---
title: "Replace selected IAB vendors"
method: PUT
path: "/v1/projects/{projectId}/consent/configuration/iab"
tags: ["Consent"]
---

# Replace selected IAB vendors

`PUT /v1/projects/{projectId}/consent/configuration/iab`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/projects/{projectId}/consent/configuration/iab`
- Auth: HTTP bearer

vendorIds replaces the selected vendor list. Omitted additionalConsentProviders retains its stored value. An empty array clears the corresponding list. Shared plan and vendor validation still apply. Requires consent.write, projects.read and projects.write, with an admin or owner role. New public writes require rollout-agent-access-writes, default false. Organization API keys cannot call this operation.

## Path parameters

- `projectId` string, required

## Request body

- ProjectConsentIabUpdate
  - `vendorIds` integer[], required
  - `additionalConsentProviders` integer[]

## Response `200`

Success

- object
  - `success` unknown, required
  - `data` ConsentSettings, required
    - `trustedOrigins` string[], required: Deprecated: read the project's `websites`. These are the Consent entries alone; the runtime allows every website, including addresses only an audit uses.
    - `branding` 'inth' | 'c15t' | 'none', required: Branding shown in the consent banner. Removing branding with 'none' requires an eligible paid plan.
    - `backendUrl` string, uri, nullable, required: The consent runtime URL your site points the c15t client at.
    - `dashboardUrl` string, uri, required
    - `version` string, required: Consent runtime version.

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `409`: The request conflicts with the current resource state.
- `503`: The capability is temporarily paused by an operator. Retry later.

## Changes

- **2026-10-31** `a3f4100e14c9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/projects/:projectId/consent/configuration/iab/put.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/5a1be8d43402?raw)