Cookies Beta
GET /api/v1/cookies
Lists the cookies a page sets and names the provider, purpose, category and retention for each — a privacy and consent audit inside your SEO API. Cookies are matched against a catalogue of 2,585 patterns, and third-party cookies (a domain outside the page's apex) and cookies missing Secure are flagged.
Beta. This endpoint is new: it is live and safe to call on every plan, but its response shape may still change while we take feedback. Nothing here is scheduled for removal — if you depend on a particular field, tell us and we will keep it stable for you.
Response headers only — this is not a browser scan. The endpoint reads the Set-Cookie headers returned by the page fetch. Cookies written later by JavaScript are not captured, so do not treat this as a full headless-browser consent scan. When the catalogue cannot be loaded,
classified comes back false and provider, category and purpose are null — the cookies themselves are still listed.Authentication
Send your API key as an X-API-Key header, or as a key query parameter. Available on every plan, including Free — plans differ only in requests per day. This call costs one request against your daily quota, which is shared across every key on the account. See Authentication.
Query parameters
| Name | Type | Description |
|---|---|---|
url required | string | The page to check. |
key optional | string | Your API key, if not sent as the X-API-Key header. |
Request
Response
200 · application/json
- {
- "url": "https://example.com", "host": "example.com",
- "count": 2, "classified": true,
- "thirdPartyCount": 1, "insecureCount": 2,
- "cookies": [
- { "name": "sid", "secure": false, "httpOnly": true, "sameSite": null,
- "domain": null, "days": null, "provider": null, "category": null,
- "purpose": null, "thirdParty": false },
- { "name": "_ga", "secure": false, "httpOnly": false, "sameSite": null,
- "domain": "other.com", "days": 730, "provider": "Google Analytics",
- "category": "analytics", "purpose": "Distinguishes users",
- "thirdParty": true }
- ]
- }
Response fields
| Field | Type | Description |
|---|---|---|
classified | boolean | Whether the pattern catalogue was available. false means the cookies are listed but unclassified. |
thirdPartyCount | integer | Cookies whose domain is outside the page's apex domain. |
insecureCount | integer | Cookies set without the Secure attribute. |
cookies[].days | number | null | Retention in days. null means a session cookie. |
cookies[].provider / category / purpose | string | null | Matched from the catalogue. null when the cookie is unrecognised or the catalogue is unavailable. |
Errors
| Status | When |
|---|---|
401 | Missing or invalid API key. |
403 | The URL is a private, loopback or cloud-metadata address and was blocked by SSRF protection. |
429 | Burst rate limit (60 req/10s per IP, 30 req/10s per key) or your daily quota. See Rate limits. |
502 | The target URL could not be fetched. |
503 | The cookie catalogue module is unavailable on this server. This check runs before authentication. |
Errors return { "error": "…" }; see Errors.