Q: I receive 401 Unauthorized on every request. What should I check?
Bearer <token>
Q: I received 403 Forbidden even though I am authenticated.
Q: I received 207 Multi-Status. What does this mean?
It means that at least one URL succeeded and at least one failed. Always iterate over every item in the response array and inspect the status and message fields. Do not assume all operations completed successfully just because you received a 2xx response.
Q: A URL I tried to add appears in the response with status ALREADY_EXISTS.
The website is already registered in the specified Cookie Consent Manager. This is not a critical error — you can safely skip these entries. If you believe this is incorrect, verify the cmUuid you are targeting.
Q: Can I send more than one website per request?
Yes. The Websites field accepts an array. Batch multiple URLs in a single request to reduce round-trips. Each URL is processed independently, and results are returned as an array with per-URL status.
Q: I receive 409 Conflict when trying to create a scan.
A scan is already running for the specified website. Wait for the current scan to complete before submitting a new request. Implement a polling or webhook-based mechanism to detect when scans finish.
Q: I receive 404 Not Found when creating a scan.
cmUuid.POST /external/v1/websites endpoint before triggering a scan.cmUuid — websites are scoped per Consent Manager instance.Q: The scan API returned 201, but I see no scan results in the portal.
The 201 response confirms the scan was queued, not that it has completed. Cookie scans are asynchronous and may take several minutes to hours depending on the size of the site. Check the portal after allowing sufficient processing time.
Q: What is the rate limit for the External API?
Rate limit thresholds vary by account tier. Contact your TrustArc Account Manager for your specific limits. Implement exponential backoff when receiving 429 Too Many Requests responses.
Q: How do I find my cmUuid?
UUID is displayed in the page URL or the Settings panel, formatted as a standard UUID (e.g., a1b2c3d4-e5f6-7890-abcd-ef1234567890).Q: Which HTTP methods are supported for DELETE /websites?
The Remove Websites endpoint uses HTTP DELETE with a request body. Some HTTP clients and proxies do not support body payloads on DELETE requests. If you encounter issues, confirm your HTTP client is configured to allow a request body on DELETE. As an alternative, contact TrustArc support about your specific client limitations.
Q: Are there sandbox or staging environments available?
Yes. TrustArc provides a staging environment for integration testing. Request staging credentials from your account manager. Use separate tokens for staging vs. production to avoid unintended data changes.
If you encounter issues not covered in this guide: