Search

API Reference

This section documents all available endpoints in the CCM External API v1.

Websites

The Websites resource allows you to add and remove website URLs from a specified Consent Manager (CM) instance.

Add Websites
Method POST
Endpoint POST /external/v1/websites
Required Roles SUPER_ADMIN, ADMIN, DESIGNER
Request Body 
{
  "cmUuid": "string (required) — UUID of the target Consent Manager instance",
  "websites": [
    "string (required) — One or more fully-qualified URLs to add"
  ]
}
Request Body Schema Field Type Required Description
cmUuid string Yes UUID of the Consent Manager to add websites to.
websites string[] Yes Array of fully-qualified website URLs to add.
Response Returns an array of WebsiteResultDTO objects, one per requested URL.
HTTP Status Condition Meaning
201 Created All URLs added successfully. Every website in the request was added without error.
207 Multi-Status Partial success. One or more URLs succeeded and one or more failed. Inspect each result's status field.
400 Bad Request All URLs failed. No websites were added. Review errors in the response body.
401 Unauthorized Auth failure. Token is missing, expired, or invalid.
403 Forbidden Insufficient role. An authenticated user lacks the required role.
Response Body Schema
(WebsiteResultDTO)		 Field Type Description
url string The URL that was processed.
status string Result status: SUCCESS or an error code indicating the failure reason.
message string Human-readable description of the result or failure reason.
Example Request 
curl -X POST \
  https://<your-ccm-domain>/external/v1/websites \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "cmUuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "websites": ["https://example.com", "https://shop.example.com"]
  }'
Example Response (201 Created) 
[
  {
    "url": "https://example.com",
    "status": "SUCCESS",
    "message": "Website added successfully."
  },
  {
    "url": "https://shop.example.com",
    "status": "SUCCESS",
    "message": "Website added successfully."
  }
]
Example Response (207 Multi-Status) 
[
  {
    "url": "https://example.com",
    "status": "SUCCESS",
    "message": "Website added successfully."
  },
  {
    "url": "https://already-exists.com",
    "status": "ALREADY_EXISTS",
    "message": "Website is already registered in this Cookie Consent Manager."
  }
]
Remove Websites
Method DELETE
Endpoint DELETE /external/v1/websites
Required Roles SUPER_ADMIN, ADMIN, DESIGNER
Request Body Same schema as Add Websites. Provide cmUuid and the array of website URLs to remove.
{
  "cmUuid": "string (required)",
  "websites": ["string (required)"]
}
Response Codes HTTP Status Condition Meaning
200 OK All URLs removed. Every website in the request was removed without error.
207 Multi-Status Partial success. One or more removed; one or more failed. Inspect each result's status field.
400 Bad Request All URLs failed. No websites were removed.
Example Request 
curl -X DELETE \
  https://<your-ccm-domain>/external/v1/websites \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "cmUuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "websites": ["https://old.example.com"]
  }'
Scans

The Scans resource allows you to initiate an automated cookie scan for a registered website.

Create Scan
Method POST
Endpoint POST /external/v1/scans
Required Roles SUPER_ADMIN, ADMIN, DESIGNER
Request Body Schema Field Type Required Description
websiteId string Yes Identifier of the website to scan, as registered in the CM.
cmUuid string Yes UUID of the Cookie Consent Manager that owns the website.
scanType string Yes Type of scan to perform. Defaults to FULL if omitted.
Response Codes HTTP Status Condition Meaning
201 Created Scan created. Scan was successfully queued. The response body contains ScanDTO.
400 Bad Request Invalid request. The request body failed validation or the scan request was malformed (ArachnidException / BadRequestException).
404 Not Found Resource missing. The specified website or CM instance does not exist.
409 Conflict Scan conflict. A scan is already in progress for the specified website (ScanException).
500 Internal Server Error Server error. Unexpected server-side failure. Retry after a backoff interval.
Response Body Schema (ScanDTO) Field Type Description
scanId string Unique identifier for the created scan.
websiteId string Identifier of the website being scanned.
status string Initial scan status (e.g., QUEUED, IN_PROGRESS).
createdAt string ISO 8601 timestamp of when the scan was created.
Example Request 
curl -X POST \
  https://<your-ccm-domain>/external/v1/scans \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "cmUuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "websiteId": "ws-001",
    "scanType": "FULL"
  }'
Example Response (201 Created) 
{
  "scanId": "scn-abc123",
  "websiteId": "ws-001",
  "status": "QUEUED",
  "createdAt": "2025-04-23T10:30:00Z"
}
Error Response Schema On 400, 404, 409, or 500, the response body contains an ErrorMessage object:
{
  "message": "string — human-readable error description",
  "type": "string — error category (SYSTEM, VALIDATION, CONFLICT, etc.)",
  "timestamp": "string — ISO 8601 timestamp of the error"
}
Tracker Inventory

The Tracker Inventory resource provides paginated, sortable access to all trackers (cookies and other tracking technologies) associated with a given Consent Manager instance. Results can be filtered by tracker type and sorted across a rich set of fields.

Get Tracker Inventory
Method GET
Endpoint GET /external/tracker/inventory/{cmId}
Required Roles SUPER_ADMIN, ADMIN
Path Parameters Parameter Type Description
cmId string The Consent Manager identifier. Resolved to an internal UUID via the consent manager service.
Query Parameters Parameter Type Required Description
discriminator string No Filter results by tracker origin. Accepted values: SCANNED, MANUAL. Omit to return all trackers.
page integer No Zero-based page index. Default: 0.
size integer No Number of records per page. Default: 100. Maximum: 500.
sort string No Sort expression in the format field,direction (e.g., sort=name,asc). Default sort: categoryPriority, seedUrl, trackerId. See Sortable Fields below for allowed values.
Sortable Fields The following field names are valid values for the sort parameter:

categoryId, categoryName, categoryPriority, trackerId, discriminator, domain, trackerType, name, identifier, seedUrl, duration, organizationId, organizationName, hidden, thirdPartySharing, isNew, lastKeepAccept, dataCollected, trackerPurpose, cookieVendorInformation
Response Codes HTTP Status Condition Meaning
200 OK Success. Returns a paginated Page of TrackerInventoryRecord objects.
400 Bad Request Invalid request parameters. Returned when page size exceeds 500, the sort field is not in the allowed list, or the discriminator value is not SCANNED or MANUAL.
401 Unauthorized Auth failure. Token is missing, expired, or invalid.
403 Forbidden Insufficient role or does not own the CM account. The authenticated user lacks the required role, or does not own the specified Cookie Consent Manager account.
Example Request 
curl -X GET \
  "https://<your-ccm-domain>/external/tracker/inventory/a1b2c3d4-e5f6-7890-abcd-ef1234567890" \
  -H "Authorization: Bearer <token>" \
  "?discriminator=SCANNED&page=0&size=100&sort=categoryPriority,asc"
TrustArc  ·  CCM External API  ·  https://trustarc.com/