prebid.js 6.26.0 → 6.27.0

package/modules/akamaiDapRtdProvider.js

@@ -10,12 +10,22 @@ import {config} from '../src/config.js';
 import {getStorageManager} from '../src/storageManager.js';
 import {submodule} from '../src/hook.js';
 import {isPlainObject, mergeDeep, logMessage, logInfo, logError} from '../src/utils.js';
+import { loadExternalScript } from '../src/adloader.js';
 
 const MODULE_NAME = 'realTimeData';
 const SUBMODULE_NAME = 'dap';
+const MODULE_CODE = 'akamaidap';
+
+export const DAP_TOKEN = 'async_dap_token';
+export const DAP_MEMBERSHIP = 'async_dap_membership';
+export const DAP_ENCRYPTED_MEMBERSHIP = 'encrypted_dap_membership';
+export const DAP_SS_ID = 'dap_ss_id';
+export const DAP_DEFAULT_TOKEN_TTL = 3600; // in seconds
+export const DAP_MAX_RETRY_TOKENIZE = 1;
+export const DAP_CLIENT_ENTROPY = 'dap_client_entropy'
 
-export const SEGMENTS_STORAGE_KEY = 'akamaiDapSegments';
 export const storage = getStorageManager({gvlid: null, moduleName: SUBMODULE_NAME});
+let dapRetryTokenize = 0;
 
 /**
  * Lazy merge objects.
@@ -53,60 +63,92 @@ export function addRealTimeData(rtd) {
  * Real-time data retrieval from Audigent
  * @param {Object} reqBidsConfigObj
  * @param {function} onDone
- * @param {Object} rtdConfi
+ * @param {Object} rtdConfig
  * @param {Object} userConsent
  */
 export function getRealTimeData(bidConfig, onDone, rtdConfig, userConsent) {
-  logInfo('DEBUG(getRealTimeData) - ENTER');
+  let entropyDict = JSON.parse(storage.getDataFromLocalStorage(DAP_CLIENT_ENTROPY));
+  let loadScriptPromise = new Promise((resolve, reject) => {
+    if (rtdConfig && rtdConfig.params && rtdConfig.params.dapFpTimeout && Number.isInteger(rtdConfig.params.dapFpTimeout)) {
+      setTimeout(reject, rtdConfig.params.dapFpTimeout, Error('DapFP script could not be loaded'));
+    }
+    if (entropyDict && entropyDict.expires_at > Math.round(Date.now() / 1000.0)) {
+      logMessage('Using cached entropy');
+      resolve();
+    } else {
+      if (typeof window.dapCalculateEntropy === 'function') {
+        window.dapCalculateEntropy(resolve, reject);
+      } else {
+        if (rtdConfig && rtdConfig.params && dapUtils.isValidHttpsUrl(rtdConfig.params.dapFpUrl)) {
+          loadExternalScript(rtdConfig.params.dapFpUrl, MODULE_CODE, () => { dapUtils.dapGetEntropy(resolve, reject) });
+        } else {
+          reject(Error('Please check if dapFpUrl is specified and is valid under config.params'));
+        }
+      }
+    }
+  });
+  loadScriptPromise
+    .catch((error) => {
+      logError('Entropy could not be calculated due to: ', error.message);
+    })
+    .finally(() => {
+      generateRealTimeData(bidConfig, onDone, rtdConfig, userConsent);
+    });
+}
+
+export function generateRealTimeData(bidConfig, onDone, rtdConfig, userConsent) {
+  logInfo('DEBUG(generateRealTimeData) - ENTER');
   logMessage('  - apiHostname: ' + rtdConfig.params.apiHostname);
   logMessage('  - apiVersion:  ' + rtdConfig.params.apiVersion);
-  let jsonData = storage.getDataFromLocalStorage(SEGMENTS_STORAGE_KEY);
+  dapRetryTokenize = 0;
+  var jsonData = null;
+  if (rtdConfig && isPlainObject(rtdConfig.params)) {
+    if (rtdConfig.params.segtax == 504) {
+      let encMembership = dapUtils.dapGetEncryptedMembershipFromLocalStorage();
+      if (encMembership) {
+        jsonData = dapUtils.dapGetEncryptedRtdObj(encMembership, rtdConfig.params.segtax)
+      }
+    } else {
+      let membership = dapUtils.dapGetMembershipFromLocalStorage();
+      if (membership) {
+        jsonData = dapUtils.dapGetRtdObj(membership, rtdConfig.params.segtax)
+      }
+    }
+  }
   if (jsonData) {
-    let data = JSON.parse(jsonData);
-    if (data.rtd) {
-      addRealTimeData(data.rtd);
+    if (jsonData.rtd) {
+      addRealTimeData(jsonData.rtd);
       onDone();
-      logInfo('DEBUG(getRealTimeData) - 1');
+      logInfo('DEBUG(generateRealTimeData) - 1');
       // Don't return - ensure the data is always fresh.
     }
   }
+  // Calling setTimeout to release the main thread so that the bid request could be sent.
+  setTimeout(callDapAPIs, 0, bidConfig, onDone, rtdConfig, userConsent);
+}
 
