API ReferenceCompliance

Create or replace a country compliance config

View as Markdown
Creates the config for `country_code` or **fully replaces** the existing one. Omitted optional fields go back to their defaults: `require_dnc_check` becomes `true`, `require_opt_in` becomes `false`, `blocked_prefixes` becomes `[]`, and `consent_script` and `require_ai_disclosure` become `null`. The change takes effect on the next call, message or email to that country. Loosening a config (longer hours, more attempts, DNC off) places your outreach outside the country's defaults. That is a legal decision, which is why only the workspace owner can make it. **Retention coupling.** After saving, the workspace retention window (`GET /api/compliance/retention`) is set to the **smallest** `data_retention_days` across all country configs. Saving a Colombia config with 30 days therefore shortens retention for the whole workspace, and the next daily sweep deletes accordingly. **Side effects.** Writes the config and updates the workspace retention window. Writes an audit entry. Future call greetings use the new recording and AI-disclosure notices. **Idempotency.** Safe to retry. This is a full replace keyed by country. **Access** - **Required scope:** `full`. Signed-in users need the `owner` role; admins are refused. - **Rate limit:** General API — 120 (Starter), 200 (Growth), 300 (Business) or 600 (Enterprise) requests/min per workspace. See [Rate limits](/rate-limits). - **Plan:** Available on every plan. The route passes through a compliance plan gate, but the feature is enabled on every tier, so the gate does not refuse today.

Authentication

AuthorizationBearer
Workspace API key: `jl_` followed by 64 lowercase hex characters, created by the workspace owner in the dashboard (**Settings → API Keys**) and sent as `Authorization: Bearer jl_...`. The plaintext is shown once, at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys. | Scope | GET / HEAD | POST / PUT / PATCH / DELETE | Admin-only routes | | --- | --- | --- | --- | | `read` | Yes | No | No | | `write` | Yes | Yes | No | | `full` | Yes | Yes | Yes | Operations restricted to admins or owners reject keys without the `full` scope with `403`, and say so in their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret — that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds. See [Authentication](/authentication).

Request

This endpoint expects an object.
country_codeenumRequired

A country Jelliu has written compliance rules for (ISO 3166-1 alpha-2, upper case). The country of a number is resolved from its dialling prefix. Defaults shown are the built-in ones. All seven require a recording notice, run the DNC check and default the AI-disclosure notice to off.

  • CO: Colombia (+57). Ley 1581 de 2012 (data protection) and the Registro de Números Excluidos under Ley 2300 de 2023. Calls 08:00–20:00 America/Bogota, 3 per day, 10 total, opt-in required, 365-day retention.
  • MX: Mexico (+52). LFPDPPP and the Profeco REPEP registry. Calls 08:00–21:00 America/Mexico_City, 3 per day, 10 total, 365 days.
  • BR: Brazil (+55). LGPD and Não Me Perturbe. Calls 08:00–20:00 America/Sao_Paulo, 3 per day, 8 total, opt-in required, recording notice in Portuguese, 365 days.
  • US: United States (+1, which also covers Canada and the Caribbean). TCPA/TSR and the National DNC Registry. Calls 08:00–21:00 America/New_York, 3 per day, 15 total, recording notice in English, 730 days.
  • AR: Argentina (+54). Ley 25.326. Calls 08:00–20:00 America/Argentina/Buenos_Aires, 3 per day, 10 total, 365 days.
  • CL: Chile (+56). Ley 19.628. Calls 08:00–20:00 America/Santiago, 3 per day, 10 total, 365 days.
  • PE: Peru (+51). Ley 29733. Calls 08:00–20:00 America/Lima, 3 per day, 10 total, 365 days.
max_call_attempts_per_dayintegerRequired1-10

Maximum calls to one contact per local day (midnight in the call-hours time zone).

max_call_attempts_totalintegerRequired1-50
Maximum lifetime call attempts to one contact.
allowed_call_hoursobjectRequired

The local window in which outreach is allowed. start is inclusive and end is exclusive. When start is later than end, the window wraps past midnight. At check time, the workspace’s own time zone setting, when present, replaces timezone.

data_retention_daysintegerRequired30-3650

Retention for this country, in days (minimum 30 here, although the workspace window accepts values from 1). The smallest value across configs becomes the workspace retention window.

consent_scriptstring or nullOptional<=2000 characters

The recording notice the agent reads at the start of the call, in the callee’s language. null uses the country default script.

require_dnc_checkbooleanOptionalDefaults to true

Block numbers that belong to any workspace contact marked do-not-call. The suppression list is checked regardless.

require_opt_inbooleanOptionalDefaults to false

Records that this country requires prior opt-in. It is stored and shown, but not enforced by the call gate. The dialer’s consent requirement is a separate workspace setting.

blocked_prefixeslist of stringsOptionalDefaults to []

E.164 prefixes that are never contacted (plain string prefix match), e.g. premium-rate or landline ranges.

require_ai_disclosureboolean or nullOptional

Open calls to this country by saying the caller is an AI. true or false is this workspace’s decision. null or omitted inherits the country default, which is false for every supported country. An agent’s own disclose_ai setting overrides this.

Response

The saved config.
dataobject

A saved per-country compliance config. Fields left null fall back to the country default when a call is placed.

Errors

400
Bad Request Error
401
Unauthorized Error
403
Forbidden Error
429
Too Many Requests Error