The TruePrivacy REST API lets you automate scans, manage schedules, and read consent data programmatically.
API keys management in the dashboard

​
Basics

  • Base URL: https://api.trueprivacy.io/v1
  • Authentication: Bearer token in the Authorization header. Create API keys in the dashboard under Settings → API Keys. All authenticated endpoints are scoped to your organization.
  • Errors: RFC 7807 application/problem+json:
{
  "type": "https://api.trueprivacy.io/problems/not-found",
  "title": "Scan not found",
  "status": 404,
  "detail": "No scan with id scn_9f2c exists in this organization."
}

curl https://api.trueprivacy.io/v1/tracker-scanner/scans \
  -H "Authorization: Bearer tp_live_xxxxxxxxxxxx"

​
Tracker Scanner endpoints

MethodPathDescription
POST/v1/tracker-scanner/scanStart a new scan
GET/v1/tracker-scanner/scansList scans
GET/v1/tracker-scanner/scans/{id}Get a scan with results and diff
POST/v1/tracker-scanner/scans/{id}/applyApply scan results to detected cookies
GET/v1/tracker-scanner/scheduleGet the scan schedule
PUT/v1/tracker-scanner/scheduleCreate or update the scan schedule

​
Start a scan

// POST /v1/tracker-scanner/scan
{
  "siteUrl": "https://www.example.com",
  "maxPages": 10
}

// 202 Accepted
{
  "id": "scn_9f2c1ab4",
  "status": "pending",
  "siteUrl": "https://www.example.com",
  "maxPages": 10,
  "createdAt": "2026-07-24T08:00:12Z"
}

​
Get a scan

// GET /v1/tracker-scanner/scans/scn_9f2c1ab4
{
  "id": "scn_9f2c1ab4",
  "status": "completed",
  "engine": "playwright",
  "pagesScanned": 10,
  "completedAt": "2026-07-24T08:01:47Z",
  "cookies": [
    {
      "name": "_ga",
      "provider": "Google Analytics",
      "domain": ".example.com",
      "party": "third",
      "storage": "cookie",
      "expiry": "2 years",
      "suggestedCategory": "statistics"
    }
  ],
  "diff": {
    "newTrackers": ["TikTok Pixel"],
    "removedTrackers": []
  }
}

​
Update the schedule

// PUT /v1/tracker-scanner/schedule
{
  "enabled": true,
  "frequency": "weekly",
  "siteUrl": "https://www.example.com",
  "notificationEmail": "privacy@example.com"
}
MethodPathDescription
POST/v1/consent/scanTrigger a scan from the consent context (Detected Cookies tab)
GET/v1/consent/detected-cookiesList detected cookies with category mappings
PATCH/v1/consent/detected-cookies/{id}Re-categorize a detected cookie
// PATCH /v1/consent/detected-cookies/dc_51aa
{
  "category": "marketing"
}

// 200 OK
{
  "id": "dc_51aa",
  "name": "_fbp",
  "category": "marketing",
  "carriedForward": true
}
Category assignments made via PATCH are carried forward across rescans, exactly like changes made in the dashboard.

​
Public endpoints (no auth)

MethodPathDescription
GET/v1/public/consent/{publicKey}/configPublished banner configuration (used by banner.js)
GET/v1/public/consent/{publicKey}/declarationPublic cookie declaration (cached 1 hour)
See Cookie Declaration for the declaration response shape.
Public endpoints are identified by the site’s public key and safe to call from browsers — they expose only published, visitor-facing data.