SMS Consent API

Consent is recorded against one specific sending number, so that number has to be registered for A2P messaging first — and registered for the right kind of message.

• Local (10DLC) numbers must be attached to a campaign and show as assigned. Assignment usually completes in about two hours.
• Toll-free numbers must be verified. Verification is reviewed by Telnyx and then the carriers, so allow several days.
• The registered use case matters. Carrier registration authorizes a use case, and sending outside it is what gets a campaign suspended. A number registered for two-factor authentication codes cannot carry marketing, however verified it is. A MIXED campaign only covers the sub-use-cases it declared.

Open a number under Organization → Numbers to see its programme, registered use case, campaign or verification state, and whether it is authorized for marketing. If something is blocking it, that page names the next step.

Create a credential

1. Open Text settings and choose Consent API.
2. Select the sending number, enter a credential name, and enter the website domain. Turn on Create a CRM lead if submissions should also appear in CRM Leads. The credential name is the lead source; you can rename it later.
3. Use the canonical hostname, such as example.com or forms.example.com. We normalize https://www.example.com/ to example.com.
4. Copy the key. You can return to the same settings row to Reveal key, Rotate key, or Revoke it later.

Call this endpoint only from your website's server. Do not put the credential in browser JavaScript or a public form.

curl -X POST https://app.annexorbis.com/api/public/sms/consent \
  -H "Content-Type: application/json" \
  -H "X-AnnexOrbis-Consent-Key: $ANNEXORBIS_SMS_CONSENT_KEY" \
  -d '{
    "phone": "+15551234567",
    "consent_text": "I agree to receive text messages from Example Company.",
    "source_url": "https://example.com/contact",
    "data": {
      "business_name": "Example Company",
      "contact_name": "Jane Doe",
      "email": "jane@example.com"
    }
  }'

phone, consent_text, and source_url are required. source_url must be a page on the credential's approved domain. Store the exact wording your visitor accepted in consent_text.

data is optional JSON captured with the consent receipt. Use it for your form's context, such as business_name, contact_name, and email. It accepts a bounded JSON object (maximum 16 KB, three levels deep); field names use letters, numbers, underscores, or hyphens. If the credential has Create a CRM lead on, those fields also become a CRM lead. The lead source is the credential name. Consent is recorded either way.

The receipt is attached to the exact sending phone number and records the recipient, the consent text you send, the source URL and domain, the user agent, and the time — plus an append-only event log kept for audit. A STOP from the recipient and future send enforcement are also sender-specific.

Consent is recorded per sending number, not per organization. An opt-in to your support line is not an opt-in to your marketing line.

What we cannot verify for you. We store the consent_text your server sends us. We have no way to confirm that wording was actually displayed, or that the checkbox was unchecked by default — so you are warranting both. Make the disclosure visible next to the phone field, leave the box unchecked, and keep the wording you send identical to the wording on screen.

Your organization is responsible for the consent form, disclosure wording, and the lawful basis for sending messages.