Public Marketing Signup
Record email or SMS opt-ins from a website without a customer login.
POST https://edge.tiquo.app/api/client/v1/marketing/subscribeThis endpoint needs an enabled Website SDK integration, its public key, and an allowed browser Origin. It does not require a bearer token, email code, or completed customer profile.
Request
Supply the public key as X-Public-Key or publicKey in the JSON body. A browser supplies its own Origin header; add the website to the integration's allowed domains in Tiquo.
curl 'https://edge.tiquo.app/api/client/v1/marketing/subscribe' -H 'Content-Type: application/json' -H 'Origin: https://www.example.com' -H 'X-Public-Key: YOUR_PUBLIC_KEY' -d '{"email":"alex@example.com","emailOptIn":true}'| Field | Requirement |
|---|---|
email | Required email address, up to 254 characters |
emailOptIn | Optional boolean for email consent |
smsOptIn | Optional boolean for messaging consent |
firstName, lastName | Optional, up to 100 characters each; used for new profiles |
phone | Optional, up to 64 characters; E.164 or national format with phoneCountry; used for new profiles |
phoneCountry | Optional two-letter ISO country code |
honeypot | Optional hidden field, up to 500 characters; real visitors leave it empty |
publicKey | Up to 256 characters when supplied in the body |
Only an explicit true applies an opt-in. A false or omitted value does not unsubscribe an existing customer. SMS consent can be recorded without a phone, but message delivery still needs an eligible destination.
An existing customer's other details remain unchanged. A new signup can create a customer profile, but it creates no enquiry and does not recreate a deleted profile.
Response and limits
An accepted request returns { "success": true } without customer data or a customer ID. The same generic response can be returned for screened spam without profile changes. Do not use it to confirm that an address exists or belongs to the visitor. The public key and Origin checks do not verify identity.
The body limit is 8 KiB. Per organisation, the ten-minute rate limits are 60 requests in total, 20 per IP, and five per normalised email or submitted phone. A 429 response includes Retry-After; wait before retrying.
| Status | Meaning |
|---|---|
400 | Invalid input or missing public key |
403 | Invalid Origin, public key, or disabled integration |
413 | Body exceeds 8 KiB |
429 | Rate limit reached |
500 | Signup temporarily unavailable |
For editing an authenticated customer's existing preferences, use PATCH /profile. See DOM Package signup and Hosted Package signup for browser helpers and form examples.