Client reference

Every method on the @cookiemunch/sdk client (packages/sdk/src/index.ts), grouped by namespace exactly as the client exposes them. All methods return Promises and throw CookieMunchApiError { status, message, code? } on any non-2xx response — see Install & initialize. The org is always derived from your API key; no method accepts an orgId.

import { createCookieMunch } from '@cookiemunch/sdk';
const client = createCookieMunch({ apiKey: 'fck_…', baseUrl: 'https://api.cookiemunch.net' });

client.me()

me(): Promise<Identity> // { orgId, plan, keyPrefix }

client.sites

sites: {
  list(): Promise<Site[]>;
  create(input: SiteCreate): Promise<Site>;
  get(cbid: string): Promise<Site>;
  delete(cbid: string): Promise<void>;
  getConfig(cbid: string): Promise<SiteConfig>;
  putConfig(cbid: string, config: SiteConfig): Promise<SiteConfig>;
  cookies(cbid: string): Promise<CookieDeclaration>;       // { updatedAt, cookies: CategorizedCookie[] }
  scan(cbid: string): Promise<ScanStatus>;                  // kicks off a crawl
  scanStatus(cbid: string): Promise<ScanStatus>;            // { status: 'idle' | 'scanning', lastScannedAt }
  ab(cbid: string): Promise<AbResult[]>;
  snippet(cbid: string, opts?: SnippetOptions): Promise<InstallSnippet>;
  verify(cbid: string, method: 'dns' | 'meta' | 'file'): Promise<VerifyResult>;
  brand(cbid: string): Promise<BrandExtractionResult>;      // "Match my site" theme extraction
  getFlow(cbid: string): Promise<SiteFlow>;                 // v2 banner flow + lint issues
  editFlow(cbid: string, operations: FlowOp[]): Promise<FlowOpResponse>;
  setFlow(cbid: string, config: Record<string, unknown>): Promise<FlowOpResponse>;
}

const site = await client.sites.create({ domain: 'example.com' }); // cbid auto-generated
const config = await client.sites.getConfig(site.cbid);
await client.sites.putConfig(site.cbid, { ...config, banner: { ...config.banner, layout: 'popup' } });

const { snippet } = await client.sites.snippet(site.cbid, { blockingMode: 'auto', culture: 'en' });
await client.sites.scan(site.cbid);
const status = await client.sites.scanStatus(site.cbid);
const { verified } = await client.sites.verify(site.cbid, 'dns');

editFlow applies an ordered batch of ops (addView, removeView, addElement, setButtonTransition, addCustomCategory, …). If validation or linting fails, nothing is persisted and the response is { ok: false, failedAt?, op?, issues } instead of { ok: true, flow }.

client.consent

consent: {
  stats(cbid: string, query?: RangeQuery): Promise<ConsentDay[]>;
  log(cbid: string, query?: LogQuery): Promise<ConsentLogRow[]>;
  export(cbid: string, query?: RangeQuery): Promise<string>;   // raw CSV text
  receipt(cbid: string, stamp: string): Promise<SignedReceipt>;
  eraseSubject(cbid: string, stamp: string): Promise<{ erased: number }>;
  exportSubject(cbid: string, stamp: string): Promise<{ cbid: string; stamp: string; records: unknown[]; count: number }>;
  ingest(input: ConsentIngestInput): Promise<void>;
}

const days = await client.consent.stats(cbid, { from: Date.now() - 30 * 86_400_000 });
const recent = await client.consent.log(cbid, { limit: 50 });
const csv = await client.consent.export(cbid);              // requires a verified domain
const receipt = await client.consent.receipt(cbid, 'stamp_abc123'); // requires a verified domain

await client.consent.eraseSubject(cbid, 'stamp_abc123');     // irreversible crypto-erase
const bundle = await client.consent.exportSubject(cbid, 'stamp_abc123');

ingest hits the public, unauthenticated POST /api/v1/consent endpoint directly (no /v1 prefix — the request is routed around the authenticated base URL logic), so it works without an API key as long as the cbid is a registered site:

await client.consent.ingest({
  cbid, stamp: 'stamp_abc123',
  choices: { preferences: false, statistics: true, marketing: false },
  method: 'explicit', ver: 1, utc: Date.now(), url: 'https://example.com',
  subjectId: 'user_42', // optional cross-surface correlation id
});

client.dsar

dsar: {
  list(): Promise<DsarRequest[]>;
  create(input: DsarCreate): Promise<{ request: DsarRequest }>;
  advance(id: string, toStatus: DsarStatus): Promise<{ request: DsarRequest }>;
}

const { request } = await client.dsar.create({ type: 'access', subjectEmail: '[email protected]', regulation: 'gdpr' });
await client.dsar.advance(request.id, 'verifying');

