API reference
Versioned REST over sites, scans and policies.
The surface below is the shape of the API. Full request and response schemas publish with the API itself, so this page can never describe an endpoint that does not exist.
| Method | Path | What it returns |
|---|---|---|
| GET | /v1/sites | List the sites in an organization with their runtime and policy assignment. |
| POST | /v1/sites/{id}/scans | Start a scan, optionally naming which consent states to run. |
| GET | /v1/scans/{id} | Scan status and, once finished, the observations it produced. |
| GET | /v1/sites/{id}/services | The discovered services with vendor, category and first/last seen. |
| GET | /v1/sites/{id}/cookies | The cookie and storage inventory behind the disclosure. |
| GET | /v1/sites/{id}/manifest | The current Consent Manifest version for a site. |
| POST | /v1/sites/{id}/policies | Publish a new immutable policy version. |
| GET | /v1/sites/{id}/health | Privacy Health findings for the most recent verification run. |
| GET | /v1/sites/{id}/consents/summary | Aggregate consent outcomes. Individual receipts are a separate, stricter endpoint. |
Authentication
Tokens are scoped to an organization and carry the same permissions as the user or service that issued them. Receipt endpoints require an additional grant.
Idempotency
Write requests accept an idempotency key. A retried create returns the original record rather than a duplicate.
Versioning
Breaking changes arrive as /v2. The current version keeps working until it is formally deprecated with notice.
The object model behind these endpoints is described under Developers.
Know what runs before you ask visitors to trust it.
Start with a scan of what your website loads today. The list is usually longer than the team expects, and that is the useful part.
No code to install for a scan Public pages only DotCensus runs on DotCensus