What a developer connects to Fohrkast

• The consent banner

  One script tag, first in the page head. It shows the business's privacy notice, asks for consent per purpose, records each choice and holds known trackers until the visitor agrees. Each website has its own embed key, shown in the app when the website is added.

  <script src="https://fohrkast.com/shield.js" data-key="EMBED_KEY"></script>

• The consent check API

  Before a message, a call or an export, the business's own server asks whether a person's consent for a purpose is held. It needs a consent check key; a test key reads only.

  GET /api/in/v1/shield/consent?token=&purpose=
    One consent check: { granted, notice, at }
  GET /api/in/v1/shield/events?since=<seq>
    Consent given and withdrawn after a log position, 500 at a time

• Webhooks

  Consent given and consent withdrawn, sent to each registered https endpoint within five minutes and retried for about two days. Each delivery is signed with HMAC and SHA 384 over the time and the raw body, under the endpoint's secret. Refuse a signature older than five minutes and a delivery already seen.

• WordPress and Shopify

  The WordPress plugin prints the banner script first in the page head and holds the script tags of known trackers until consent. The Shopify theme app extension adds the banner to the store's theme as a block.

• The scanner, in the business's own cloud

  The scanner runs in the business's own environment, reads its databases and code, and sends labels and counts only, never a value. Fohrkast activates each run against the scanner key first. In CI it can stop a pull request that sends sensitive columns to a new vendor.

The full reference, with every path, key scope, error and the webhook body: API reference.