Retrieve a country compliance config

GET

https://api.jelliu.co/api/compliance/configs/:countryCode

GET

/api/compliance/configs/:countryCode

curl https://api.jelliu.co/api/compliance/configs/CO \
     -H "Authorization: Bearer <token>"

{
  "data": {
    "id": "d41f7b2c-3e8a-4c95-b1d6-7f0e2a9c5b31",
    "tenant_id": "7a1d4e2b-9c8f-4b3a-a6e5-0d2c1f9b8e74",
    "country_code": "CO",
    "require_recording_consent": true,
    "consent_script": "Esta llamada será grabada con fines de calidad y cumplimiento según la Ley 1581 de Protección de Datos Personales. ¿Autoriza continuar?",
    "require_dnc_check": true,
    "max_call_attempts_per_day": 2,
    "max_call_attempts_total": 8,
    "allowed_call_hours": {
      "start": "09:00",
      "end": "19:00",
      "timezone": "America/Bogota"
    },
    "data_retention_days": 365,
    "require_opt_in": true,
    "blocked_prefixes": [
      "+57601"
    ],
    "require_ai_disclosure": null,
    "regulatory_notes": null,
    "created_at": "2026-08-20T15:02:11.000Z",
    "updated_at": "2026-09-11T10:45:37.000Z"
  }
}

Returns the workspace’s saved config for one country. When none has been saved, data is null, not a 404. In that case the country defaults from GET /api/compliance/defaults/{countryCode} apply.

This returns the stored row, not the effective rules. A null consent_script or require_ai_disclosure here is filled from the country default when a call is placed.

Access

Required scope: read or write. Any signed-in workspace role.
Rate limit: General API — 120 (Starter), 200 (Growth), 300 (Business) or 600 (Enterprise) requests/min per workspace. See Rate limits.
Plan: Available on every plan.

Authentication

AuthorizationBearer

Workspace API key: jl_ followed by 64 lowercase hex characters, created by the workspace owner in the dashboard (Settings → API Keys) and sent as Authorization: Bearer jl_.... The plaintext is shown once, at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys.

Scope	GET / HEAD	POST / PUT / PATCH / DELETE	Admin-only routes
`read`	Yes	No	No
`write`	Yes	Yes	No
`full`	Yes	Yes	Yes

Operations restricted to admins or owners reject keys without the full scope with 403, and say so in their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret — that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds. See Authentication.

Path parameters

countryCodeenumRequired

ISO 3166-1 alpha-2 code of a supported country, in upper case. CO Colombia, MX Mexico, BR Brazil, US United States, AR Argentina, CL Chile, PE Peru. Any other value, including lower case, returns 400.

Response

The config, or null.

dataobject or null

A saved per-country compliance config. Fields left null fall back to the country default when a call is placed.

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

429

Too Many Requests Error