+function callDapAPIs(bidConfig, onDone, rtdConfig, userConsent) {
   if (rtdConfig && isPlainObject(rtdConfig.params)) {
     let config = {
       api_hostname: rtdConfig.params.apiHostname,
       api_version: rtdConfig.params.apiVersion,
       domain: rtdConfig.params.domain,
-      segtax: rtdConfig.params.segtax
-    };
-    let identity = {
-      type: rtdConfig.params.identityType
+      segtax: rtdConfig.params.segtax,
+      identity: {type: rtdConfig.params.identityType}
     };
-    let token = dapUtils.dapGetToken(config, identity, rtdConfig.params.tokenTtl);
-    if (token !== null) {
-      let membership = dapUtils.dapGetMembership(config, token);
-      let udSegment = dapUtils.dapMembershipToRtbSegment(membership, config);
-      logMessage('DEBUG(getRealTimeData) - token: ' + token + ', user.data.segment: ', udSegment);
-      let data = {
-        rtd: {
-          ortb2: {
-            user: {
-              data: [
-                udSegment
-              ]
-            },
-            site: {
-              ext: {
-                data: {
-                  dapSAID: membership.said
-                }
-              }
-            }
-          }
-        }
-      };
-      storage.setDataInLocalStorage(SEGMENTS_STORAGE_KEY, JSON.stringify(data));
-      onDone();
+    let refreshMembership = true;
+    let token = dapUtils.dapGetTokenFromLocalStorage();
+    logMessage('token is: ', token);
+    if (token !== null) { // If token is not null then check the membership in storage and add the RTD object
+      if (config.segtax == 504) { // Follow the encrypted membership path
+        dapUtils.dapRefreshEncryptedMembership(config, token, onDone) // Get the encrypted membership from server
+        refreshMembership = false;
+      } else {
+        dapUtils.dapRefreshMembership(config, token, onDone) // Get the membership from server
+        refreshMembership = false;
+      }
     }
+    dapUtils.dapRefreshToken(config, refreshMembership, onDone) // Refresh Token and membership in all the cases
   }
 }
 
@@ -117,6 +159,9 @@ export function getRealTimeData(bidConfig, onDone, rtdConfig, userConsent) {
  * @return {boolean}
  */
 function init(provider, userConsent) {
+  if (dapUtils.checkConsent(userConsent) === false) {
+    return false;
+  }
   return true;
 }
 
@@ -128,104 +173,190 @@ export const akamaiDapRtdSubmodule = {
 };
 
 submodule(MODULE_NAME, akamaiDapRtdSubmodule);
-
 export const dapUtils = {
+  dapGetEntropy: function(resolve, reject) {
+    if (typeof window.dapCalculateEntropy === 'function') {
+      window.dapCalculateEntropy(resolve, reject);
+    } else {
+      reject(Error('window.dapCalculateEntropy function is not defined'))
+    }
+  },
 
-  dapGetToken: function(config, identity, ttl) {
+  dapGetTokenFromLocalStorage: function(ttl) {
     let now = Math.round(Date.now() / 1000.0); // in seconds
-    let storageName = 'async_dap_token';
     let token = null;
-
-    if (ttl == 0) {
-      localStorage.removeItem(storageName);
+    let item = JSON.parse(storage.getDataFromLocalStorage(DAP_TOKEN));
+    if (item) {
+      if (now < item.expires_at) {
+        token = item.token;
+      }
     }
+    return token;
+  },
 
