Record a consent change for a contact

curl --request POST \
  --url https://api.mercemur.com/api/v1/marketing-contacts/{marketingContactId}/consent \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{}'

const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({})
};

fetch('https://api.mercemur.com/api/v1/marketing-contacts/{marketingContactId}/consent', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.mercemur.com/api/v1/marketing-contacts/{marketingContactId}/consent"

payload = {}
headers = {
    "Idempotency-Key": "<idempotency-key>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.mercemur.com/api/v1/marketing-contacts/{marketingContactId}/consent"

	payload := strings.NewReader("{}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Idempotency-Key", "<idempotency-key>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.mercemur.com/api/v1/marketing-contacts/{marketingContactId}/consent",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "Idempotency-Key: <idempotency-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

{
  "data": {
    "anonymous_id": null,
    "created_at": "<string>",
    "customer_id": null,
    "email": "<string>",
    "email_consent": "<string>",
    "erased": true,
    "erasure_scheduled_for": null,
    "first_name": "<string>",
    "id": "<string>",
    "last_name": "<string>",
    "orders_count": 123,
    "phone_e164": null,
    "push_consent": "<string>",
    "resolved_tz": null,
    "sms_consent": "<string>",
    "updated_at": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

API Reference

Record a consent change for a contact

Appends a consent event and moves the contact’s state for that channel, in one transaction, so the proof and the state can never diverge. THE LEDGER CANNOT BE EDITED. Nothing on this API or in the dashboard can rewrite or remove a row, by design: that immutability is what makes it worth producing to a regulator. Correct a mistake by recording the event that is true now. A KEY HOLDING write_marketing_contacts CAN RECORD AN OPT-IN, which is the direction that costs the merchant rather than the shopper. Ask for this grant only where your system genuinely captured the consent. The response is the contact, so you can read whether the person may now be mailed.

POST

api

marketing-contacts

{marketingContactId}

consent

Record a consent change for a contact

curl --request POST \
  --url https://api.mercemur.com/api/v1/marketing-contacts/{marketingContactId}/consent \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{}'

const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({})
};

fetch('https://api.mercemur.com/api/v1/marketing-contacts/{marketingContactId}/consent', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.mercemur.com/api/v1/marketing-contacts/{marketingContactId}/consent"

payload = {}
headers = {
    "Idempotency-Key": "<idempotency-key>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.mercemur.com/api/v1/marketing-contacts/{marketingContactId}/consent"

	payload := strings.NewReader("{}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Idempotency-Key", "<idempotency-key>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.mercemur.com/api/v1/marketing-contacts/{marketingContactId}/consent",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "Idempotency-Key: <idempotency-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

{
  "data": {
    "anonymous_id": null,
    "created_at": "<string>",
    "customer_id": null,
    "email": "<string>",
    "email_consent": "<string>",
    "erased": true,
    "erasure_scheduled_for": null,
    "first_name": "<string>",
    "id": "<string>",
    "last_name": "<string>",
    "orders_count": 123,
    "phone_e164": null,
    "push_consent": "<string>",
    "resolved_tz": null,
    "sms_consent": "<string>",
    "updated_at": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

Authorizations

Authorization

string

header

required

A secret API key. Publishable keys cannot reach this API. A key may carry an expiry, and an expired key is refused exactly like an unknown one, with a 401 that names no reason; check the key's expires_at in the dashboard rather than inferring it from a response. When a merchant rolls a key's secret they choose a grace window of up to 3 days, and for its duration BOTH the new secret and the one it replaced authenticate, so an integration moves over on its own deploy schedule instead of at the instant the button is pressed. Move before the window closes: after it, the old secret is refused. Nothing else about this contract moves with a roll. The key keeps its id and its scopes, so the only thing an integration updates is the credential itself.

Headers

Idempotency-Key

string

required

A unique key per logical write. Replaying a request with the same key returns the first response byte for byte instead of applying the write twice.

Path Parameters

marketingContactId

string

required

Body

application/json

THIS WRITES EVIDENCE, NOT A SETTING. The row lands in an append-only ledger this platform holds no update or delete permission on, so a wrong record stands forever and can only be contradicted by a later one, and that ledger is what a merchant produces to show a subscribe was real. Send the action that is true. THE ACTION DECIDES THE STATE, which is why there is no consent field to write: subscribe, confirm and import all land on subscribed, unsubscribe lands on unsubscribed, and pending lands on pending. An event and the state it produced can never disagree. THE BODY IS TWO FIELDS AND THE SERVER OWNS THE REST OF THE ROW. source, text_shown, ip, ua and occurred_at are each refused BY NAME with a 400, not ignored, because all five describe the person who acted and this request was made by your server rather than by them. Your address and http client describe your integration; the disclosure text describes a page an api write showed nobody. The server stamps source as public_api and text_shown as its own sentence saying so, and that is the whole point of the ledger: an auditor has to be able to separate a row a recipient produced by clicking a link in their own inbox from a row a merchant's integration wrote on their behalf, because only the first is evidence the recipient consented. Consent captured from a real shopper on the storefront keeps its own source, text, address and device. The response is the CONTACT, so you can read the resulting state, not the event you just sent.

channel

enum<string>

required

Which channel this decision is about. Consent is per channel: an email unsubscribe says nothing about sms.

Available options:

email,

sms,

push

action

enum<string>

required

What happened. confirm is the completion of a double opt-in, so send it only when you hold the evidence the person clicked a link in their own inbox; import is the right action when migrating a list from another system, and it records the subscription as inherited rather than freshly given. There is no default, because every value here changes who may be mailed.

Available options:

subscribe,

unsubscribe,

confirm,

pending,

import

Response

Success

data

object

Show child attributes

Overview

Endpoints

Record a consent change for a contact

Authorizations

Headers

Path Parameters

Body

Response