Skip to main content

Compliance API

DSAR, consent records, compliance policy configuration Base path: /api/v1/compliance Endpoint count: 115
DLT-India registration must be enabled for your account. The four DLT-India write endpoints — POST /compliance/dlt-india/principal-entities, POST /compliance/dlt-india/headers, POST /compliance/dlt-india/content-templates, and POST /compliance/dlt-india/consent-templates — return 503 FEATURE_DISABLED until DLT registration is enabled for your account. The matching GET endpoints stay available in every environment, so you can still read existing principal entities, headers, and templates while writes are disabled.A gated request returns:
503 Service Unavailable
If you receive this response, contact support to have DLT registration enabled for your account.

GET /api/v1/compliance/10dlc/brands//vetting

GET /api/v1/compliance/10dlc/brands/{id}/vetting
id
string
required

GET /api/v1/compliance/10dlc/campaigns//status

GET /api/v1/compliance/10dlc/campaigns/{id}/status
id
string
required

GET /api/v1/compliance/10dlc/status

GET /api/v1/compliance/10dlc/status

GET /api/v1/compliance/10dlc/wizard

GET /api/v1/compliance/10dlc/wizard

GET /api/v1/compliance/10dlc/wizard/draft

GET /api/v1/compliance/10dlc/wizard/draft

GET /api/v1/compliance/ai-disclosure/

GET /api/v1/compliance/ai-disclosure/

GET /api/v1/compliance/audit-export

GET /api/v1/compliance/audit-export

GET /api/v1/compliance/audit-export/

GET /api/v1/compliance/audit-export/{jobId}
jobId
string
required

GET /api/v1/compliance/audit-export//verify

GET /api/v1/compliance/audit-export/{jobId}/verify
jobId
string
required

GET /api/v1/compliance/baa/

GET /api/v1/compliance/baa/

GET /api/v1/compliance/baa/download

GET /api/v1/compliance/baa/download

GET /api/v1/compliance/baa/template

GET /api/v1/compliance/baa/template

GET /api/v1/compliance/dpa/

GET /api/v1/compliance/dpa/
Returns the org’s current GDPR Article 28 Data Processing Agreement state (status, accepted version, signer details, and whether a newer template is available). Read-only. Owner/admin only.

GET /api/v1/compliance/dpa/download

GET /api/v1/compliance/dpa/download
Returns a 24-hour signed URL to the org’s accepted DPA document. Read-only. Owner/admin only. Responds 404 when no accepted DPA is on file.

GET /api/v1/compliance/dpa/template

GET /api/v1/compliance/dpa/template
Returns the raw markdown body of the canonical DPA template for the requested version (defaults to the current version). Read-only. Owner/admin only.

