> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Record an opt-in or opt-out for a contact > Record a consent opt-in or opt-out for a contact across one or more channels. The write fans out to the canonical consent ledger, the contact's channel-preferences mirror, and — on opt-out — the suppression list and STOP-fence cache, so every send-time gate sees the same state. Identify the contact by `contact_id` or a freeform `identifier` (email / E.164 phone / WhatsApp id); a consent-based opt-in requires `purpose` and `consent_text_version` for GDPR Art 7(1) proof, and you may attach a validity window (`valid_until` or `expires_in_days`) for re-permission jurisdictions. 404s when the contact does not exist. ## OpenAPI ````yaml /openapi.yaml post /api/v1/compliance/consent openapi: 3.1.0 info: title: Devotel CPaaS API description: Orbit by Devotel — Communications Platform as a Service API version: 1.0.0 contact: name: Devotel url: https://devotel.io email: support@devotel.io license: name: Proprietary servers: - url: https://api.orbit.devotel.io description: Production security: - Bearer: [] - ApiKey: [] tags: - name: Messages description: >- Send and manage messages across all channels (SMS, WhatsApp, RCS, Email, Viber, etc.) - name: Fax description: >- List and track fax (MMS/T.38) transmissions on Telnyx-backed fax numbers (sending flows through the Messaging API) - name: Agents description: AI agent creation, configuration, and execution - name: Voice description: Voice calls, IVR, conferencing, and SIP trunking - name: OnCall description: On-call rotations and escalation policy planning for incident alerting - name: Webhooks description: Webhook endpoint management and delivery logs - name: Numbers description: Phone number search, provisioning, and configuration - name: Brand Identity description: >- Unified cross-channel brand trust posture (10DLC, toll-free, WhatsApp, RCS, branded calling, number KYC) - name: Contacts description: Contact management, segmentation, and lifecycle tracking - name: Campaigns description: Marketing campaign orchestration and analytics - name: Flows description: Automation flow builder and execution engine - name: Templates description: Message template management and approval workflows - name: Settings description: Organization, channel, and user preference settings - name: Verify description: OTP generation and verification across channels - name: Push description: Push notification delivery via FCM and APNs - name: Integrations description: Third-party service connections and OAuth management - name: CDP description: >- Customer Data Platform — activation surface (CRM object sync, streaming destinations, ad-audience activation) - name: Files description: >- Server-to-server media upload, listing, retrieval, and deletion (signed-URL backed) - name: Commerce description: >- Omnichannel conversational-commerce — persistent cart + checkout state machine, channel-agnostic hosted pay-by-link, native WhatsApp checkout, and AP2-style agent payment mandates. - name: Sync description: >- Real-time shared-state primitive (Twilio Sync parity) — Documents, Maps, Lists, and ephemeral Streams, with change events relayed over the /api/v1/ws/sync WebSocket gateway - name: Risk description: >- Unified cross-channel Trust & Fraud risk scoring — fuses SMS-pumping, URL-reputation, Verify Fraud Guard, and Voice Biometrics signals into one composite verdict queryable before a send or a call. - name: Orby description: >- In-dashboard Orby operator assistant: streamed assistant turns, conversation threads, product knowledge-base search, and the tool-action approval gate. Available to signed-in operators only (dashboard session auth — API-key requests are rejected). paths: /api/v1/compliance/consent: post: tags: - Compliance summary: Record an opt-in or opt-out for a contact description: >- Record a consent opt-in or opt-out for a contact across one or more channels. The write fans out to the canonical consent ledger, the contact's channel-preferences mirror, and — on opt-out — the suppression list and STOP-fence cache, so every send-time gate sees the same state. Identify the contact by `contact_id` or a freeform `identifier` (email / E.164 phone / WhatsApp id); a consent-based opt-in requires `purpose` and `consent_text_version` for GDPR Art 7(1) proof, and you may attach a validity window (`valid_until` or `expires_in_days`) for re-permission jurisdictions. 404s when the contact does not exist. requestBody: required: true content: application/json: schema: type: object additionalProperties: false required: - channels - opt_in properties: contact_id: type: string minLength: 1 maxLength: 64 description: >- The contact to record consent for (supply this or `identifier`). identifier: type: string minLength: 1 maxLength: 320 description: >- Freeform contact identifier resolved to a contact — email, E.164 phone, or WhatsApp id (supply this or `contact_id`). channels: type: array minItems: 1 description: >- Channels this consent applies to (`sms`, `email`, `whatsapp`, `voice`, `rcs`, `viber`, `messenger`, `instagram`, `line`, `push`, `fax`). items: type: string enum: - email - fax - instagram - line - messenger - push - rcs - sms - viber - voice - whatsapp opt_in: type: boolean description: >- `true` records an opt-in grant; `false` records an opt-out (revocation). source: type: string maxLength: 64 description: Where the consent came from (defaults to `consent_api`). consent_type: type: string maxLength: 80 description: Consent purpose/type (defaults to `messaging`). lawful_basis: type: string enum: - consent - contract - legal_obligation - vital_interests - public_task - legitimate_interests description: GDPR Art 6 lawful basis for processing. purpose: type: string maxLength: 500 description: >- What the recipient agreed to — required for a consent-based opt-in (GDPR Art 7(1)). consent_text_version: type: string maxLength: 80 description: >- Disclosure/policy version the recipient agreed to — required for a consent-based opt-in. consent_proof_url: type: string format: uri maxLength: 500 description: >- http(s) link to a specific evidence resource (a bare site root is rejected). valid_until: type: string format: date-time description: >- Absolute ISO-8601 expiry for a time-bounded opt-in (mutually exclusive with `expires_in_days`). expires_in_days: type: integer minimum: 1 maximum: 3650 description: Relative validity window in days for a time-bounded opt-in. metadata: type: object additionalProperties: true description: Optional free-form metadata stored on the grant. example: contact_id: contact_01H8XY channels: - sms opt_in: true lawful_basis: consent purpose: Promotional SMS about Acme offers consent_text_version: sms-optin-v3 source: signup_form responses: '201': description: >- Consent recorded — returns `{ contact_id, consent_record_ids, channels, state, valid_until }`. '404': description: No contact matches the supplied id/identifier. '422': description: Validation error in the consent payload. components: securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Dashboard JWT token from Clerk ApiKey: type: apiKey name: X-API-Key in: header description: Server-to-server API key (dv_live_sk_*) ````