Publish a cookie

import { createSiteClient } from '@fetchski/attract-cms-sdk';

const site = createSiteClient();
const cookie = await site.cookies().publishCookie({ id: 'clx8m2k4p0000a1b2c3d4e5f6' });

{
  "title": "Example title",
  "provider": "This website",
  "category": "necessary",
  "purpose": "Example purpose",
  "sortOrder": 50,
  "slug": "example-slug",
  "visibility": "public",
  "storageType": "cookie",
  "firstParty": true,
  "domain": "Example domain",
  "duration": "Session",
  "privacyPolicyUrl": "https://acme.example/example",
  "disclosure": {
    "metaType": "area",
    "_id": "clx8m2k4p0000a1b2c3d4e5f6",
    "items": [
      {
        "type": "@apostrophecms/rich-text",
        "_id": "clx8m2k4p0000a1b2c3d4e5f6",
        "metaType": "widget",
        "content": "<p>Hello from the API.</p>",
        "sectionCss": {
          "slots": {
            "key": "Example value"
          },
          "css": "Example css",
          "mark": "Example mark"
        }
      }
    ]
  },
  "builtInKey": "Example built in key",
  "embedScriptId": "clx8m2k4p0000a1b2c3d4e5f6",
  "archived": false,
  "_id": "clx8m2k4p0000a1b2c3d4e5f6",
  "type": "Example type",
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "aposShareKey": "k3v9x2m7q1z8w4p6"
}

import { createSiteClient } from '@fetchski/attract-cms-sdk';

const site = createSiteClient();
const cookie = await site.cookies().publishCookie({ id: 'clx8m2k4p0000a1b2c3d4e5f6' });

{
  "title": "Example title",
  "provider": "This website",
  "category": "necessary",
  "purpose": "Example purpose",
  "sortOrder": 50,
  "slug": "example-slug",
  "visibility": "public",
  "storageType": "cookie",
  "firstParty": true,
  "domain": "Example domain",
  "duration": "Session",
  "privacyPolicyUrl": "https://acme.example/example",
  "disclosure": {
    "metaType": "area",
    "_id": "clx8m2k4p0000a1b2c3d4e5f6",
    "items": [
      {
        "type": "@apostrophecms/rich-text",
        "_id": "clx8m2k4p0000a1b2c3d4e5f6",
        "metaType": "widget",
        "content": "<p>Hello from the API.</p>",
        "sectionCss": {
          "slots": {
            "key": "Example value"
          },
          "css": "Example css",
          "mark": "Example mark"
        }
      }
    ]
  },
  "builtInKey": "Example built in key",
  "embedScriptId": "clx8m2k4p0000a1b2c3d4e5f6",
  "archived": false,
  "_id": "clx8m2k4p0000a1b2c3d4e5f6",
  "type": "Example type",
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "aposShareKey": "k3v9x2m7q1z8w4p6"
}

In your app

A function makes the call on the client it is given, so your code passes the real one and a test passes a fake.

Add the function

src/attract/publish-cookie.ts

import type { SiteClient } from '@fetchski/attract-cms-sdk';

export async function publishCookie(site: SiteClient, id: string) {
  return site.cookies().publishCookie({ id });
}

Call it

A script makes the client once and calls the function:

scripts/publish-cookie.ts

import { createSiteClient } from '@fetchski/attract-cms-sdk';
import { publishCookie } from '../src/attract/publish-cookie.ts';

const site = createSiteClient();
console.log(await publishCookie(site, 'clx8m2k4p0000a1b2c3d4e5f6'));

Terminal

node --env-file=.env scripts/publish-cookie.ts

A route handler, a job or a queue worker calls it the same way.

Answers the draft.

Find the id

id is the document’s _id, from a list. Ask the list for only the fields you need: each row is a document’s id and those fields.

TypeScript

import { createSiteClient } from '@fetchski/attract-cms-sdk';

const site = createSiteClient();
const row = (await site.cookies().listCookiesPick(['title', 'slug'])).find((each) => each.slug === 'getting-started'); // { id, title, slug }, or undefined

Pass row.id as id. Drafts: list with { aposMode: 'draft' } to get the draft’s id (Find an id).

Required parameters

One object, e.g. publishCookie({ id }); leave out the optional fields.

string

required

Required. The document’s _id: a full id names its own locale and mode (the draft’s …:en:draft, the published one’s …:en:published; no aposMode needed), a bare aposDocId takes the request’s (aposLocale, aposMode).

