> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developer.jelliu.co/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.jelliu.co/_mcp/server.

# Import a previewed CSV

POST https://api.jelliu.co/api/campaigns/{campaignId}/contacts/upload-confirm
Content-Type: multipart/form-data

Step 2 of the CSV import. Send the **same file** again as `multipart/form-data`, together with
the confirmed `mapping` and the `fileHash` from `POST .../upload-preview`. A file whose SHA-256
differs is refused with 400 `File changed between preview and confirm`. Because the request is
multipart, `mapping`, `metadataKeys` and `consent` are JSON-encoded strings (each at most 1 MB
and 5 levels deep).

**How rows become contacts** (every row of the file, not only the first 1,000):

* Phone and WhatsApp values lose spaces, dashes and parentheses, and get a leading `+` if they
  have none. **No country code is added**, so `3001234567` becomes `+3001234567`. Include the
  country code in the file.
* A row needs a phone, an email or a WhatsApp number. Phones must then be E.164, and emails
  well-formed and lowercased.
* Columns mapped to `metadata` are stored under their header (or the name given in
  `metadataKeys`). Card-like and 9-digit ID-like numbers are redacted. The 20-key and key-format
  rules of the JSON endpoints do not apply.
* Rows that fail go to `errors` and count in `skipped`.

Valid rows are then imported in chunks of 500 with the exact rules of
`POST /api/campaigns/{campaignId}/contacts/bulk`: duplicates collapse, existing phones are skipped,
removed ones are restored. **A chunk that fails does not fail the request.** A campaign that is
unknown or completed, or a chunk that would cross the plan's contact cap, adds one
`Failed to import rows X-Y: …` entry to `errors`, and the other chunks still import. Always read
`imported` and `errors`; a 200 does not mean every row landed. `imported + skipped` can be lower
than the row count, because duplicates, existing contacts and failed chunks are in neither.

**Consent.** Without `consent`, every imported contact is recorded as having no consent evidence
(`import:csv`). With it, the source is recorded as `import:csv:<source>` together with the evidence
and the uploader's IP.

**Side effects.** Inserts contacts, writes consent provenance rows and an audit entry. Nobody is
contacted. Contacts added to an `active` campaign are not queued until it is paused and activated
again.

**Idempotency.** Safe to retry with the same file: phones already in the campaign are skipped, so a
retry imports only what did not land (`imported` counts only new rows).

**Webhook events.** `audit.log_recorded` for webhooks subscribed to it. See [Webhooks](/webhooks).

**Access**

* **Required scope:** `write` (or `full`).
* **Rate limit:** Contacts import — 5 requests/min per workspace, shared by every route under `/api/campaigns/{campaignId}/contacts`, on top of the general API limit. See [Rate limits](/rate-limits).
* **Plan:** Refused with 403 `BILLING_ERROR` when the contact cap is already reached. Otherwise each 500-row chunk is checked against the cap (Starter 500, Growth 2,000, Business 20,000), and chunks over it are reported in `errors`.

Reference: https://developer.jelliu.co/api-reference/contacts/post-campaigns-by-campaign-id-contacts-upload-confirm

## Authentication

- `Authorization` header (bearer token, required) — Workspace API key: `jl_` followed by 64 lowercase hex characters, created by the workspace owner in the dashboard (**Settings → API Keys**) and sent as `Authorization: Bearer jl_...`. The plaintext is shown once, at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys. | Scope | GET / HEAD | POST / PUT / PATCH / DELETE | Admin-only routes | | --- | --- | --- | --- | | `read` | Yes | No | No | | `write` | Yes | Yes | No | | `full` | Yes | Yes | Yes | Operations restricted to admins or owners reject keys without the `full` scope with `403`, and say so in their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret — that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds. See [Authentication](/authentication).

## Request

### Path parameters

- `campaignId` (string, required) — UUID of the campaign that receives the contacts. A value that is not a UUID answers 400. An unknown or foreign campaign does **not** answer 404 here; every chunk is reported as failed in `errors`.

### Body (multipart/form-data)

This endpoint expects a multipart form containing a file.

