API
Portal sessions
Open Manage my data for a person who is already signed in to your app.
POST /api/v1/portal-sessions
Opens Manage my data (the Trust Center's preferences page) for a person who is already signed in to your app, without an emailed code. Your login has proved who they are. It needs a key with Read and record consent (consent:write). Your backend calls it. The app never holds the key.
curl -s -X POST "https://v1.pactbase.in/api/v1/portal-sessions" \
-H "Authorization: Bearer $PACTBASE_API_KEY" -H "Content-Type: application/json" \
-d '{ "email": "asha@example.in" }'| Field | |
|---|---|
email | Required. The signed-in person's email, as your login verified it. Trimmed and lower-cased |
Answer 201:
{ "url": "https://v1.pactbase.in/portal/acme/preferences#s=Xk2...", "expires_at": "2026-10-20T10:40:00.000Z" }Open url at once in a browser tab, an in-app browser or a web view. The page shows the person's choices, already verified, for 30 minutes. Every change is recorded as source: preference_center, exactly as after an emailed code, including webhooks and receipts.
- One use, 10 minutes. Ask for a new link each time the person taps. Never store, email or log it. A used or expired link shows a message and offers the emailed code instead.
- The secret is after
#, so it never reaches a server log. The page removes it from the address bar as it opens. - Errors.
409 TRUST_CENTER_OFF(Manage my data or the Trust Center is switched off), and the usual key errors in Errors.