-    let item = JSON.parse(localStorage.getItem(storageName));
-    if (item == null) {
-      item = {
-        expires_at: now - 1,
-        token: null
-      };
-    } else {
-      token = item.token;
-    }
-
-    if (now > item.expires_at) {
-      dapUtils.dapLog('Token missing or expired, fetching a new one...');
-      // Trigger a refresh
-      let configAsync = {...config};
-      dapUtils.dapTokenize(configAsync, identity,
-        function(token, status, xhr) {
-          item.expires_at = now + ttl;
-          item.token = token;
-          localStorage.setItem(storageName, JSON.stringify(item));
-          dapUtils.dapLog('Successfully updated and stored token; expires in ' + ttl + ' seconds');
-          let deviceId100 = xhr.getResponseHeader('Akamai-DAP-100');
-          if (deviceId100 != null) {
-            localStorage.setItem('dap_deviceId100', deviceId100);
-            dapUtils.dapLog('Successfully stored DAP 100 Device ID: ' + deviceId100);
+  dapRefreshToken: function(config, refreshMembership, onDone) {
+    dapUtils.dapLog('Token missing or expired, fetching a new one...');
+    // Trigger a refresh
+    let now = Math.round(Date.now() / 1000.0); // in seconds
+    let item = {}
+    let configAsync = {...config};
+    dapUtils.dapTokenize(configAsync, config.identity, onDone,
+      function(token, status, xhr, onDone) {
+        item.expires_at = now + DAP_DEFAULT_TOKEN_TTL;
+        let exp = dapUtils.dapExtractExpiryFromToken(token)
+        if (typeof exp == 'number') {
+          item.expires_at = exp - 10;
+        }
+        item.token = token;
+        storage.setDataInLocalStorage(DAP_TOKEN, JSON.stringify(item));
+        dapUtils.dapLog('Successfully updated and stored token; expires at ' + item.expires_at);
+        let dapSSID = xhr.getResponseHeader('Akamai-DAP-SS-ID');
+        if (dapSSID) {
+          storage.setDataInLocalStorage(DAP_SS_ID, JSON.stringify(dapSSID));
+        }
+        let deviceId100 = xhr.getResponseHeader('Akamai-DAP-100');
+        if (deviceId100 != null) {
+          storage.setDataInLocalStorage('dap_deviceId100', deviceId100);
+          dapUtils.dapLog('Successfully stored DAP 100 Device ID: ' + deviceId100);
+        }
+        if (refreshMembership) {
+          if (config.segtax == 504) {
+            dapUtils.dapRefreshEncryptedMembership(config, token, onDone);
+          } else {
+            dapUtils.dapRefreshMembership(config, token, onDone);
           }
-        },
-        function(xhr, status, error) {
-          logError('ERROR(' + error + '): failed to retrieve token! ' + status);
         }
-      );
-    }
-
-    return token;
+      },
+      function(xhr, status, error, onDone) {
+        logError('ERROR(' + error + '): failed to retrieve token! ' + status);
+        onDone()
+      }
+    );
   },
 
-  dapGetMembership: function(config, token) {
+  dapGetMembershipFromLocalStorage: function() {
     let now = Math.round(Date.now() / 1000.0); // in seconds
-    let storageName = 'async_dap_membership';
-    let maxTtl = 3600; // if the cached membership is older than this, return null
     let membership = null;
-    let item = JSON.parse(localStorage.getItem(storageName));
-    if (item == null || (now - item.expires_at) > maxTtl) {
-      item = {
-        expires_at: now - 1,
-        said: null,
-        cohorts: null,
-        attributes: null
-      };
-    } else {
-      membership = {
-        said: item.said,
-        cohorts: item.cohorts,
-        attributes: null
-      };
+    let item = JSON.parse(storage.getDataFromLocalStorage(DAP_MEMBERSHIP));
+    if (item) {
+      if (now < item.expires_at) {
+        membership = {
+          said: item.said,
+          cohorts: item.cohorts,
+          attributes: null
+        };
+      }
     }
+    return membership;
+  },
 
