---
title: "Update Cookie Consent Settings"
method: PATCH
path: "/v1/settings/cookie-consent"
tags: ["Settings", "v1"]
---

# Update Cookie Consent Settings

`PATCH /v1/settings/cookie-consent`

Toggles cookie consent management for the account. When enabled, the Leadfeeder tracker does not set its cookie on page load until the visitor grants consent. Integration cookies cannot be modified through the API.

**Side effect:** if `consent_management_enabled` is set to `true` and the Leadfeeder Analytics cookie (`lfa_cookie_enabled`) is currently `false`, enabling consent management will also activate the Leadfeeder cookie automatically.

:::info
Requires the `accounts:write` OAuth2 scope.
:::

## Query parameters

- `account_id` string, required

## Request body

- object
  - `data` object, required
    - `type` 'cookie_consent_settings', required
    - `attributes` object, required
      - `consent_management_enabled` boolean, required — `true` to enable consent-gated cookie placement; `false` to set the cookie immediately on page load.

## Response `200`

Cookie consent settings

- object
  - `data` CookieConsentSettingsV1, required
    - `type` 'cookie_consent_settings', required
    - `id` string, required — The account ID these settings belong to.
    - `attributes` object, required
      - `consent_management_enabled` boolean, required — When `true`, the Leadfeeder tracker does not set its cookie on page load until the visitor grants consent. Enable this when the account uses a cookie consent banner.
  - `meta` object, required
    - `request_id` string, required — A unique identifier assigned to each API request for end-to-end traceability.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized. The request was rejected because the credentials are missing, invalid, expired, or have been revoked. The client must re-authenticate before retrying. Clients can differentiate via the `code` value of the first item in `errors`.
- `403` — Forbidden. The credentials are valid but the caller is not authorized to perform the request — typically because the user lacks the required permission, the OAuth scope is insufficient, the subscription plan does not include the required entitlement, the `account_id` does not belong to the authenticated user, or the target list is read-only and its members cannot be modified. Clients can differentiate via the `code` value of the first item in `errors`.
- `404` — Not found
- `422` — Unprocessable entity
- `429` — Too many requests. Either the per-second rate limit or the monthly quota configured for the API key / OAuth application has been exceeded. Clients can differentiate via the `code` value of the first item in `errors`.
- `500` — Internal server error
- `504` — Server timeout

## Changes

> 18 revisions in range; 1 not diffed.

- **2026-09-01** `885dcce2a6c2` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/leadfeeder/apis/leadfeeder-public-api/changes/v1/settings/cookie-consent/patch.md)

---

[API](https://skmtc.dev/leadfeeder/apis/leadfeeder-public-api.md) · [All operations](https://skmtc.dev/leadfeeder/apis/leadfeeder-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/leadfeeder/leadfeeder-public-api/revisions/7a571092a308/schema)