Record Lead Consent

Record a lawful basis for contacting a lead on one or more channels, with an evidence pointer. Append-only; the write side of the consent ledger every outbound action already reads.

POST/api/v1/leads/dispatch

Request

curl -X POST "<BASE_URL>/api/v1/leads/dispatch" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "X-CQRS-Action: RECORD_LEAD_CONSENT" \
  -H "Content-Type: application/json" \
  -d '{
    "channels": [
      "EMAIL"
    ],
    "evidence_ref": "string",
    "jurisdiction": {
      "country": "US",
      "subRegion": "string"
    },
    "lead_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7"
  }'

Authorization

Minimum role: Sales repThe caller must hold this role or a higher one.
Action: RECORD_LEAD_CONSENT

Headers

AuthorizationstringRequired
Access token of the signed-in user, as a Bearer token. It identifies the user, their role and the workspace.
X-CQRS-ActionstringRequired
Names the command to run. Must be RECORD_LEAD_CONSENT for this endpoint.
Content-TypestringRequired
Always application/json.
X-Idempotency-KeystringOptional
A key you choose that is unique to this attempt. A command repeated with the same key is not applied a second time.
X-Correlation-IdstringOptional
Your own identifier for the request. Returned in the x-correlation-id response header; generated when you leave it out.

Request body

channelsarray of enumRequired
One grant is written per channel. Empty is refused — a consent record that permits nothing is an audit trail with no subject.
Allowed values
- EMAIL
- SMS
- PHONE
- LINKEDIN
- PROGRAMMATIC_AD
- AI_OUTREACH
- POSTAL
minimum items 1
evidence_refstringRequired
Pointer to the evidence: form submission id, list vendor + contract ref, signed agreement, recorded opt-in. Required, and deliberately not defaulted — "we have consent" without a pointer is an assertion, not a record, and it is the thing a regulator asks to see.
minimum length 1
jurisdictionobjectRequired
No description yet.
2 child fields
- countrystringRequired
  ISO 3166-1 alpha-2 ("US", "DE", "BD").
- subRegionstringRequired
  Sub-region for split regimes ("US-CA", "DE-BY"). Empty = whole country.
lead_iduuidRequired
No description yet.
expires_atdate-time or nullOptional
None = open-ended. Jurisdictions with a fixed consent lifetime should set this so the grant self-expires rather than relying on a cleanup job.

Response

Status 202. The command was applied. The body reports the outcome and, where the command changes a record, that record's new state.

successbooleanRequired
true when the command was applied.
error_messagestringRequired
Empty when the command was applied.
projected_stateobjectOptional
The record as it stands after the command.
event_payloadobjectOptional
The event the command recorded.
insightsarray of objectOptional
Advisory notes about the result. Each has a code, a message and an impact number.

Errors

Every error carries an HTTP status. Where it also carries a code, branch on the code, not on the message.

400X-CQRS-Action is missing or names a command this route does not accept. Send RECORD_LEAD_CONSENT.
400DOMAIN_ROUTINGThe body is not a valid command. Check the required fields and their types.
401The access token is missing, expired or not valid.
401L1_AUTHThe caller's role is below rep or the caller has no access to this record.
403L1_POLICYA business rule refused the command. The message names the rule.
409L1_IDEMPOTENCYA command with this idempotency key was already applied.
409CONFLICTThe command would duplicate a record that must be unique.
500L3_COMMITThe command was valid but could not be saved.