GET /api/v1/compliance/binder/

GET /api/v1/compliance/binder/

GET /api/v1/compliance/binder/

GET /api/v1/compliance/binder/{jobId}
jobId
string
required

GET /api/v1/compliance/binder/frameworks

GET /api/v1/compliance/binder/frameworks

GET /api/v1/compliance/brands

GET /api/v1/compliance/brands

GET /api/v1/compliance/campaigns

GET /api/v1/compliance/campaigns

GET /api/v1/compliance/check

GET /api/v1/compliance/check

GET /api/v1/compliance/compliance-profiles

GET /api/v1/compliance/compliance-profiles

GET /api/v1/compliance/compliance-profiles/

GET /api/v1/compliance/compliance-profiles/{id}
id
string
required

GET /api/v1/compliance/compliance-profiles//numbers

GET /api/v1/compliance/compliance-profiles/{id}/numbers
id
string
required

GET /api/v1/compliance/compliance-profiles/eligible

GET /api/v1/compliance/compliance-profiles/eligible

GET /api/v1/compliance/consent/history

GET /api/v1/compliance/consent/history

GET /api/v1/compliance/consent/lookup

GET /api/v1/compliance/consent/lookup

GET /api/v1/compliance/consent/managers

GET /api/v1/compliance/consent/managers

GET /api/v1/compliance/countries

GET /api/v1/compliance/countries

GET /api/v1/compliance/countries/

GET /api/v1/compliance/countries/{code}
code
string
required

GET /api/v1/compliance/country-rules/

GET /api/v1/compliance/country-rules/

GET /api/v1/compliance/dlt-india/consent-templates

GET /api/v1/compliance/dlt-india/consent-templates

GET /api/v1/compliance/dlt-india/content-templates

GET /api/v1/compliance/dlt-india/content-templates

GET /api/v1/compliance/dlt-india/headers

GET /api/v1/compliance/dlt-india/headers

GET /api/v1/compliance/dlt-india/nudge

GET /api/v1/compliance/dlt-india/nudge

GET /api/v1/compliance/dlt-india/principal-entities

GET /api/v1/compliance/dlt-india/principal-entities

Check DNC status for a phone number

GET /api/v1/compliance/dnc/check
>- Returns whether the given E.164 phone number appears on any of the platform’s Do-Not-Call sources (tenant contacts.dnc, tenant dnc_list, platform-wide DNC, explicit consent opt-out). Read-only — does not perform a send. Use this before any outbound SMS / Voice initiation to pre-flight the compliance check that the actual send path enforces. Gated behind organizations.settings.dnc_sync_enabled (audit #SCAN-CMP-005). Federal/state/TCR feed ingestion is currently a stub; tenants must explicitly opt in (acknowledging the gap) before the endpoint is served. When the flag is OFF, responses are HTTP 403 with code DNC_SYNC_NOT_ENABLED. When ON, responses
phone
string
required
E.164 phone number to check (e.g. +14155551234).
country
string
Optional ISO 3166-1 alpha-2 country code. Reserved for future country-specific lookups; currently informational.

GET /api/v1/compliance/documents

GET /api/v1/compliance/documents

GET /api/v1/compliance/dsar/

GET /api/v1/compliance/dsar/

GET /api/v1/compliance/dsar/

GET /api/v1/compliance/dsar/{id}
id
string
required

GET /api/v1/compliance/dsar/erasure-requests

GET /api/v1/compliance/dsar/erasure-requests

GET /api/v1/compliance/dsar/sla

GET /api/v1/compliance/dsar/sla

Get compliance emergency-stop status

GET /api/v1/compliance/emergency-stop
Returns the current state of the tenant-level outbound kill switch. When active=true, every outbound SMS / MMS / voice / dialer activation for this organization is blocked with HTTP 403 ORG_COMPLIANCE_EMERGENCY_STOP. Toggle via POST /compliance/emergency-stop/activate or /deactivate (owner/admin).

GET /api/v1/compliance/preference-center

GET /api/v1/compliance/preference-center

GET /api/v1/compliance/preferences/

GET /api/v1/compliance/preferences/{token}
token
string
required

Preview quiet-hours dispatch decision

GET /api/v1/compliance/quiet-hours/preview
Returns whether a send to the given recipient on the given channel would be allowed right now under the universal quiet-hours gate (TCPA dialing-window for voice, 08:00–21:00 baseline for SMS / RCS / Telegram / Viber, 09:00–21:00 for WhatsApp / Meta channels, configurable per-org). Read-only — does not perform a send. The next_allowed_at field on a blocked result is the DST-safe ISO timestamp of the next moment the gate would pass.
phone
string
required
E.164 recipient phone number (e.g. +14155551234).
channel
string (enum: sms|mms|whatsapp|rcs|viber|telegram|…)
required
Channel of the prospective send.
timezone_override
string
Optional IANA timezone (e.g. America/New_York) overriding the area-code resolution. Useful when the recipient’s tz is known from a CRM record.

GET /api/v1/compliance/requirements

GET /api/v1/compliance/requirements

Get the org’s FCC Robocall Mitigation Database registration

GET /api/v1/compliance/rmd
Returns this organization’s RMD registration (or null when none has been started) annotated with a live recertification verdict and whether a robocall-mitigation plan is required. Read-only.

