The default name of the control API cookie is AL_CONTROL. Although this name can be changed, it is not recommended to do so, because it adds a source of confusion. The control API is enabled on the mapping page (option "Enable Control API"). If the control API is enabled, all back-end applications connected to the mapping have the permission to use it. Regardless of this configuration, there are some unconditional control API commands that do not require a special permission. In order to interact with Airlock Gateway, a back-end service adds an AL_CONTROL cookie to the response. The cookie contains the desired commands.
The back-end control API cookie is handled by Airlock Gateway. It will not be sent to the client.