DsarStatus progresses received → verifying → in_progress → completed, or rejected. type is one of access | deletion | rectification | portability | opt-out; regulation is gdpr | ccpa.

client.vendors

vendors: {
  list(): Promise<ScoredVendor[]>;
  create(input: VendorInput): Promise<{ vendor: Record<string, unknown>; risk: { score: number; band: string } }>;
}

const { vendor, risk } = await client.vendors.create({
  name: 'Segment', category: 'analytics', dataShared: ['device_id'],
  dpaSigned: true, subprocessors: 3, certifications: ['SOC2'], region: 'US',
});

client.ropa

ropa: {
  list(): Promise<RopaEntry[]>;
  create(input: RopaInput): Promise<{ entry: RopaEntry }>;
}

const { entry } = await client.ropa.create({
  name: 'Email marketing', purpose: 'Send product updates', legalBasis: 'consent',
  dataCategories: ['email'], recipients: ['Mailchimp'], retentionDays: 730, crossBorderTransfer: true,
});

legalBasis is one of consent | contract | legal-obligation | vital-interests | public-task | legitimate-interests.

client.brandKits

brandKits: {
  list(): Promise<BrandKit[]>;
  create(input: BrandKitCreate): Promise<{ kit: BrandKit }>;
  delete(id: string): Promise<void>;
}

client.preferences

preferences: {
  list(): Promise<PreferenceItem[]>;
  save(subjectId: string, purposes: Record<string, boolean>): Promise<unknown>;
}

await client.preferences.save('[email protected]', { newsletter: true, sms: false });

client.members, client.keys, client.usage()

Admin-only — require an unscoped API key.

members: {
  list(): Promise<Member[]>;
  invite(email: string, role: string): Promise<{ member: { userId: string; email: string; role: string } }>;
  setRole(userId: string, role: string): Promise<{ member: { userId: string; email: string; role: string } }>;
  remove(userId: string): Promise<unknown>;
}
keys: {
  list(): Promise<ApiKeyPrefix[]>;      // prefixes only — secrets are never re-listed
  issue(input?: ApiKeyIssueInput): Promise<ApiKeyIssued>; // { key, prefix } — key shown once
}
usage(): Promise<Usage>; // { domains, seats, monthlyEvents }

await client.members.invite('[email protected]', 'admin');
const { key } = await client.keys.issue({ name: 'ci-bot' }); // store `key` now — it's never returned again

client.webhooks

webhooks: {
  list(): Promise<WebhookSubscription[]>;
  create(input: WebhookCreate): Promise<WebhookSubscription>; // { url, events, cbid? }
  delete(id: string): Promise<void>;
}

const sub = await client.webhooks.create({
  url: 'https://example.com/hooks/cookiemunch',
  events: ['consent.recorded', 'dsar.created'],
});
console.log(sub.secret); // returned once, on create only
await client.webhooks.delete(sub.id);

Full event catalog and signature verification: Webhooks & events.

client.banners

The reusable, account-level banner library — one design assignable to many sites.

banners: {
  list(): Promise<BannerSummary[]>;
  create(input: { name: string; json: SiteConfig }): Promise<BannerRecord>;
  get(id: string): Promise<BannerRecord>;
  update(id: string, patch: { name?: string; json?: SiteConfig }): Promise<BannerRecord>;
  delete(id: string): Promise<void>;
  assignments(id: string): Promise<{ cbids: string[] }>;
  setAssignments(id: string, cbids: string[]): Promise<{ cbids: string[] }>;
  publish(id: string): Promise<{ publishedCbids: string[] }>;
}

const design = await client.banners.create({ name: 'EU banner — dark', json: { v: 2, flow: { views: [] }, categories: {} } });
await client.banners.setAssignments(design.id, [site.cbid]);
const { publishedCbids } = await client.banners.publish(design.id); // fires a banner.published webhook per site

Full example: onboard a site end to end

import { createCookieMunch } from '@cookiemunch/sdk';

const client = createCookieMunch({ apiKey: process.env.COOKIEMUNCH_API_KEY!, baseUrl: 'https://api.cookiemunch.net' });

const site = await client.sites.create({ domain: 'shop.example.com' });
await client.sites.verify(site.cbid, 'dns');

const { snippet } = await client.sites.snippet(site.cbid);
// hand `snippet` to whoever manages the site's <head>

await client.webhooks.create({
  url: 'https://example.com/hooks/cookiemunch',
  events: ['consent.recorded'],
  cbid: site.cbid,
});

See also: MCP tools reference — the same capabilities exposed as tools for an AI agent, built directly on this SDK.