Scrub a destination number against the FCC Reassigned Numbers Database

GET /api/v1/compliance/rnd/check
>- Returns whether the given E.164 destination number has been permanently disconnected (and may have been reassigned) since the consent_date, and whether the FCC reassigned-number safe harbor (47 CFR § 64.1200(m)) applies. Read-only — does not perform a send. Use this before any outbound SMS / Voice initiation to avoid TCPA liability for contacting a reassigned number. Gated behind organizations.settings.rnd_scrub_enabled. Tenants must explicitly opt in before the endpoint is served. When the flag is OFF, responses are HTTP 403 with code RND_SCRUB_NOT_ENABLED. When ON, feed_synced reports whether an RND disconnect snapshot is loaded: the feed ingestion pipeline runs at boot and installs the FCC RND source when the SomosGov / reassigned.us snapshot is configured, so matching verdicts return feed_synced: true; until a snapshot is configured every verdict stays no_data / feed_synced: false.
phone
string
required
E.164 destination number to scrub (e.g. +14155551234).
ISO calendar date (YYYY-MM-DD) the prior-express consent was obtained / last verified.

GET /api/v1/compliance/sender-id-registrations

GET /api/v1/compliance/sender-id-registrations

List ITG traceback cases

GET /api/v1/compliance/traceback
Returns every Industry Traceback Group (ITG) traceback case logged for this organization, each annotated with a live response-deadline (SLA) verdict. Read-only.

Get one ITG traceback case

GET /api/v1/compliance/traceback/{id}
Returns a single ITG traceback case (with its live SLA verdict) by id for the caller’s organization. Read-only.
id
string
required

GET /api/v1/compliance/use-cases

GET /api/v1/compliance/use-cases

POST /api/v1/compliance/10dlc/brand

POST /api/v1/compliance/10dlc/brand

POST /api/v1/compliance/10dlc/brands//revet

POST /api/v1/compliance/10dlc/brands/{id}/revet
id
string
required

POST /api/v1/compliance/10dlc/campaign

POST /api/v1/compliance/10dlc/campaign

POST /api/v1/compliance/10dlc/decode-rejection

POST /api/v1/compliance/10dlc/decode-rejection

POST /api/v1/compliance/10dlc/preflight

POST /api/v1/compliance/10dlc/preflight

POST /api/v1/compliance/10dlc/wizard/preflight

POST /api/v1/compliance/10dlc/wizard/preflight

POST /api/v1/compliance/10dlc/wizard/submit

POST /api/v1/compliance/10dlc/wizard/submit

POST /api/v1/compliance/admin/sync

POST /api/v1/compliance/admin/sync

POST /api/v1/compliance/baa/decline

POST /api/v1/compliance/baa/decline

POST /api/v1/compliance/baa/execute

POST /api/v1/compliance/baa/execute

POST /api/v1/compliance/dpa/accept

POST /api/v1/compliance/dpa/accept
Accepts the Data Processing Agreement via a type-the-name click-wrap e-signature. typed_attestation must exactly match signer_name. Writes a compliance.dpa.accepted audit-chain row as the legal evidence of attestation. Owner only. Acceptance never gates outbound.

POST /api/v1/compliance/binder/generate

POST /api/v1/compliance/binder/generate

POST /api/v1/compliance/brands

POST /api/v1/compliance/brands

POST /api/v1/compliance/campaigns

POST /api/v1/compliance/campaigns

POST /api/v1/compliance/campaigns//numbers

POST /api/v1/compliance/campaigns/{id}/numbers
id
string
required

POST /api/v1/compliance/compliance-profiles

POST /api/v1/compliance/compliance-profiles

POST /api/v1/compliance/compliance-profiles//documents

POST /api/v1/compliance/compliance-profiles/{id}/documents
id
string
required

POST /api/v1/compliance/compliance-profiles//resync

POST /api/v1/compliance/compliance-profiles/{id}/resync
id
string
required

POST /api/v1/compliance/compliance-profiles//submit

POST /api/v1/compliance/compliance-profiles/{id}/submit
id
string
required

POST /api/v1/compliance/consent

POST /api/v1/compliance/consent

POST /api/v1/compliance/consent/managers

POST /api/v1/compliance/consent/managers

POST /api/v1/compliance/consent/receipts

POST /api/v1/compliance/consent/receipts

POST /api/v1/compliance/consent/receipts//verify

POST /api/v1/compliance/consent/receipts/{id}/verify
id
string
required

POST /api/v1/compliance/country-rules/sync

POST /api/v1/compliance/country-rules/sync
Platform super-admin only. This endpoint refreshes the shared country-rules reference data from upstream provider feeds, so it is restricted to Devotel platform administrators. A regular tenant admin key receives 403 FORBIDDEN:
Tenant admins do not need to call this — country rules are kept current by an automatic weekly sync.
provider
string
Upstream feed to pull from: telnyx (default), mef, iconectiv, meta, or itu.
channel
string
Optional channel to limit the refresh to (for example sms or whatsapp).

