For builders

Headless by design.
Documented from the source.

Our OpenAPI spec is generated from the gateway’s registered routes — 497 documented paths, 678 operations, no drift between docs and deployment. Read it before you talk to us. Build your own consent UI, or drop in ours; the backend doesn’t care.

API BASE: https://app.consentree.in/api/v1 · CONSOLE: app.consentree.in · SENTIN-AI: sentinai.consentree.in

10 lines to first consentJS SDK
import { createClient } from '@consentree/js';

const cs = createClient({ apiKey: 'pk_live_…' });

// render the banner — notice version & language resolved server-side
cs.banner.mount('#consent-root', { language: 'auto' });

// gate a purpose anywhere in your app
if (await cs.consent.has('analytics')) {
  initAnalytics();
}
documented REST pathssource of truth: the gateway itself
client SDKs at v1.1.0signed webhooks · typed clients
in-app guides in the docs hubwritten from working code
SSElive compliance event streamplus signed webhooks
SDKs

Four SDKs. One consent model.

All four share the same key model, webhook signature verification, and consent semantics — learn one, know them all.

WEB

@consentree/js

Framework-free banner, preference center and purpose checks for any site. Offline queueing with sync-on-reconnect.

v1.1.0 · vanilla JS/TS
WEB

@consentree/react

Hooks and components — useConsent(), <ConsentGate/> — that make purpose-gating declarative.

v1.1.0 · React 18/19
SERVER

@consentree/node

Server-side consent checks, DSR submission, and signed-webhook verification middleware for Express & friends.

v1.1.0 · Node 18+
RIGHTS

@consentree/dsar-sdk

Drop-in data-subject request intake — submission, status polling and verification handoff — for embedding rights flows in your own portal.

v1.1.0 · TypeScript

How you get them, stated plainly: these are built from our monorepo and provided directly to design partners and integration clients. They are not yet published to a public package registry, so npm install will not find them today — ask us and we will send you the tarball and the integration guide. Native Java, Android and Flutter SDKs are on the roadmap and are not built.

Events

Your backend hears it
the moment it happens.

The event-hub delivers signed webhooks for every lifecycle event — grants, withdrawals, expiries, erasure completions — with delivery logs you can actually inspect when something goes wrong. Need push instead of pull? There’s a live SSE stream too.

Shipped: event-hub-service · HMAC-signed deliveries · delivery log UI
verify, then trustNODE
import { verifyWebhook } from '@consentree/node';

app.post('/hooks/consent', (req, res) => {
  const evt = verifyWebhook(req, process.env.CS_WEBHOOK_SECRET);

  switch (evt.type) {
    case 'consent.withdrawn':
      // stop processing — the platform already logged the proof
      await crm.suppress(evt.data_principal);
      break;
    case 'dsr.erasure.completed':
      await notifyPrivacyTeam(evt);
  }
  res.sendStatus(200);
});
Enforcement

Purpose checks happen
on our servers, not yours.

Client-side purpose gating is a UI nicety, not a control — anyone can open devtools and flip it. Every consent check the SDKs call resolves against the gateway itself, so a denied purpose is a hard stop no client code can bypass, and the denial is itself an audited event.

consent check · edge latency pathGO · GATEWAY
// Purpose-limitation is enforced in the backend,
// not left to the UI’s good manners.
decision := engine.Resolve(ctx, ResolveReq{
    Principal: "dp_7f3a…",
    Purpose:   "marketing.email",
})

if !decision.Granted {
    // hard stop — and the denial is itself audited
    return ErrPurposeNotConsented
}
API surface

A taste of the 497.

Representative endpointsFULL REFERENCE IN THE DEVELOPER HUB
MethodEndpointWhat it does
POST/v1/consentsRecord a consent decision against a notice version
GET/v1/consents/resolvePurpose-level consent check on the hot path
POST/v1/dsr/requestsOpen an access / correction / erasure request
GET/v1/dsr/requests/{id}/proofFetch per-system execution proof for a DSR
GET/v1/audit/receipts/{id}Download a tamper-evident consent receipt (PDF)
GET/v1/audit/chain/verifyVerify chain integrity & TSA anchors
POST/v1/scansTrigger a discovery or risk scan
GET/v1/events/streamLive SSE stream of compliance events

Keys with a blast radius you choose

Per-key domain allowlists (exact-match, no prefix tricks), scoped permissions, and rotation without downtime.

Shipped: per-key allowed_domains, exact-match enforcement

Sandbox that mirrors production

A dedicated staging environment for DPDP workflows — plus Playwright and Go testcontainers to mock consent flows in your own CI.

Shipped: sandbox tenants · E2E test containers