-    // Always refresh the cached membership.
+  dapRefreshMembership: function(config, token, onDone) {
+    let now = Math.round(Date.now() / 1000.0); // in seconds
+    let item = {}
     let configAsync = {...config};
-    dapUtils.dapMembership(configAsync, token,
-      function(membership, status, xhr) {
-        item.expires_at = now + maxTtl;
+    dapUtils.dapMembership(configAsync, token, onDone,
+      function(membership, status, xhr, onDone) {
+        item.expires_at = now + DAP_DEFAULT_TOKEN_TTL;
+        let exp = dapUtils.dapExtractExpiryFromToken(membership.said)
+        if (typeof exp == 'number') {
+          item.expires_at = exp - 10;
+        }
         item.said = membership.said;
         item.cohorts = membership.cohorts;
-        localStorage.setItem(storageName, JSON.stringify(item));
+        storage.setDataInLocalStorage(DAP_MEMBERSHIP, JSON.stringify(item));
         dapUtils.dapLog('Successfully updated and stored membership:');
         dapUtils.dapLog(item);
+
+        let data = dapUtils.dapGetRtdObj(item, config.segtax)
+        dapUtils.checkAndAddRealtimeData(data, config.segtax);
+        onDone();
       },
-      function(xhr, status, error) {
+      function(xhr, status, error, onDone) {
         logError('ERROR(' + error + '): failed to retrieve membership! ' + status);
+        if (status == 403 && dapRetryTokenize < DAP_MAX_RETRY_TOKENIZE) {
+          dapRetryTokenize++;
+          dapUtils.dapRefreshToken(config, true, onDone);
+        } else {
+          onDone();
+        }
       }
     );
+  },
 
-    return membership;
+  dapGetEncryptedMembershipFromLocalStorage: function() {
+    let now = Math.round(Date.now() / 1000.0); // in seconds
+    let encMembership = null;
+    let item = JSON.parse(storage.getDataFromLocalStorage(DAP_ENCRYPTED_MEMBERSHIP));
+    if (item) {
+      if (now < item.expires_at) {
+        encMembership = {
+          encryptedSegments: item.encryptedSegments
+        };
+      }
+    }
+    return encMembership;
+  },
+
+  dapRefreshEncryptedMembership: function(config, token, onDone) {
+    let now = Math.round(Date.now() / 1000.0); // in seconds
+    let item = {};
+    let configAsync = {...config};
+    dapUtils.dapEncryptedMembership(configAsync, token, onDone,
+      function(encToken, status, xhr, onDone) {
+        item.expires_at = now + DAP_DEFAULT_TOKEN_TTL;
+        let exp = dapUtils.dapExtractExpiryFromToken(encToken)
+        if (typeof exp == 'number') {
+          item.expires_at = exp - 10;
+        }
+        item.encryptedSegments = encToken;
+        storage.setDataInLocalStorage(DAP_ENCRYPTED_MEMBERSHIP, JSON.stringify(item));
+        dapUtils.dapLog('Successfully updated and stored encrypted membership:');
+        dapUtils.dapLog(item);
+
+        let encData = dapUtils.dapGetEncryptedRtdObj(item, config.segtax);
+        dapUtils.checkAndAddRealtimeData(encData, config.segtax);
+        onDone();
+      },
+      function(xhr, status, error, onDone) {
+        logError('ERROR(' + error + '): failed to retrieve encrypted membership! ' + status);
+        if (status == 403 && dapRetryTokenize < DAP_MAX_RETRY_TOKENIZE) {
+          dapRetryTokenize++;
+          dapUtils.dapRefreshToken(config, true, onDone);
+        } else {
+          onDone();
+        }
+      }
+    );
+  },
+
+  /**
+   * DESCRIPTION
+   * Extract expiry value from a token
+   */
+  dapExtractExpiryFromToken: function(token) {
+    let exp = null;
+    if (token) {
+      const tokenArray = token.split('..');
+      if (tokenArray && tokenArray.length > 0) {
+        let decode = atob(tokenArray[0])
+        let header = JSON.parse(decode.replace(/&quot;/g, '"'));
+        exp = header.exp;
+      }
+    }
+    return exp
   },
 