POST /api/v1/compliance/dlt-india/consent-templates

POST /api/v1/compliance/dlt-india/consent-templates

POST /api/v1/compliance/dlt-india/content-templates

POST /api/v1/compliance/dlt-india/content-templates

POST /api/v1/compliance/dlt-india/headers

POST /api/v1/compliance/dlt-india/headers

POST /api/v1/compliance/dlt-india/nudge/dismiss

POST /api/v1/compliance/dlt-india/nudge/dismiss

POST /api/v1/compliance/dlt-india/principal-entities

POST /api/v1/compliance/dlt-india/principal-entities

POST /api/v1/compliance/documents

POST /api/v1/compliance/documents
This endpoint consumes multipart/form-data — upload a single KYC document in the file form field with a required type form field (passport, id_card, …) and an optional country_code.

POST /api/v1/compliance/dsar/

POST /api/v1/compliance/dsar/

POST /api/v1/compliance/dsar//cancel

POST /api/v1/compliance/dsar/{id}/cancel
id
string
required

POST /api/v1/compliance/dsar//verification

POST /api/v1/compliance/dsar/{id}/verification
id
string
required

POST /api/v1/compliance/dsar/erasure-requests//cancel

POST /api/v1/compliance/dsar/erasure-requests/{id}/cancel
id
string
required

Activate the org-wide compliance emergency stop

POST /api/v1/compliance/emergency-stop/activate
Halts every outbound dispatch path (SMS / MMS / voice / dialer activation) for this organization immediately. Owner / admin only. The optional reason is stored on the settings flag and surfaced in the audit log so a post-incident review can rebuild the timeline.

Deactivate the org-wide compliance emergency stop

POST /api/v1/compliance/emergency-stop/deactivate
Lifts the org-wide outbound dispatch halt. Owner / admin only. Audit-logged with the deactivation timestamp and actor.

POST /api/v1/compliance/preference-center

POST /api/v1/compliance/preference-center

POST /api/v1/compliance/preference-center/link

POST /api/v1/compliance/preference-center/link

POST /api/v1/compliance/public/dsar/begin

POST /api/v1/compliance/public/dsar/begin

POST /api/v1/compliance/public/dsar/resend-email

POST /api/v1/compliance/public/dsar/resend-email

POST /api/v1/compliance/public/dsar/send-phone

POST /api/v1/compliance/public/dsar/send-phone

POST /api/v1/compliance/public/dsar/submit

POST /api/v1/compliance/public/dsar/submit

POST /api/v1/compliance/public/dsar/verify-email

POST /api/v1/compliance/public/dsar/verify-email

POST /api/v1/compliance/public/dsar/verify-phone

POST /api/v1/compliance/public/dsar/verify-phone

Create or update the draft RMD registration

POST /api/v1/compliance/rmd
Upserts the organization’s draft RMD registration. Allowed only when there is no registration yet, or its status is draft / withdrawn — a submitted/active filing is mutated through the lifecycle endpoints. Records the filing locally only (invariant #45) — it wires no carrier and places no calls.

Mark the RMD registration active/certified

POST /api/v1/compliance/rmd/certify
Records that the FCC RMD filing has been published / accepted, moving it to active and starting the recertification review clock. Records state only (invariant #45).

Flag the RMD registration as needing remediation

POST /api/v1/compliance/rmd/remediation
Records that a terminating carrier or the FCC flagged a deficiency in the active RMD filing that must be corrected. Records state only (invariant #45).

Resolve an RMD remediation and re-certify

POST /api/v1/compliance/rmd/resolve
Records that a flagged deficiency has been corrected, returning the filing to active and refreshing the recertification review clock. Records state only (invariant #45).

