Check Clickwrap Status

Endpoint

POST /v2/server/clickwrap/{slug}/status

Authentication

This endpoint requires an OAuth access token. Send it as a bearer token:

Authorization: Bearer your_access_token

Required scope: clickwrap:read

Clickwrap is the one /v2 surface with no acting user. The subject of a clickwrap event is user_identifier, an opaque string you supply for your own end user, which is never resolved against Chamelio’s users. These endpoints are authorized by organization and scope alone, so client_credentials tokens work here without restriction.

Path Parameters

Parameter	Type	Required	Description
`slug`	string	Yes	Unique identifier for the clickwrap

Request Body

Field	Type	Required	Description
`user_identifier`	string	Yes	The identifier used when capturing the user’s acceptance (e.g. email, user ID)

Request Example

curl -X POST "https://platform.chamelio.ai/v2/server/clickwrap/privacy-policy/status" \
  -H "Authorization: Bearer your_access_token" \
  -H "Content-Type: application/json" \
  -d '{"user_identifier": "user@example.com"}'

import requests

slug = "privacy-policy"

url = f"https://platform.chamelio.ai/v2/server/clickwrap/{slug}/status"
headers = {
    "Authorization": "Bearer your_access_token",
    "Content-Type": "application/json"
}
body = {
    "user_identifier": "user@example.com"
}

response = requests.post(url, headers=headers, json=body)
print(response.json())

const slug = "privacy-policy";

const response = await fetch(
  `https://platform.chamelio.ai/v2/server/clickwrap/${slug}/status`,
  {
    method: 'POST',
    headers: {
      'Authorization': 'Bearer your_access_token',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      user_identifier: 'user@example.com'
    })
  }
);

const data = await response.json();
console.log(data);

Response

Success Response

Status Code: 200 OK

{
  "accepted": true,
  "clickwrap_version_id": 42,
  "version_number": 3
}

Response Fields

Field	Type	Description
`accepted`	boolean	Whether the user has accepted the current active version
`clickwrap_version_id`	integer	Internal identifier of the active version checked against
`version_number`	integer	Sequential version number of the active version

Error Responses

401 Unauthorized

Returned when the access token is missing, unknown, revoked, or expired, or when an X-API-Key was sent instead of a bearer token. See OAuth error responses.

{
  "detail": "Invalid access token"
}

403 Forbidden

Returned when the token does not carry the required scope.

{
  "detail": "Insufficient scope; this endpoint requires: clickwrap:read"
}

404 Not Found

Returned when no active clickwrap exists for the given slug.

{
  "detail": "Not found"
}

422 Unprocessable Entity

Returned when the request body fails validation, for example a missing user_identifier.

{
  "detail": [
    {
      "loc": ["body", "user_identifier"],
      "msg": "Field required",
      "type": "missing"
    }
  ]
}

429 Too Many Requests

Returned when your organization exceeds its per-minute request limit.

{
  "detail": "Rate limit exceeded"
}

500 Internal Server Error

Returned when the request fails due to a server error.

{
  "detail": "Failed to check clickwrap status"
}

Notes

accepted: true means the user has accepted the currently active version specifically. If the clickwrap was updated since the user last accepted, accepted will be false even though the user accepted a previous version.

The result is organization-global. Every token issued for the same organization gets the same answer - the token’s user is used only to authenticate and scope-check the request.

Use the version_number in the response to detect when a user accepted an older version and needs to re-accept the latest terms.

Use Cases

This endpoint is useful for:

Access gating - Block a user from proceeding until they have accepted the current terms
Re-consent checks - Determine on login or feature access whether the user’s acceptance is still current
Audit queries - Programmatically verify acceptance status before performing a regulated action

Overview

API Key Access

OAuth App Access

Webhooks

Endpoint

Authentication

Path Parameters

Request Body

Request Example

Response

Success Response

Response Fields

Error Responses

401 Unauthorized

403 Forbidden

404 Not Found

422 Unprocessable Entity

429 Too Many Requests

500 Internal Server Error

Notes

Use Cases

​Endpoint

​Authentication

​Path Parameters

​Request Body

​Request Example

​Response

​Success Response

​Response Fields

​Error Responses

​401 Unauthorized

​403 Forbidden

​404 Not Found

​422 Unprocessable Entity

​429 Too Many Requests

​500 Internal Server Error

​Notes

​Use Cases

Endpoint

Authentication

Path Parameters

Request Body

Request Example

Response

Success Response

Response Fields

Error Responses

401 Unauthorized

403 Forbidden

404 Not Found

422 Unprocessable Entity

429 Too Many Requests

500 Internal Server Error

Notes

Use Cases