Troubleshooting

Common errors, what they mean, and how to resolve them.

A publishable key returns 403 "no Origin allowlist"

pk_ keys must be Origin-restricted. Add allowed domains to the key, or verify at least one domain on the site (Sites & API keys → + domain).

POST /v1/consent returns 422 "purpose has no published version"

Create the purpose, add at least one locale of text on its draft, and publish that version. Consent is only recorded against published versions.

The same Idempotency-Key returns 409

You reused the key with a different body. A retry must send byte-identical JSON. Keys are scoped per (site, environment).

A subject read created a blank subject

Read endpoints return 404 on unknown identifiers; only writes create. If a read created one, you were hitting a write path — check the method.

After erasure the subject is still in the vault

By design: crypto-shredding destroys the identifiers’ key material (the subject is unfindable), but the anonymized event log is kept for legal defensibility.

Webhook deliveries are failing

Check the endpoint’s delivery log. Failures retry with exponential backoff up to 8 attempts; you can replay any delivery from the console. Make sure your endpoint responds 2xx within 10 s.

I suspect an API key has leaked

Revoke it in Sites & API keys and check the org Audit log and the vault timeline for writes attributed to that apiKeyId. Create a replacement key (or rotate — the new one is valid and the old one stays until you revoke it).