestCase
{
    public function test_replace_cookie_answers_your_values(): void
    {
        Attract::fake([
            'cookies.replaceCookie' => Cookie::factory()->make(['title' => 'Your value']),
        ]);

        $cookie = Attract::cookies()->replaceCookie(id: 'clx8m2k4p0000a1b2c3d4e5f6', title: 'Example title', provider: 'This website', category: 'necessary', purpose: 'Example purpose');

        $this->assertSame('Your value', $cookie->title);
    }
}

List a cookie’s locales

Attract::cookies()->getCookieLocales()

List cookies

Attract::cookies()->listCookies()

Create a cookie

Attract::cookies()->createCookie()

Get a cookie

Attract::cookies()->getCookie()

Delete a cookie

Attract::cookies()->deleteCookie()

Update a cookie

Attract::cookies()->updateCookie()

PUT /cookie/{_id}

The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks.

use Fetchski\AttractCmsLaravel\Facades\Attract;

$cookie = Attract::cookies()->replaceCookie(id: 'clx8m2k4p0000a1b2c3d4e5f6', title: 'Example title', provider: 'This website', category: 'necessary', purpose: 'Example purpose');

{
  "title": "Example title",
  "provider": "This website",
  "category": "necessary",
  "purpose": "Example purpose",
  "sortOrder": 50,
  "slug": "example-slug",
  "visibility": "public",
  "storageType": "cookie",
  "firstParty": true,
  "domain": "Example domain",
  "duration": "Session",
  "privacyPolicyUrl": "https://acme.example/example",
  "disclosure": {
    "metaType": "area",
    "_id": "clx8m2k4p0000a1b2c3d4e5f6",
    "items": [
      {
        "type": "@apostrophecms/rich-text",
        "_id": "clx8m2k4p0000a1b2c3d4e5f6",
        "metaType": "widget",
        "content": "<p>Hello from the API.</p>",
        "sectionCss": {
          "slots": {
            "key": "Example value"
          },
          "css": "Example css",
          "mark": "Example mark"
        }
      }
    ]
  },
  "builtInKey": "Example built in key",
  "embedScriptId": "clx8m2k4p0000a1b2c3d4e5f6",
  "archived": false,
  "_id": "clx8m2k4p0000a1b2c3d4e5f6",
  "type": "Example type",
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "aposShareKey": "k3v9x2m7q1z8w4p6"
}

Get started

Using the SDK

Going further

Pages & Site

Content

Media

Forms

Ads & Conversions

Analytics

In your app

Call it from the terminal

Find the id

Behavior

Test it

List a cookie’s locales

List cookies

Create a cookie

Get a cookie

Delete a cookie

Update a cookie

PUT /cookie/{_id}

In your app

Call it from the terminal

Find the id

Behavior

Test it

Related

List a cookie’s locales

List cookies

Create a cookie

Get a cookie

Delete a cookie

Update a cookie

PUT /cookie/{_id}