Introduction

One API. Any device. Total control.

The Server-Side CMP API is OneTrust's headless consent engine — a single, central API that computes every CMP function (banner logic, preference center state, vendor lists, consent logging) on the server and hands back a clean response for your app to render however you want.

There's no client SDK to install, version, or wait on. No bundled UI to work around. Your team owns the entire presentation layer — layout, styling, animation, interaction model, accessibility treatment — while OneTrust handles the compliance logic, geolocation rules, and consent state underneath it.

This "bring your own UI" model is exactly why teams reach for the CMP API when the platform they're building for doesn't fit a conventional SDK pattern.

Built for places SDKs can't go

Traditional CMP SDKs assume a fairly conventional runtime: a mobile OS or a browser with predictable rendering and enough headroom to bundle a UI framework. A lot of real-world devices don't look like that. The CMP API was built to handle exactly this class of problem, and it's already powering consent experiences on:

• Video game consoles and titles — where consent has to render inside a game engine's own UI system, at 60fps, without breaking immersion or pulling in a foreign rendering stack.
• In-car infotainment (CarPlay and beyond) — tightly locked-down environments with strict UI guidelines and no room for a general-purpose SDK.
• Smart appliances and connected-home devices — think smart fridges and other constrained IoT hardware, where memory, CPU, and screen real estate are all in short supply.
• Connected TV and other low-power platforms — the original driver for moving CMP computation server-side, so low-end hardware isn't stuck doing consent logic it doesn't have the resources for.

If your platform doesn't have a OneTrust SDK — or the one that exists doesn't fit your constraints — the API is the way in. Wherever your users are, the consent logic behind them is the same.

Why teams pick the API over an SDK

Total UI control. You're not customizing a template or working within an SDK's theming options — you're building the interface from scratch, in whatever framework or engine your platform already uses. Every pixel, transition, and interaction is yours to design.

No SDK release cycle. There's no client library to bump, no waiting on a new SDK version to unblock a feature or fix a bug in someone else's UI code. You call an API, you get a response, you render it. Updates to your experience ship on your schedule, not a vendor's.

Built for scale. Because the heavy lifting happens server-side, low-power and resource-constrained devices aren't computing consent logic locally. The same API contract serves a game console, a car dashboard, and a kitchen appliance without asking any of them to do more than they're capable of.

One integration pattern, many platforms. Learn the API once and you can bring consent to essentially any device that can make an HTTP call — including the ones that don't have a name-brand SDK yet.

How it works

CMP functions are computed server-side; your app calls the API, gets back the data it needs, and renders its own banner, preference center, and vendor list UI. The underlying consent logic — geolocation rules, regulatory frameworks, vendor consent — is identical to what powers OneTrust's SDKs; only the rendering responsibility moves to you.

The following technical guides walk through implementation end to end.

1. Persisting Consent
2. Get Banner UI
3. Get Preference Center UI
4. Get Vendor List UI
5. Save and Log Consent
6. Implementation Guidance

UI Assist App

Building a UI from raw API responses is easier with a reference. The UI Assist Application shows exactly where each element in an API response maps to a piece of UI, so you can see the shape of the data before you commit to a design.

This tool is a reference aid, not a production client — it doesn't persist consent or generate consent strings on its own.

How to use the application

macOS (Intel and Apple Silicon)

1. Download the application.
2. Run the application.

Windows OS

1. Download the application.
2. Run the application.

Linux OS

1. Download the application.
2. Run the application.

Configuring the application

Load your own configuration to see your actual branding and copy: open Settings and add your Application ID to the OT-App-Id header.

To view location specific configurations, set OT-Country-Code and/or OT-Region-Code.

Turn on UI Assist in Settings to see the element mapping, and switch between CTV and Mobile experiences from the same panel.

Note: the Preference Center UI is only reachable through the Banner UI. If your geolocation rule has Show Banner disabled, nothing will render. In this case, add OT-Force-Fetch: true in Settings to force the banner to appear, then navigate to the Preference Center from there.