---
title: "Record Consent"
method: POST
path: "/api/consent"
tags: ["consent"]
---

# Record Consent

`POST /api/consent`

## Request

- Base URL: `https://api.getcheapgames.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.getcheapgames.com/api/consent`
- Auth: none declared

Keep one cookie decision. 204 and nothing else: the site does not wait.

The body is parsed by hand rather than as a typed parameter so it is read
whatever content type it comes with — a keepalive `fetch` sends JSON, and
`navigator.sendBeacon` with a string sends `text/plain` — and so its size
is capped before it is parsed.

Refused with 403 when the browser says the call came from another site
(`Sec-Fetch-Site`): a page elsewhere must not be able to write consent
records through its visitors' browsers. Older browsers send no such header
and are let through; the most a forger gets is a row that names a random
id nobody holds, and no visitor's own answer (in their browser) changes.

## Response `204`

Successful Response

---

[API](https://skmtc.dev/getcheapgames/apis/getcheapgames-api.md) · [All operations](https://skmtc.dev/getcheapgames/apis/getcheapgames-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getcheapgames/apis/getcheapgames-api/revisions/57333a690301?raw)