- `file` (file, required) — The same CSV file sent to upload-preview (`.csv`, max 10 MB). Its SHA-256 must equal `fileHash`.
- `mapping` (string, required) — JSON object mapping each CSV header to one of `phoneNumber`, `name`, `email`, `whatsappNumber`, `metadata` or `ignore`. Headers left out are ignored. If several headers map to the same identity field, the last one in the object wins.
- `metadataKeys` (string, optional) — Optional JSON object renaming `metadata` columns, from CSV header to the key stored on the contact. Unlisted metadata columns keep their header as key.
- `fileHash` (string, required) — The `fileHash` returned by upload-preview (case-insensitive hex).
- `skipInvalid` (boolean, optional) — Has no effect: invalid rows are always skipped and reported. **Do not send it** in a multipart request. The form value arrives as the string `"true"` and fails validation with 400.
- `consent` (string, optional) — Optional JSON object `{"source": string (2-80 chars), "evidence": string (3-500 chars)}` declaring the consent basis for the list: `source` is how it was collected (`web_form`, `contract`, `double_opt_in`…), `evidence` something checkable later (a URL, an export id). Both keys are required when it is sent; a basis without evidence is refused with 400. Omit it when there is no evidence.

## Response

### 200

The import ran. Check `errors` for rows or chunks that did not land.

- `success` (true, required) — Always `true` on 200, even when chunks failed.
- `data` (object, required)
  - `imported` (integer, required) — Newly inserted contacts across all chunks.
  - `skipped` (integer, required) — Rows that could not be turned into a contact (no identifier, invalid phone, email or WhatsApp number). Duplicates, existing contacts and failed chunks are not included.
  - `errors` (list of object, required) — Up to 100 problems. Row-level errors come first, then one entry per failed chunk.
    - `row` (integer, optional) — Line number in the file (header = 1, blank lines skipped); for a failed chunk, its first row.
    - `message` (string, optional) — What went wrong.

## Errors

### 400 Bad Request Error

No file, not a CSV, invalid JSON fields, an invalid body, or a file different from the previewed one.

- `error` (object, required) — The error object. Always has `code` and `message`.
  - `code` (string, required) — Stable machine-readable error code (for example `VALIDATION_FAILED`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`, `BILLING_ERROR`, `COMPLIANCE_BLOCKED`, `RATE_LIMIT_EXCEEDED`, `INTERNAL_ERROR`). Switch on this, not on `message`. See [Errors](/errors).
  - `message` (string, required) — Human-readable explanation. English or Spanish depending on the route; may change without notice.
  - `details` (object or list of object, optional) — Present on `VALIDATION_FAILED` only. Its shape depends on how the route validates: * a field map, either Zod's `flatten()` output (`{ "formErrors": [], "fieldErrors": { "name": ["..."] } }`) or just its `fieldErrors` part (`{ "name": ["..."] }`); * an issue list, where each issue has at least `path`, `message` and `code`. `path` is a dot-separated string on routes that let the schema throw, and an array of keys on routes that forward Zod's raw issues (those also carry Zod's extra issue fields).
    - Field map
      - `formErrors` (list of string, optional)
      - `fieldErrors` (map from string to list of string, optional)
  - `metadata` (map from string to any, optional) — Structured detail exposed for a small allowlist of codes only — for example `BILLING_ERROR` carries `limit`, `current` and `tier` (resource caps) or `tier` and `feature` (feature gates).

### 401 Unauthorized Error

No usable credential. Either the `Authorization` header is missing or is not a well-formed `Bearer jl_…` key, or the key is unknown, revoked or expired. Do not retry with the same key. See [Authentication](/authentication#401-unauthorized).

- `error` (object, required) — The error object. Always has `code` and `message`.
  - `code` (string, required) — Stable machine-readable error code (for example `VALIDATION_FAILED`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`, `BILLING_ERROR`, `COMPLIANCE_BLOCKED`, `RATE_LIMIT_EXCEEDED`, `INTERNAL_ERROR`). Switch on this, not on `message`. See [Errors](/errors).
  - `message` (string, required) — Human-readable explanation. English or Spanish depending on the route; may change without notice.
  - `details` (object or list of object, optional) — Present on `VALIDATION_FAILED` only. Its shape depends on how the route validates: * a field map, either Zod's `flatten()` output (`{ "formErrors": [], "fieldErrors": { "name": ["..."] } }`) or just its `fieldErrors` part (`{ "name": ["..."] }`); * an issue list, where each issue has at least `path`, `message` and `code`. `path` is a dot-separated string on routes that let the schema throw, and an array of keys on routes that forward Zod's raw issues (those also carry Zod's extra issue fields).
    - Field map
      - `formErrors` (list of string, optional)
      - `fieldErrors` (map from string to list of string, optional)
  - `metadata` (map from string to any, optional) — Structured detail exposed for a small allowlist of codes only — for example `BILLING_ERROR` carries `limit`, `current` and `tier` (resource caps) or `tier` and `feature` (feature gates).