Returns

A Cookie. Cookie content type. Read its properties (cookie.title): each says whether the site always sends it. The example answer is the site’s wire JSON: one key differs from the property names (_id → id).

string

Always sent. What a visitor would see in their browser — the cookie’s exact name (fetchski_vid), or the tool’s name where it isn’t a cookie (Google Maps).

string

Always sent. Who receives the data. Name the legal entity for a third party (e.g. “Google LLC”) — a reader is entitled to know who that is.

Behavior

Access: an API key with global:publish (or a master above it: global:all, admin:all). A signed-in person may call it as far as their own permissions allow; anyone else gets 403.
Rate limit: the key’s own writes-per-minute limit, set when the key is created (default 120); over it, 429 with Retry-After. The client waits and retries for you; you see RateLimited only if that runs out.
Retries: a write is sent again only after a 429 (refused before it acted) or when it never reached the site. After a timeout or a 5xx it may have landed: check before you send it again.
Timeout: 15 s per attempt by default; raise timeout (milliseconds) on the client for longer.

Test it

It calls the function above with a fake client: the fake answers every call with a valid example, so nothing leaves your machine and no settings or key are needed. Run it with node --test.

tests/cookies-publishCookie.test.ts

import { test } from 'node:test';
import { fakeSite } from '@fetchski/attract-cms-sdk/testing';
import { publishCookie } from '../src/attract/publish-cookie.ts';

test('cookies.publishCookie', async () => {
  const site = fakeSite();
  await publishCookie(site, 'clx8m2k4p0000a1b2c3d4e5f6');
  site.assertCalled('cookies.publishCookie', (args) => args.id === 'clx8m2k4p0000a1b2c3d4e5f6');
});

Answer with your own values: fake cookies.publishCookie with factories.Cookie({...}), the fields you give over a valid example.

tests/cookies-publishCookie-answer.test.ts

import assert from 'node:assert/strict';
import { test } from 'node:test';
import { factories, fakeSite } from '@fetchski/attract-cms-sdk/testing';

test('cookies.publishCookie answers your values', async () => {
  const site = fakeSite({
    'cookies.publishCookie': factories.Cookie({ title: 'Your value' })
  });
  const cookie = await site.cookies().publishCookie({ id: 'clx8m2k4p0000a1b2c3d4e5f6' });
  assert.equal(cookie.title, 'Your value');
});

List a cookie’s locales

site.cookies().getCookieLocales()

List cookies

site.cookies().listCookies()

Create a cookie

site.cookies().createCookie()

Get a cookie

site.cookies().getCookie()

Replace a cookie

site.cookies().replaceCookie()

Delete a cookie

site.cookies().deleteCookie()

POST /cookie/{_id}/publish

The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks.

import { createSiteClient } from '@fetchski/attract-cms-sdk';

const site = createSiteClient();
const cookie = await site.cookies().publishCookie({ id: 'clx8m2k4p0000a1b2c3d4e5f6' });

{
  "title": "Example title",
  "provider": "This website",
  "category": "necessary",
  "purpose": "Example purpose",
  "sortOrder": 50,
  "slug": "example-slug",
  "visibility": "public",
  "storageType": "cookie",
  "firstParty": true,
  "domain": "Example domain",
  "duration": "Session",
  "privacyPolicyUrl": "https://acme.example/example",
  "disclosure": {
    "metaType": "area",
    "_id": "clx8m2k4p0000a1b2c3d4e5f6",
    "items": [
      {
        "type": "@apostrophecms/rich-text",
        "_id": "clx8m2k4p0000a1b2c3d4e5f6",
        "metaType": "widget",
        "content": "<p>Hello from the API.</p>",
        "sectionCss": {
          "slots": {
            "key": "Example value"
          },
          "css": "Example css",
          "mark": "Example mark"
        }
      }
    ]
  },
  "builtInKey": "Example built in key",
  "embedScriptId": "clx8m2k4p0000a1b2c3d4e5f6",
  "archived": false,
  "_id": "clx8m2k4p0000a1b2c3d4e5f6",
  "type": "Example type",
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "aposShareKey": "k3v9x2m7q1z8w4p6"
}

Get started

Using the SDK

Going further

Pages & Site

Content

Media

Forms

Ads & Conversions

Analytics

In your app

Find the id

Behavior

Test it

List a cookie’s locales

List cookies

Create a cookie

Get a cookie

Replace a cookie

Delete a cookie

POST /cookie/{_id}/publish

In your app

Find the id

Behavior

Test it

Related

List a cookie’s locales

List cookies

Create a cookie

Get a cookie

Replace a cookie

Delete a cookie

POST /cookie/{_id}/publish