> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Mint and persist a signed consent receipt > Persist a Consent Manager's signed receipt as an opt-in consent record for a contact and channel. The receipt envelope is first structurally validated (ISO-8601 timestamps, Base64URL signature, non-empty payload, signed-field consistency), then its ECDSA P-256 signature is verified against the issuing manager's registered public key before anything is stored — an unknown/inactive manager or a failed signature returns `CONSENT_RECEIPT_INVALID` and persists nothing. Use it to record confirmed-consent proof captured through a DPDP Consent Manager. ## OpenAPI ````yaml /openapi.yaml post /api/v1/compliance/consent/receipts openapi: 3.1.0 info: title: Devotel CPaaS API description: Orbit by Devotel — Communications Platform as a Service API version: 1.0.0 contact: name: Devotel url: https://devotel.io email: support@devotel.io license: name: Proprietary servers: - url: https://api.orbit.devotel.io description: Production security: - Bearer: [] - ApiKey: [] tags: - name: Messages description: >- Send and manage messages across all channels (SMS, WhatsApp, RCS, Email, Viber, etc.) - name: Fax description: >- List and track fax (MMS/T.38) transmissions on Telnyx-backed fax numbers (sending flows through the Messaging API) - name: Agents description: AI agent creation, configuration, and execution - name: Voice description: Voice calls, IVR, conferencing, and SIP trunking - name: OnCall description: On-call rotations and escalation policy planning for incident alerting - name: Webhooks description: Webhook endpoint management and delivery logs - name: Numbers description: Phone number search, provisioning, and configuration - name: Brand Identity description: >- Unified cross-channel brand trust posture (10DLC, toll-free, WhatsApp, RCS, branded calling, number KYC) - name: Contacts description: Contact management, segmentation, and lifecycle tracking - name: Campaigns description: Marketing campaign orchestration and analytics - name: Flows description: Automation flow builder and execution engine - name: Templates description: Message template management and approval workflows - name: Settings description: Organization, channel, and user preference settings - name: Verify description: OTP generation and verification across channels - name: Push description: Push notification delivery via FCM and APNs - name: Integrations description: Third-party service connections and OAuth management - name: CDP description: >- Customer Data Platform — activation surface (CRM object sync, streaming destinations, ad-audience activation) - name: Files description: >- Server-to-server media upload, listing, retrieval, and deletion (signed-URL backed) - name: Commerce description: >- Omnichannel conversational-commerce — persistent cart + checkout state machine, channel-agnostic hosted pay-by-link, native WhatsApp checkout, and AP2-style agent payment mandates. - name: Sync description: >- Real-time shared-state primitive (Twilio Sync parity) — Documents, Maps, Lists, and ephemeral Streams, with change events relayed over the /api/v1/ws/sync WebSocket gateway - name: Risk description: >- Unified cross-channel Trust & Fraud risk scoring — fuses SMS-pumping, URL-reputation, Verify Fraud Guard, and Voice Biometrics signals into one composite verdict queryable before a send or a call. - name: Orby description: >- In-dashboard Orby operator assistant: streamed assistant turns, conversation threads, product knowledge-base search, and the tool-action approval gate. Available to signed-in operators only (dashboard session auth — API-key requests are rejected). paths: /api/v1/compliance/consent/receipts: post: tags: - Compliance summary: Mint and persist a signed consent receipt description: >- Persist a Consent Manager's signed receipt as an opt-in consent record for a contact and channel. The receipt envelope is first structurally validated (ISO-8601 timestamps, Base64URL signature, non-empty payload, signed-field consistency), then its ECDSA P-256 signature is verified against the issuing manager's registered public key before anything is stored — an unknown/inactive manager or a failed signature returns `CONSENT_RECEIPT_INVALID` and persists nothing. Use it to record confirmed-consent proof captured through a DPDP Consent Manager. requestBody: required: true content: application/json: schema: type: object additionalProperties: false required: - contact_id - consent_manager_id - channel - consent_type - receipt properties: contact_id: type: string minLength: 1 maxLength: 64 description: The contact this consent covers. consent_manager_id: type: string minLength: 1 maxLength: 200 description: >- The `manager_id` of the registered Consent Manager that signed the receipt. channel: type: string minLength: 1 maxLength: 40 description: >- The channel the consent applies to (e.g. `sms`, `whatsapp`, `email`). consent_type: type: string minLength: 1 maxLength: 80 description: The consent purpose/type recorded on the grant. receipt: type: object additionalProperties: false required: - receipt_id - issued_at - purpose - fiduciary_id - signature - payload description: The Consent Manager's signed receipt envelope. properties: receipt_id: type: string minLength: 1 maxLength: 200 description: The manager's unique receipt identifier. issued_at: type: string description: ISO-8601 timestamp the receipt was issued. expires_at: type: string description: Optional ISO-8601 expiry of the consent. purpose: type: string minLength: 1 maxLength: 500 description: The purpose the recipient consented to. fiduciary_id: type: string minLength: 1 maxLength: 200 description: The data-fiduciary identifier on the receipt. signature: type: string minLength: 1 maxLength: 4096 description: >- Base64URL detached ECDSA P-256 signature over the canonicalised payload. payload: type: object additionalProperties: true description: The non-empty JSON object the manager signed. example: contact_id: contact_01H8XY consent_manager_id: cm-acme-prod channel: sms consent_type: marketing receipt: receipt_id: rcpt-2026-07-abc123 issued_at: '2026-07-03T10:00:00Z' expires_at: '2027-07-03T10:00:00Z' purpose: Promotional SMS about Acme offers fiduciary_id: acme-in-001 signature: MEUCIQ...base64url... payload: receipt_id: rcpt-2026-07-abc123 purpose: Promotional SMS about Acme offers responses: '201': description: >- Receipt verified and persisted — returns `{ id, receipt_id, verified: true }`. '422': description: >- Structural validation failed, or the manager is unknown/inactive or the signature failed verification (`CONSENT_RECEIPT_INVALID`) — nothing is persisted. components: securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Dashboard JWT token from Clerk ApiKey: type: apiKey name: X-API-Key in: header description: Server-to-server API key (dv_live_sk_*) ````