Export Consent & Suppression Records
Recording consent and suppressing opt-outs is only half of the audit problem. When a regulator, an auditor, or opposing counsel asks you to prove who opted in or out, when, on which channel, and from what source, you need the whole trail back out as a structured file — not a per-contact lookup or a manual database pull. Two endpoints produce that proof. Both are limited to owners and admins, default to CSV (the file an auditor opens in a spreadsheet), also speak JSON, and are audited themselves: every export run is written to your audit log with the filters and row count, so the export is part of the evidence trail. All endpoints below are rooted athttps://api.orbit.devotel.io/api/v1/compliance.
Consent proof-of-record
GET /compliance/consent/export returns one row per consent event —
opt-in, opt-out, or unknown — joined to the contact’s email, phone, and
WhatsApp ID so a record maps back to a person.
Each row carries the GDPR burden-of-proof fields alongside the
identifiers:
lawful_basis, purpose, policy_template,
consent_text_version, consent_proof_url, the recording source,
ip_address, the time-bounded valid_until, and the grant /
revocation / record timestamps. Missing values are empty cells — start
with the wide export, then narrow.
Suppression ledger
GET /compliance/suppression-list/export is the export counterpart to
the bulk import — it returns the durable (channel, address) STOP
signals, including bulk-imported addresses that have no linked contact.
The active set is the audit default because it is the set every send
gate enforces; switch to
revoked to prove an address was re-permissioned,
or all for the full ledger.
Truncation
Both exports are synchronous and hard-capped at 50,000 rows per request — the same ceiling as the bulk import. When your ledger exceeds the cap, the CSV response sets theX-Export-Truncated: true header and
JSON responses report truncated: true. Narrow by date range or channel
and pull consecutive windows; never assume a flagged file is complete.
Related references
- Consent Management — record and look up per-channel consent, the writes these exports read back.
- Opt-Out & Suppression Lists — bulk-import the suppression ledger these exports return.
- DSAR — honouring access requests over the consent record.
- API Reference → Compliance — full request/response schemas.