   /**
    * DESCRIPTION
    *
    *  Convert a DAP membership response to an OpenRTB2 segment object suitable
-   *  for insertion into user.data.segment or site.data.segment.
+   *  for insertion into user.data.segment or site.data.segment and add it to the rtd obj.
    */
-  dapMembershipToRtbSegment: function(membership, config) {
+  dapGetRtdObj: function(membership, segtax) {
     let segment = {
       name: 'dap.akamai.com',
       ext: {
-        'segtax': config.segtax
+        'segtax': segtax
       },
       segment: []
     };
@@ -234,7 +365,83 @@ export const dapUtils = {
         segment.segment.push({ id: i });
       }
     }
-    return segment;
+    let data = {
+      rtd: {
+        ortb2: {
+          user: {
+            data: [
+              segment
+            ]
+          },
+          site: {
+            ext: {
+              data: {
+                dapSAID: membership.said
+              }
+            }
+          }
+        }
+      }
+    };
+    return data;
+  },
+
+  /**
+   * DESCRIPTION
+   *
+   *  Convert a DAP membership response to an OpenRTB2 segment object suitable
+   *  for insertion into user.data.segment or site.data.segment and add it to the rtd obj.
+   */
+  dapGetEncryptedRtdObj: function(encToken, segtax) {
+    let segment = {
+      name: 'dap.akamai.com',
+      ext: {
+        'segtax': segtax
+      },
+      segment: []
+    };
+    if (encToken != null) {
+      segment.segment.push({ id: encToken.encryptedSegments });
+    }
+    let encData = {
+      rtd: {
+        ortb2: {
+          user: {
+            data: [
+              segment
+            ]
+          }
+        }
+      }
+    };
+    return encData;
+  },
+
+  checkAndAddRealtimeData: function(data, segtax) {
+    if (data.rtd) {
+      if (segtax == 504 && dapUtils.checkIfSegmentsAlreadyExist(data.rtd, 504)) {
+        logMessage('DEBUG(handleInit): rtb Object already added');
+      } else {
+        addRealTimeData(data.rtd);
+      }
+      logInfo('DEBUG(checkAndAddRealtimeData) - 1');
+    }
+  },
+
+  checkIfSegmentsAlreadyExist: function(rtd, segtax) {
+    let segmentsExist = false
+    let ortb2 = config.getConfig('ortb2') || {};
+    if (ortb2.user && ortb2.user.data && ortb2.user.data.length > 0) {
+      for (let i = 0; i < ortb2.user.data.length; i++) {
+        let element = ortb2.user.data[i]
+        if (element.ext && element.ext.segtax == segtax) {
+          segmentsExist = true
+          logMessage('DEBUG(checkIfSegmentsAlreadyExist): rtb Object already added: ', ortb2.user.data);
+          break;
+        }
+      }
+    }
+    return segmentsExist
   },
 
   dapLog: function(args) {
@@ -248,6 +455,35 @@ export const dapUtils = {
     logInfo('%cDAP Client', css, args);
   },
 
+  isValidHttpsUrl: function(urlString) {
+    let url;
+    try {
+      url = new URL(urlString);
+    } catch (_) {
+      return false;
+    }
+    return url.protocol === 'https:';
+  },
+
+  checkConsent: function(userConsent) {
+    let consent = true;
+
+    if (userConsent && userConsent.gdpr && userConsent.gdpr.gdprApplies) {
+      const gdpr = userConsent.gdpr;
+      const hasGdpr = (gdpr && typeof gdpr.gdprApplies === 'boolean' && gdpr.gdprApplies) ? 1 : 0;
+      const gdprConsentString = hasGdpr ? gdpr.consentString : '';
+      if (hasGdpr && (!gdprConsentString || gdprConsentString === '')) {
+        logError('akamaiDapRtd submodule requires consent string to call API');
+        consent = false;
+      }
+    } else if (userConsent && userConsent.usp) {
+      const usp = userConsent.usp;
+      consent = usp[1] !== 'N' && usp[2] !== 'Y';
+    }
+
+    return consent;
+  },
+
   /*******************************************************************************
    *
    * V2 (And Beyond) API
@@ -293,23 +529,23 @@ export const dapUtils = {
    *      function( response, status, xhr } { token = response; },
    *      function( xhr, status, error ) { ; } // handle error
    */
-  dapTokenize: function(config, identity, onSuccess = null, onError = null) {
+  dapTokenize: function(config, identity, onDone, onSuccess = null, onError = null) {
     if (onError == null) {
-      onError = function(xhr, status, error) {};
+      onError = function(xhr, status, error, onDone) {};
     }
 
     if (config == null || typeof (config) == typeof (undefined)) {
-      onError(null, 'Invalid config object', 'ClientError');
+      onError(null, 'Invalid config object', 'ClientError', onDone);
       return;
     }
 
     if (typeof (config.domain) != 'string') {
-      onError(null, 'Invalid config.domain: must be a string', 'ClientError');
+      onError(null, 'Invalid config.domain: must be a string', 'ClientError', onDone);
       return;
     }
 
     if (config.domain.length <= 0) {
-      onError(null, 'Invalid config.domain: must have non-zero length', 'ClientError');
+      onError(null, 'Invalid config.domain: must have non-zero length', 'ClientError', onDone);
       return;
     }
 