### 403 Forbidden Error

The workspace contact cap is already reached, or the API key lacks the `write` scope.

- `error` (object, required) — The error object. Always has `code` and `message`.
  - `code` (string, required) — Stable machine-readable error code (for example `VALIDATION_FAILED`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`, `BILLING_ERROR`, `COMPLIANCE_BLOCKED`, `RATE_LIMIT_EXCEEDED`, `INTERNAL_ERROR`). Switch on this, not on `message`. See [Errors](/errors).
  - `message` (string, required) — Human-readable explanation. English or Spanish depending on the route; may change without notice.
  - `details` (object or list of object, optional) — Present on `VALIDATION_FAILED` only. Its shape depends on how the route validates: * a field map, either Zod's `flatten()` output (`{ "formErrors": [], "fieldErrors": { "name": ["..."] } }`) or just its `fieldErrors` part (`{ "name": ["..."] }`); * an issue list, where each issue has at least `path`, `message` and `code`. `path` is a dot-separated string on routes that let the schema throw, and an array of keys on routes that forward Zod's raw issues (those also carry Zod's extra issue fields).
    - Field map
      - `formErrors` (list of string, optional)
      - `fieldErrors` (map from string to list of string, optional)
  - `metadata` (map from string to any, optional) — Structured detail exposed for a small allowlist of codes only — for example `BILLING_ERROR` carries `limit`, `current` and `tier` (resource caps) or `tier` and `feature` (feature gates).

### 429 Too Many Requests Error

The contacts-import limit (5/min) or the general API limit was exceeded.

- `error` (object, required) — The error object. Always has `code` and `message`.
  - `code` (string, required) — Stable machine-readable error code (for example `VALIDATION_FAILED`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`, `BILLING_ERROR`, `COMPLIANCE_BLOCKED`, `RATE_LIMIT_EXCEEDED`, `INTERNAL_ERROR`). Switch on this, not on `message`. See [Errors](/errors).
  - `message` (string, required) — Human-readable explanation. English or Spanish depending on the route; may change without notice.
  - `details` (object or list of object, optional) — Present on `VALIDATION_FAILED` only. Its shape depends on how the route validates: * a field map, either Zod's `flatten()` output (`{ "formErrors": [], "fieldErrors": { "name": ["..."] } }`) or just its `fieldErrors` part (`{ "name": ["..."] }`); * an issue list, where each issue has at least `path`, `message` and `code`. `path` is a dot-separated string on routes that let the schema throw, and an array of keys on routes that forward Zod's raw issues (those also carry Zod's extra issue fields).
    - Field map
      - `formErrors` (list of string, optional)
      - `fieldErrors` (map from string to list of string, optional)
  - `metadata` (map from string to any, optional) — Structured detail exposed for a small allowlist of codes only — for example `BILLING_ERROR` carries `limit`, `current` and `tier` (resource caps) or `tier` and `feature` (feature gates).

## Examples

### Import with two invalid rows

**Request**

```json
{}
```

**Response**

```json
{
  "success": true,
  "data": {
    "imported": 243,
    "skipped": 2,
    "errors": [
      {
        "row": 17,
        "message": "Invalid phone format: +03001234567"
      },
      {
        "row": 88,
        "message": "No phone number, email, or WhatsApp number"
      }
    ]
  }
}
```

**SDK Code**

```python Import with two invalid rows
import requests

url = "https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.json())
```

```javascript Import with two invalid rows
const url = 'https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Import with two invalid rows
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Import with two invalid rows
require 'uri'
require 'net/http'

url = URI("https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java Import with two invalid rows
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php Import with two invalid rows
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp Import with two invalid rows
using RestSharp;

var client = new RestClient("https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift Import with two invalid rows
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### Second chunk refused by the plan's contact cap

**Request**

