Grant consent
Records that a contact granted one type of consent (voice_call, email or data_processing).
The contact’s previous granted record of the same type, if any, is marked revoked in the same
transaction, so a contact has at most one active grant per type. The history is kept: read it with
GET /api/compliance/consent/{contactId} and test it with
GET /api/compliance/consent/check/{contactId}/{consentType}.
contactId is not checked against existing contacts, so a mistyped id records consent for a
contact that does not exist. The request’s source IP is stored in ip_address. For a server-to-server
API call, that is your server’s IP, not the end customer’s. Put the customer’s proof in evidence.
A voice_call grant matters when the workspace setting require consent before calling is on. The
campaign dialer then skips any contact without an active, unexpired voice_call grant.
Side effects. Writes a consent record. Evicts the contact’s cached consent check and history.
Writes an audit entry (grant_consent, with consentType and source). No provider calls, no messages.
Idempotency. Safe to retry in effect: each retry revokes the previous grant and inserts a new one,
so one active grant remains. Each retry does add one more revoked row to the history.
Access
- Required scope:
full. Signed-in users need theowneroradminrole. - Rate limit: General API — 120 (Starter), 200 (Growth), 300 (Business) or 600 (Enterprise) requests/min per workspace. See Rate limits.
- Plan: Available on every plan.
Authentication
Workspace API key: jl_ followed by 64 lowercase hex characters, created by the workspace owner in the
dashboard (Settings → API Keys) and sent as Authorization: Bearer jl_.... The plaintext is shown once,
at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys.
Operations restricted to admins or owners reject keys without the full scope with 403, and say so in
their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret —
that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds.
See Authentication.
Request
What the contact agreed to.
voice_call: being called by phone, including by an AI voice agent.email: receiving commercial email.data_processing: having personal data stored and processed at all.
Where the consent was captured, as free text, e.g. web_form, ivr, verbal, whatsapp_optin.
A reference to the proof, e.g. a form submission id, a recording URL or a signed-document id.
When the consent stops counting, as an ISO 8601 UTC datetime with the Z suffix. Offsets such
as -05:00 fail validation. Omit it for consent that does not expire.