Submit the RMD registration to the FCC database

POST /api/v1/compliance/rmd/submit
Marks the draft RMD registration as submitted. Rejects with 409 when the draft is incomplete (e.g. a robocall-mitigation plan is required but absent). Records the filing reference; wires no carrier (invariant responses:

Withdraw the RMD registration

POST /api/v1/compliance/rmd/withdraw
Marks the RMD filing as withdrawn / superseded. The filing can later be re-opened to a draft via POST /compliance/rmd. Records state only (invariant #45).

Set the call-time RMD origination enforcement mode

PUT /api/v1/compliance/rmd/enforcement
Sets whether outbound voice origination is blocked (enforce), flagged (warn), or unaffected (off, the default) while this organization’s FCC Robocall Mitigation Database filing is not current. Opt-in; records policy only — it wires no carrier and places no calls. RBAC: owner/admin only.

POST /api/v1/compliance/sender-id-registrations

POST /api/v1/compliance/sender-id-registrations

Bulk import a CSV of opt-outs into the suppression list

POST /api/v1/compliance/suppression-list/import
>- Operator uploads a CSV of phone / email / wa_id addresses; each row is marked as durably suppressed across every channel (channel=‘all’) in one shot. Idempotent — re-uploading the same list is a no-op. Returns a per-row breakdown so the wizard can show accepted / duplicate / invalid counts and download a skipped.csv for invalid rows.
This endpoint consumes multipart/form-data — upload a single CSV file in the file form field (not a JSON body). The CSV must have a header row; recognised columns are case-insensitive and at least one of phone, email, wa_id is required per row, with optional channel and reason columns. Optional form fields: default_country (ISO-3166 alpha-2 for national-format phone normalisation), default_reason, and dry_run=true (classify + count without writing). The JSON response returns per-row counts — accepted, duplicates, intra_file_duplicates, invalid — a by_channel breakdown, the uploaded file’s file_sha256, and an errors[] array (up to 100 invalid rows with reason codes such as invalid_phone / invalid_email) the wizard uses to build a downloadable skipped.csv.

Log an inbound ITG traceback request

POST /api/v1/compliance/traceback
Records a new Industry Traceback Group (ITG) traceback request for an originating number implicated in a robocall complaint, starting the response-deadline clock (default 24h). Does NOT place a call or send a message (invariant #45) — this is case intake only.

Acknowledge an ITG traceback case

POST /api/v1/compliance/traceback/{id}/acknowledge
Marks an ITG traceback case as acknowledged (receipt confirmed to the ITG). Records no outbound message (invariant #45).
id
string
required

File a response/disposition for an ITG traceback case

POST /api/v1/compliance/traceback/{id}/respond
Records the originator’s disposition (source identified, customer notified/terminated, number disabled, not originated here, or no action) for an ITG traceback case, stopping the response-deadline clock. Optionally closes the case. Persists the disposition only — sends nothing (invariant #45).
id
string
required

PUT /api/v1/compliance/10dlc/wizard/draft

PUT /api/v1/compliance/10dlc/wizard/draft

PUT /api/v1/compliance/ai-disclosure/

PUT /api/v1/compliance/ai-disclosure/

PUT /api/v1/compliance/compliance-profiles//data

PUT /api/v1/compliance/compliance-profiles/{id}/data
id
string
required

PUT /api/v1/compliance/consent/managers/

PUT /api/v1/compliance/consent/managers/{id}
id
string
required

PUT /api/v1/compliance/country-rules//

PUT /api/v1/compliance/country-rules/{channel}/{country_code}
channel
string
required
country_code
string
required

PUT /api/v1/compliance/preferences/

PUT /api/v1/compliance/preferences/{token}
token
string
required

PATCH /api/v1/compliance/compliance-profiles/

PATCH /api/v1/compliance/compliance-profiles/{id}
id
string
required

DELETE /api/v1/compliance/10dlc/wizard/draft

DELETE /api/v1/compliance/10dlc/wizard/draft

DELETE /api/v1/compliance/compliance-profiles/

DELETE /api/v1/compliance/compliance-profiles/{id}
id
string
required

DELETE /api/v1/compliance/compliance-profiles//documents/

DELETE /api/v1/compliance/compliance-profiles/{id}/documents/{docId}
id
string
required
docId
string
required

DELETE /api/v1/compliance/documents/

DELETE /api/v1/compliance/documents/{id}
id
string
required