```json
{}
```

**Response**

```json
{
  "success": true,
  "data": {
    "imported": 500,
    "skipped": 0,
    "errors": [
      {
        "row": 502,
        "message": "Failed to import rows 502-1001: Import of 500 contacts would exceed the plan limit (2000 contacts on the growth plan; currently 1850). Reduce the batch or upgrade your plan in Settings → Plan."
      }
    ]
  }
}
```

**SDK Code**

```python Second chunk refused by the plan's contact cap
import requests

url = "https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.json())
```

```javascript Second chunk refused by the plan's contact cap
const url = 'https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Second chunk refused by the plan's contact cap
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Second chunk refused by the plan's contact cap
require 'uri'
require 'net/http'

url = URI("https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java Second chunk refused by the plan's contact cap
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php Second chunk refused by the plan's contact cap
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp Second chunk refused by the plan's contact cap
using RestSharp;

var client = new RestClient("https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift Second chunk refused by the plan's contact cap
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### Confirm with mapping and consent

**Request**

```json
{
  "consent": "{\"source\":\"web_form\",\"evidence\":\"https://example.com/form-export-2026-09\"}",
  "file": "<file: telefono,nombre,correo,plan\n+573001234567,María Gómez,maria.gomez@example.com,prepago\n>",
  "fileHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
  "mapping": "{\"telefono\":\"phoneNumber\",\"nombre\":\"name\",\"correo\":\"email\",\"plan\":\"metadata\"}",
  "metadataKeys": "{\"plan\":\"tipo_plan\"}"
}
```

**Response**

```json
{
  "success": true,
  "data": {
    "imported": 243,
    "skipped": 2,
    "errors": [
      {
        "row": 17,
        "message": "Invalid phone format: +03001234567"
      },
      {
        "row": 88,
        "message": "No phone number, email, or WhatsApp number"
      }
    ]
  }
}
```