@@ -318,22 +554,22 @@ export const dapUtils = {
     }
 
     if (typeof (config.api_version) != 'string') {
-      onError(null, "Invalid api_version: must be a string like 'x1', etc.", 'ClientError');
+      onError(null, "Invalid api_version: must be a string like 'x1', etc.", 'ClientError', onDone);
       return;
     }
 
     if (!(('api_hostname') in config) || typeof (config.api_hostname) != 'string' || config.api_hostname.length == 0) {
-      onError(null, 'Invalid api_hostname: must be a non-empty string', 'ClientError');
+      onError(null, 'Invalid api_hostname: must be a non-empty string', 'ClientError', onDone);
       return;
     }
 
     if (identity == null || typeof (identity) == typeof (undefined)) {
-      onError(null, 'Invalid identity object', 'ClientError');
+      onError(null, 'Invalid identity object', 'ClientError', onDone);
       return;
     }
 
     if (!('type' in identity) || typeof (identity.type) != 'string' || identity.type.length <= 0) {
-      onError(null, "Identity must contain a valid 'type' field", 'ClientError');
+      onError(null, "Identity must contain a valid 'type' field", 'ClientError', onDone);
       return;
     }
 
@@ -348,6 +584,11 @@ export const dapUtils = {
       apiParams.attributes = identity.attributes;
     }
 
+    let entropyDict = JSON.parse(storage.getDataFromLocalStorage(DAP_CLIENT_ENTROPY));
+    if (entropyDict && entropyDict.entropy) {
+      apiParams.entropy = entropyDict.entropy;
+    }
+
     let method;
     let body;
     let path;
@@ -359,10 +600,16 @@ export const dapUtils = {
         body = JSON.stringify(apiParams);
         break;
       default:
-        onError(null, 'Invalid api_version: ' + config.api_version, 'ClientError');
+        onError(null, 'Invalid api_version: ' + config.api_version, 'ClientError', onDone);
         return;
     }
 
+    let customHeaders = {'Content-Type': 'application/json'};
+    let dapSSID = JSON.parse(storage.getDataFromLocalStorage(DAP_SS_ID));
+    if (dapSSID) {
+      customHeaders['Akamai-DAP-SS-ID'] = dapSSID;
+    }
+
     let url = 'https://' + config.api_hostname + path;
     let cb = {
       success: (response, request) => {
@@ -373,19 +620,16 @@ export const dapUtils = {
             token = request.getResponseHeader('Akamai-DAP-Token');
             break;
         }
-        onSuccess(token, request.status, request);
+        onSuccess(token, request.status, request, onDone);
       },
       error: (request, error) => {
-        onError(request, request.statusText, error);
+        onError(request, request.statusText, error, onDone);
       }
     };
 
     ajax(url, cb, body, {
       method: method,
-      customHeaders: {
-        'Content-Type': 'application/json',
-        'Pragma': 'akamai-x-cache-on'
-      }
+      customHeaders: customHeaders
     });
   },
 
@@ -411,7 +655,7 @@ export const dapUtils = {
    *      api_hostname: 'api.dap.akadns.net',
    *      };
    *
-   *  // token from dap_x1_tokenize
+   *  // token from dap_tokenize
    *
    *  dapMembership( config, token,
    *      function( membership, status, xhr ) {
@@ -422,13 +666,13 @@ export const dapUtils = {
    *      } );
    *
    */
-  dapMembership: function(config, token, onSuccess = null, onError = null) {
+  dapMembership: function(config, token, onDone, onSuccess = null, onError = null) {
     if (onError == null) {
-      onError = function(xhr, status, error) {};
+      onError = function(xhr, status, error, onDone) {};
     }
 
     if (config == null || typeof (config) == typeof (undefined)) {
-      onError(null, 'Invalid config object', 'ClientError');
+      onError(null, 'Invalid config object', 'ClientError', onDone);
       return;
     }
 
