Data subject requests for JavaScript
Show a visitor every consent record you hold about them, or delete them all, with one call each.
When someone asks to see or delete their data, the backend answers with one call. Both routes need an owner key, so set apiKeys first.
Set an owner key
createConsentBackend({
// …
apiKeys: [process.env.CONSENT_OWNER_KEY],
});Generate a key of at least 32 characters, for example with openssl rand -hex 32, and keep it on the server. Never use it as the SDK's apiKey: that one is visible to anyone who opens your page.
Find the visitor's id
Records are filed under the visitor's consentId, a random id in their consent cookie. To let visitors quote it, show it on your privacy page or in your account settings:
const id = runtime.consentStore.getState().consentId; // runtime: what initCookieYes() returnedA visitor who resets their consent, or uses another browser, gets a new id. Ask for every id they can find.
See their records
curl https://shop.example.com/api/consent/consents/VISITOR_ID \
-H "Authorization: Bearer $CONSENT_OWNER_KEY"The answer is { "records": [...] }, oldest first. Add ?format=csv for a spreadsheet with one row per decision.
Delete their records
curl -X DELETE https://shop.example.com/api/consent/consents/VISITOR_ID \
-H "Authorization: Bearer $CONSENT_OWNER_KEY"The answer is { "deleted": 3 }. The rows are deleted, not flagged; reading them again returns none. The choice in the visitor's own browser is untouched; they can change it with the recall button.
Good to know
- Without
apiKeys, both routes always answer 401. - A record that arrives after the delete, from a retry still waiting in the visitor's browser, is stored again. Delete once more after a week if that matters to you: the SDK retries for at most 7 days.