> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vellaro.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Active Integrations

> Public: browser-safe view of the tenant's enabled integrations.

The storefront's `<IntegrationsBootstrap />` hits this endpoint once
on the first paint to know which third-party scripts to load
(Iubenda CMP, GTM, Sentry, …). The Consent Mode v2 dance then runs
on top of the returned config.

Security:
  - Only `is_active=true` rows are returned.
  - Secret fields (CAPI tokens, MP API secrets, Sentry auth tokens)
    are stripped here — the public payload is safe to embed in the
    HTML of an unauthenticated page.
  - The endpoint is **public-no-auth** but tenant-scoped: the
    middleware resolves the tenant from Host header / X-Tenant-Slug,
    same as `/tenant/brand`.

Cache hint: the storefront can cache this for ~5 minutes; a longer
TTL would delay the operator's "I just disabled Pixel" intent.



## OpenAPI

````yaml https://api.vellaro.io/openapi.json get /api/v1/tenant/integrations/active
openapi: 3.1.0
info:
  title: Vellaro API
  description: Vellaro 2026 — E-commerce API
  version: 0.1.0
servers:
  - url: https://api.vellaro.io
    description: Produzione
security: []
tags: []
paths:
  /api/v1/tenant/integrations/active:
    get:
      tags:
        - tenant
      summary: Get Active Integrations
      description: |-
        Public: browser-safe view of the tenant's enabled integrations.

        The storefront's `<IntegrationsBootstrap />` hits this endpoint once
        on the first paint to know which third-party scripts to load
        (Iubenda CMP, GTM, Sentry, …). The Consent Mode v2 dance then runs
        on top of the returned config.

        Security:
          - Only `is_active=true` rows are returned.
          - Secret fields (CAPI tokens, MP API secrets, Sentry auth tokens)
            are stripped here — the public payload is safe to embed in the
            HTML of an unauthenticated page.
          - The endpoint is **public-no-auth** but tenant-scoped: the
            middleware resolves the tenant from Host header / X-Tenant-Slug,
            same as `/tenant/brand`.

        Cache hint: the storefront can cache this for ~5 minutes; a longer
        TTL would delay the operator's "I just disabled Pixel" intent.
      operationId: get_active_integrations_api_v1_tenant_integrations_active_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiResponse_dict_'
components:
  schemas:
    ApiResponse_dict_:
      properties:
        data:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Data
        meta:
          anyOf:
            - $ref: '#/components/schemas/PaginationMeta'
            - type: 'null'
        error:
          anyOf:
            - type: string
            - type: 'null'
          title: Error
        error_code:
          anyOf:
            - type: string
            - type: 'null'
          title: Error Code
      type: object
      title: ApiResponse[dict]
    PaginationMeta:
      properties:
        page:
          type: integer
          title: Page
        page_size:
          type: integer
          title: Page Size
        total:
          type: integer
          title: Total
        total_pages:
          type: integer
          title: Total Pages
      type: object
      required:
        - page
        - page_size
        - total
        - total_pages
      title: PaginationMeta

````