> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Export Consent & Suppression Records

> Download your tenant-wide consent proof-of-record and suppression ledger as CSV or JSON to answer a TCPA or GDPR audit, a discovery request, or a regulator.

# Export Consent & Suppression Records

Recording consent and suppressing opt-outs is only half of the audit
problem. When a regulator, an auditor, or opposing counsel asks you to
*prove* who opted in or out, when, on which channel, and from what
source, you need the whole trail back out as a structured file — not a
per-contact lookup or a manual database pull.

Two endpoints produce that proof. Both are limited to **owners and
admins**, default to CSV (the file an auditor opens in a spreadsheet),
also speak JSON, and are audited themselves: every export run is written
to your audit log with the filters and row count, so the export is part
of the evidence trail.

All endpoints below are rooted at
`https://api.orbit.devotel.io/api/v1/compliance`.

***

## Consent proof-of-record

`GET /compliance/consent/export` returns one row per consent event —
opt-in, opt-out, or unknown — joined to the contact's email, phone, and
WhatsApp ID so a record maps back to a person.

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/consent/export?format=csv&channel=sms&from=2026-01-01" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

Query parameters:

| Parameter     | Type             | Notes                                                                                                                          |
| ------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| `format`      | enum             | `csv` (default) or `json`.                                                                                                     |
| `channel`     | enum             | Restrict to one channel: `email`, `fax`, `instagram`, `line`, `messenger`, `push`, `rcs`, `sms`, `viber`, `voice`, `whatsapp`. |
| `state`       | enum             | `all` (default), `opted_in`, `opted_out`, or `unknown`.                                                                        |
| `contact_id`  | string           | Scope the export to a single contact — the shape a discovery request usually takes.                                            |
| `from` / `to` | date or datetime | Bound `created_at`. Accepts a bare `YYYY-MM-DD` date or an ISO-8601 datetime; `to` is inclusive of the day.                    |
| `limit`       | integer          | Rows per export (1–50,000, default 50,000).                                                                                    |

Each row carries the GDPR burden-of-proof fields alongside the
identifiers: `lawful_basis`, `purpose`, `policy_template`,
`consent_text_version`, `consent_proof_url`, the recording `source`,
`ip_address`, the time-bounded `valid_until`, and the grant /
revocation / record timestamps. Missing values are empty cells — start
with the wide export, then narrow.

***

## Suppression ledger

`GET /compliance/suppression-list/export` is the export counterpart to
the bulk import — it returns the durable `(channel, address)` STOP
signals, including bulk-imported addresses that have no linked contact.

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/suppression-list/export?status=active" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

Query parameters:

| Parameter     | Type             | Notes                                                                                                      |
| ------------- | ---------------- | ---------------------------------------------------------------------------------------------------------- |
| `format`      | enum             | `csv` (default) or `json`.                                                                                 |
| `channel`     | enum             | Restrict to one scope: `all`, `sms`, `voice`, `whatsapp`, `email`, `push`, `telegram`, `messenger`, `rcs`. |
| `status`      | enum             | `active` (default — the set your sends actually enforce), `revoked`, or `all`.                             |
| `from` / `to` | date or datetime | Bound `suppressed_at`. Same lenient date/datetime handling as the consent export.                          |
| `limit`       | integer          | Rows per export (1–50,000, default 50,000).                                                                |

The active set is the audit default because it is the set every send
gate enforces; switch to `revoked` to prove an address was re-permissioned,
or `all` for the full ledger.

***

## Truncation

Both exports are synchronous and hard-capped at 50,000 rows per
request — the same ceiling as the bulk import. When your ledger exceeds
the cap, the CSV response sets the `X-Export-Truncated: true` header and
JSON responses report `truncated: true`. Narrow by date range or channel
and pull consecutive windows; never assume a flagged file is complete.

***

## Related references

* [Consent Management](/compliance/consent-management) — record and look
  up per-channel consent, the writes these exports read back.
* [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) —
  bulk-import the suppression ledger these exports return.
* [DSAR](/compliance/dsar) — honouring access requests over the consent
  record.
* [API Reference → Compliance](/api-reference/endpoints/compliance) —
  full request/response schemas.