@@ -437,32 +681,32 @@ export const dapUtils = {
     }
 
     if (typeof (config.api_version) != 'string') {
-      onError(null, "Invalid api_version: must be a string like 'x1', etc.", 'ClientError');
+      onError(null, "Invalid api_version: must be a string like 'x1', etc.", 'ClientError', onDone);
       return;
     }
 
     if (!(('api_hostname') in config) || typeof (config.api_hostname) != 'string' || config.api_hostname.length == 0) {
-      onError(null, 'Invalid api_hostname: must be a non-empty string', 'ClientError');
+      onError(null, 'Invalid api_hostname: must be a non-empty string', 'ClientError', onDone);
       return;
     }
 
     if (token == null || typeof (token) != 'string') {
-      onError(null, 'Invalid token: must be a non-null string', 'ClientError');
+      onError(null, 'Invalid token: must be a non-null string', 'ClientError', onDone);
       return;
     }
     let path = '/data-activation/' +
-               config.api_version +
-               '/token/' + token +
-               '/membership';
+      config.api_version +
+      '/token/' + token +
+      '/membership';
 
     let url = 'https://' + config.api_hostname + path;
 
     let cb = {
       success: (response, request) => {
-        onSuccess(JSON.parse(response), request.status, request);
+        onSuccess(JSON.parse(response), request.status, request, onDone);
       },
       error: (error, request) => {
-        onError(request, request.status, error);
+        onError(request, request.status, error, onDone);
       }
     };
 
@@ -470,5 +714,91 @@ export const dapUtils = {
       method: 'GET',
       customHeaders: {}
     });
+  },
+
+  /**
+   * SYNOPSIS
+   *
+   *  dapEncryptedMembership( config, token, onSuccess, onError );
+   *
+   * DESCRIPTION
+   *
+   *  Return the audience segment membership along with a new Secure Advertising
+   *  ID for this token in encrypted format.
+   *
+   * PARAMETERS
+   *
+   *  config: an array of system configuration parameters
+   *
+   *  token: the token previously returned from the tokenize API
+   *
+   * EXAMPLE
+   *
+   *  config = {
+   *      api_hostname: 'api.dap.akadns.net',
+   *      };
+   *
+   *  // token from dap_tokenize
+   *
+   *  dapEncryptedMembership( config, token,
+   *      function( membership, status, xhr ) {
+   *          // Run auction with membership.segments and membership.said after decryption
+   *      },
+   *      function( xhr, status, error ) {
+   *          // error
+   *      } );
+   *
+   */
+  dapEncryptedMembership: function(config, token, onDone, onSuccess = null, onError = null) {
+    if (onError == null) {
+      onError = function(xhr, status, error, onDone) {};
+    }
+
+    if (config == null || typeof (config) == typeof (undefined)) {
+      onError(null, 'Invalid config object', 'ClientError', onDone);
+      return;
+    }
+
+    if (!('api_version' in config) || (typeof (config.api_version) == 'string' && config.api_version.length == 0)) {
+      config.api_version = 'x1';
+    }
+
+    if (typeof (config.api_version) != 'string') {
+      onError(null, "Invalid api_version: must be a string like 'x1', etc.", 'ClientError', onDone);
+      return;
+    }
+
+    if (!(('api_hostname') in config) || typeof (config.api_hostname) != 'string' || config.api_hostname.length == 0) {
+      onError(null, 'Invalid api_hostname: must be a non-empty string', 'ClientError', onDone);
+      return;
+    }
+
+    if (token == null || typeof (token) != 'string') {
+      onError(null, 'Invalid token: must be a non-null string', 'ClientError', onDone);
+      return;
+    }
+    let path = '/data-activation/' +
+      config.api_version +
+      '/token/' + token +
+      '/membership/encrypt';
+
+    let url = 'https://' + config.api_hostname + path;
+
+    let cb = {
+      success: (response, request) => {
+        let encToken = request.getResponseHeader('Akamai-DAP-Token');
+        onSuccess(encToken, request.status, request, onDone);
+      },
+      error: (error, request) => {
+        onError(request, request.status, error, onDone);
+      }
+    };
+    ajax(url, cb, undefined, {
+      method: 'GET',
+      customHeaders: {
+        'Content-Type': 'application/json',
+        'Pragma': 'akamai-x-get-extracted-values'
+      }
+    });
   }
 }