> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chamelio.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Check Clickwrap Status

> Check whether an end user has accepted the active version of a clickwrap

## Endpoint

```
POST /v2/server/clickwrap/{slug}/status
```

## Authentication

This endpoint requires an OAuth access token. Send it as a bearer token:

```bash theme={null}
Authorization: Bearer your_access_token
```

**Required scope:** `clickwrap:read`

<Info>
  Clickwrap is the one `/v2` surface with no acting user. The subject of a clickwrap event is
  `user_identifier`, an opaque string you supply for your own end user, which is never resolved
  against Chamelio's users. These endpoints are authorized by organization and scope alone, so
  `client_credentials` tokens work here without restriction.
</Info>

## Path Parameters

| Parameter | Type   | Required | Description                         |
| --------- | ------ | -------- | ----------------------------------- |
| `slug`    | string | Yes      | Unique identifier for the clickwrap |

## Request Body

| Field             | Type   | Required | Description                                                                    |
| ----------------- | ------ | -------- | ------------------------------------------------------------------------------ |
| `user_identifier` | string | Yes      | The identifier used when capturing the user's acceptance (e.g. email, user ID) |

## Request Example

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST "https://platform.chamelio.ai/v2/server/clickwrap/privacy-policy/status" \
    -H "Authorization: Bearer your_access_token" \
    -H "Content-Type: application/json" \
    -d '{"user_identifier": "user@example.com"}'
  ```

  ```python Python theme={null}
  import requests

  slug = "privacy-policy"

  url = f"https://platform.chamelio.ai/v2/server/clickwrap/{slug}/status"
  headers = {
      "Authorization": "Bearer your_access_token",
      "Content-Type": "application/json"
  }
  body = {
      "user_identifier": "user@example.com"
  }

  response = requests.post(url, headers=headers, json=body)
  print(response.json())
  ```

  ```javascript JavaScript theme={null}
  const slug = "privacy-policy";

  const response = await fetch(
    `https://platform.chamelio.ai/v2/server/clickwrap/${slug}/status`,
    {
      method: 'POST',
      headers: {
        'Authorization': 'Bearer your_access_token',
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        user_identifier: 'user@example.com'
      })
    }
  );

  const data = await response.json();
  console.log(data);
  ```
</CodeGroup>

## Response

### Success Response

**Status Code:** `200 OK`

```json theme={null}
{
  "accepted": true,
  "clickwrap_version_id": 42,
  "version_number": 3
}
```

### Response Fields

| Field                  | Type    | Description                                                  |
| ---------------------- | ------- | ------------------------------------------------------------ |
| `accepted`             | boolean | Whether the user has accepted the **current active** version |
| `clickwrap_version_id` | integer | Internal identifier of the active version checked against    |
| `version_number`       | integer | Sequential version number of the active version              |

## Error Responses

### 401 Unauthorized

Returned when the access token is missing, unknown, revoked, or expired, or when an `X-API-Key` was
sent instead of a bearer token. See [OAuth error responses](/api-reference/oauth-apps#error-responses).

```json theme={null}
{
  "detail": "Invalid access token"
}
```

### 403 Forbidden

Returned when the token does not carry the required scope.

```json theme={null}
{
  "detail": "Insufficient scope; this endpoint requires: clickwrap:read"
}
```

### 404 Not Found

Returned when no active clickwrap exists for the given slug.

```json theme={null}
{
  "detail": "Not found"
}
```

### 422 Unprocessable Entity

Returned when the request body fails validation, for example a missing `user_identifier`.

```json theme={null}
{
  "detail": [
    {
      "loc": ["body", "user_identifier"],
      "msg": "Field required",
      "type": "missing"
    }
  ]
}
```

### 429 Too Many Requests

Returned when your organization exceeds its per-minute request limit.

```json theme={null}
{
  "detail": "Rate limit exceeded"
}
```

### 500 Internal Server Error

Returned when the request fails due to a server error.

```json theme={null}
{
  "detail": "Failed to check clickwrap status"
}
```

## Notes

<Info>
  `accepted: true` means the user has accepted the **currently active** version specifically. If the clickwrap was updated since the user last accepted, `accepted` will be `false` even though the user accepted a previous version.
</Info>

<Info>
  The result is organization-global. Every token issued for the same organization gets the same
  answer - the token's user is used only to authenticate and scope-check the request.
</Info>

<Tip>
  Use the `version_number` in the response to detect when a user accepted an older version and needs to re-accept the latest terms.
</Tip>

## Use Cases

This endpoint is useful for:

* **Access gating** - Block a user from proceeding until they have accepted the current terms
* **Re-consent checks** - Determine on login or feature access whether the user's acceptance is still current
* **Audit queries** - Programmatically verify acceptance status before performing a regulated action