**SDK Code**

```python Confirm with mapping and consent
import requests

url = "https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm"

files = { "file": "open('telefono,nombre,correo,plan
+573001234567,María Gómez,maria.gomez@example.com,prepago
', 'rb')" }
payload = {
    "consent": "{\"source\":\"web_form\",\"evidence\":\"https://example.com/form-export-2026-09\"}",
    "fileHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
    "mapping": "{\"telefono\":\"phoneNumber\",\"nombre\":\"name\",\"correo\":\"email\",\"plan\":\"metadata\"}",
    "metadataKeys": "{\"plan\":\"tipo_plan\"}",
    "skipInvalid": 
}
headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, data=payload, files=files, headers=headers)

print(response.json())
```

```javascript Confirm with mapping and consent
const url = 'https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm';
const form = new FormData();
form.append('consent', '{"source":"web_form","evidence":"https://example.com/form-export-2026-09"}');
form.append('file', 'telefono,nombre,correo,plan
+573001234567,María Gómez,maria.gomez@example.com,prepago
');
form.append('fileHash', '9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08');
form.append('mapping', '{"telefono":"phoneNumber","nombre":"name","correo":"email","plan":"metadata"}');
form.append('metadataKeys', '{"plan":"tipo_plan"}');
form.append('skipInvalid', '');

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

options.body = form;

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Confirm with mapping and consent
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"consent\"\r\n\r\n{\"source\":\"web_form\",\"evidence\":\"https://example.com/form-export-2026-09\"}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"telefono,nombre,correo,plan\n+573001234567,María Gómez,maria.gomez@example.com,prepago\n\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"fileHash\"\r\n\r\n9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mapping\"\r\n\r\n{\"telefono\":\"phoneNumber\",\"nombre\":\"name\",\"correo\":\"email\",\"plan\":\"metadata\"}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"metadataKeys\"\r\n\r\n{\"plan\":\"tipo_plan\"}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"skipInvalid\"\r\n\r\n\r\n-----011000010111000001101001--\r\n")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Confirm with mapping and consent
require 'uri'
require 'net/http'

url = URI("https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"consent\"\r\n\r\n{\"source\":\"web_form\",\"evidence\":\"https://example.com/form-export-2026-09\"}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"telefono,nombre,correo,plan\n+573001234567,María Gómez,maria.gomez@example.com,prepago\n\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"fileHash\"\r\n\r\n9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mapping\"\r\n\r\n{\"telefono\":\"phoneNumber\",\"nombre\":\"name\",\"correo\":\"email\",\"plan\":\"metadata\"}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"metadataKeys\"\r\n\r\n{\"plan\":\"tipo_plan\"}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"skipInvalid\"\r\n\r\n\r\n-----011000010111000001101001--\r\n"

response = http.request(request)
puts response.read_body
```

```java Confirm with mapping and consent
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm")
  .header("Authorization", "Bearer <token>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"consent\"\r\n\r\n{\"source\":\"web_form\",\"evidence\":\"https://example.com/form-export-2026-09\"}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"telefono,nombre,correo,plan\n+573001234567,María Gómez,maria.gomez@example.com,prepago\n\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"fileHash\"\r\n\r\n9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mapping\"\r\n\r\n{\"telefono\":\"phoneNumber\",\"nombre\":\"name\",\"correo\":\"email\",\"plan\":\"metadata\"}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"metadataKeys\"\r\n\r\n{\"plan\":\"tipo_plan\"}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"skipInvalid\"\r\n\r\n\r\n-----011000010111000001101001--\r\n")
  .asString();
```

```php Confirm with mapping and consent
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm', [
  'multipart' => [
    [
        'name' => 'consent',
        'contents' => '{"source":"web_form","evidence":"https://example.com/form-export-2026-09"}'
    ],
    [
        'name' => 'file',
        'filename' => 'telefono,nombre,correo,plan
+573001234567,María Gómez,maria.gomez@example.com,prepago
',
        'contents' => null
    ],
    [
        'name' => 'fileHash',
        'contents' => '9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08'
    ],
    [
        'name' => 'mapping',
        'contents' => '{"telefono":"phoneNumber","nombre":"name","correo":"email","plan":"metadata"}'
    ],
    [
        'name' => 'metadataKeys',
        'contents' => '{"plan":"tipo_plan"}'
    ]
  ]
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp Confirm with mapping and consent
using RestSharp;

var client = new RestClient("https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
request.AddParameter("undefined", "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"consent\"\r\n\r\n{\"source\":\"web_form\",\"evidence\":\"https://example.com/form-export-2026-09\"}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"telefono,nombre,correo,plan\n+573001234567,María Gómez,maria.gomez@example.com,prepago\n\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"fileHash\"\r\n\r\n9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mapping\"\r\n\r\n{\"telefono\":\"phoneNumber\",\"nombre\":\"name\",\"correo\":\"email\",\"plan\":\"metadata\"}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"metadataKeys\"\r\n\r\n{\"plan\":\"tipo_plan\"}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"skipInvalid\"\r\n\r\n\r\n-----011000010111000001101001--\r\n", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Confirm with mapping and consent
import Foundation

let headers = ["Authorization": "Bearer <token>"]
let parameters = [
  [
    "name": "consent",
    "value": "{\"source\":\"web_form\",\"evidence\":\"https://example.com/form-export-2026-09\"}"
  ],
  [
    "name": "file",
    "fileName": "telefono,nombre,correo,plan
+573001234567,María Gómez,maria.gomez@example.com,prepago
"
  ],
  [
    "name": "fileHash",
    "value": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
  ],
  [
    "name": "mapping",
    "value": "{\"telefono\":\"phoneNumber\",\"nombre\":\"name\",\"correo\":\"email\",\"plan\":\"metadata\"}"
  ],
  [
    "name": "metadataKeys",
    "value": "{\"plan\":\"tipo_plan\"}"
  ],
  [
    "name": "skipInvalid",
    "value": 
  ]
]

let boundary = "---011000010111000001101001"

var body = ""
var error: NSError? = nil
for param in parameters {
  let paramName = param["name"]!
  body += "--\(boundary)\r\n"
  body += "Content-Disposition:form-data; name=\"\(paramName)\""
  if let filename = param["fileName"] {
    let contentType = param["content-type"]!
    let fileContent = String(contentsOfFile: filename, encoding: String.Encoding.utf8)
    if (error != nil) {
      print(error as Any)
    }
    body += "; filename=\"\(filename)\"\r\n"
    body += "Content-Type: \(contentType)\r\n\r\n"
    body += fileContent
  } else if let paramValue = param["value"] {
    body += "\r\n\r\n\(paramValue)"
  }
}

let request = NSMutableURLRequest(url: NSURL(string: "https://api.jelliu.co/api/campaigns/5b0c8f7e-2f4a-4d7e-9a53-0f6f2f3c1a10/contacts/upload-confirm")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```