> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pcnaid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ConsentAI API overview

> Externally reachable surfaces — signed App Proxy endpoints, embedded admin routes, public policy pages, and webhook topics.

# ConsentAI API overview

## App Proxy endpoints (public, signed)

Storefront traffic uses Shopify's signed App Proxy at the prefix `/apps/pcnaid-tnc`. The server verifies the HMAC signature and 10-minute replay window.

| Method | Path | Purpose |
| - | - | - |
| GET | `/apps/pcnaid-tnc/settings` | Return entitlement-gated storefront settings. |
| POST | `/apps/pcnaid-tnc/consent` | Rate-limited consent evidence write. |

There are no public unsigned `/api/settings` or `/api/consent` endpoints.

### Example: read settings

```bash theme={null}
curl --fail-with-body "${STORE_ORIGIN:?Set STORE_ORIGIN}/apps/pcnaid-tnc/settings"
```

Set `STORE_ORIGIN` to the store's HTTPS storefront origin without a trailing slash. Shopify supplies the HMAC signature automatically on the forwarded proxy request.

## Embedded admin routes (Shopify Admin authentication)

All admin routes require an authenticated Shopify session with the account-owner guard. Plan-gated endpoints enforce their required plan server-side and with visible badges in the UI.

| Method | Path | Purpose |
| - | - | - |
| GET | `/app` | Embedded settings UI with plan-aware controls, theme-embed status, consent evidence, customer data requests. |
| GET | `/app/billing` | Current subscription and in-app plan cards with monthly/annual toggle. |
| POST | `/app/billing/select` | Request or cancel a plan via `billing.request()` / `billing.cancel()`. |
| GET | `/app/billing/confirmed` | Re-sync subscription after Shopify's one-time confirmation. |
| GET | `/app/support` | Authenticated support page. |
| GET | `/app/exports/consents.csv` | Advanced-plan consent log CSV export with integrity verification. |
| GET | `/app/compliance/data-request/:requestId` | Download a non-expired customer data-request snapshot. |
| GET | `/app/dashboard` | Dashboard data endpoint (consumed by the settings page fetcher). |

## Public routes

| Method | Path | Purpose |
| - | - | - |
| GET | `/privacy` | 301 redirect to the hosted Privacy Policy. |
| GET | `/terms` | 301 redirect to the hosted Terms of Service. |
| GET | `/support` | Public support page. |

## Webhook endpoints (Shopify signed)

Webhooks require HMAC signature verification. The three compliance webhooks (`customers/data_request`, `customers/redact`, `shop/redact`) share a common handler and are processed one at a time per shop.

| Topic | Path | Action |
| - | - | - |
| `app/uninstalled` | `/webhooks/app/uninstalled` | Clear sessions, mark shop uninstalled. |
| `app/scopes_update` | `/webhooks/app/scopes_update` | Update stored scope set. |
| `app_subscriptions/update` | `/webhooks/app_subscriptions_update` | Reconcile Billing API plan and status. |
| `shop/update` | `/webhooks/shop/update` | Follow `.myshopify.com` rename by Shop GID. |
| `orders/create` | `/webhooks/orders/create` | Link matching cart consent to the Shopify order with sealed binding. |
| `customers/data_request` | `/webhooks/customers_data_request` | Retain matching consent evidence in a 30-day authenticated snapshot. |
| `customers/redact` | `/webhooks/customers_redact` | Redact customer personal fields, delete bindings, write tombstones. |
| `shop/redact` | `/webhooks/shop_redact` | Delete all shop evidence and configuration, retain minimal redaction receipt. |

## Consent CSV export

The Advanced-plan CSV export provides one row per recorded consent event. Each row includes the consent text and policy link shown at the time of agreement, a timestamp, the shop domain, the storefront page and cart/session context, and, when an order was later linked, the matching order details. Every export is integrity-checked — if any stored evidence fails verification, the export refuses to produce output.

## See also

* [Architecture overview](https://docs.pcnaid.com/nodes/shopify/consentai/developer/architecture-overview.md)
* [Quickstart](https://docs.pcnaid.com/nodes/shopify/consentai/developer/quickstart.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.