The API reference isn't available right now
This instance couldn't load its API specification. The reference returns as soon as the specification is readable again.
Back to the API reference
No such operation
This instance documents no operation under that identifier. It may have been renamed, or it may belong to a feature this installation hasn't enabled.
Back to the API reference
This reference may be out of date
This instance couldn't reach its API specification on the last attempt, so this page shows the copy fetched before that. Anything added or changed since then is missing here, and the reference updates itself as soon as the specification is readable again. Last fetched 2026-11-12 05:58 UTC.
API reference
/
Messaging
SMS Consent: records a consent or opt-out transition with its proof-of-consent evidence.
POST
/api/twilio/sms-consent
deprecated
Requires: Twilio.SmsConsent.View, Twilio.SmsConsent.Manage, merchant scope.
Requires API key scope:
admin
(Administration)
Upserts the consent record for the phone number in the caller's merchant scope and appends the
transition to its audit history. Requires the manage permission.
Signed in, you can send this request to your own sandbox merchant from the console
and read the answer.
Sign in to try it .
On this page
Example request
Every block below sends the same request. Replace {{BASE_URL}} with the address of the API you are calling and {{API_KEY}} with your own key.
The request body is a RecordSmsConsentInput. See the Request body section below for its fields.
Code sample language >_
cURL PS
PowerShell TS
TypeScript C#
C# Py
Python
Copythe install command for cURL
Copied
Copy failed
cURL CopycURL
Copied
Copy failed
curl -X POST "{{BASE_URL}}/api/twilio/sms-consent" \
-H "api-key: {{API_KEY}}" \
-H "Content-Type: application/json" \
-d '{
"phoneNumber": ""
}'
Copythe install command for PowerShell
Copied
Copy failed
PowerShell CopyPowerShell
Copied
Copy failed
$headers = @{
'api-key' = '{{API_KEY}}'
}
$body = @'
{
"phoneNumber": ""
}
'@
$response = Invoke-RestMethod -Method POST -Uri '{{BASE_URL}}/api/twilio/sms-consent' `
-Headers $headers -ContentType 'application/json' -Body $bodynpm install @winkpg/winkpg-api
Copythe install command for TypeScript (SDK)
Copied
Copy failed
TypeScript (SDK) CopyTypeScript (SDK)
Copied
Copy failed
import { Configuration, MessagingApi } from '@winkpg/winkpg-api';
const api = new MessagingApi(new Configuration({
basePath: '{{BASE_URL}}',
apiKey: '{{API_KEY}}',
}));
const { data } = await api.smsConsentRecordConsent({
"phoneNumber": ""
});
Copythe install command for TypeScript (raw HTTP)
Copied
Copy failed
TypeScript (raw HTTP) CopyTypeScript (raw HTTP)
Copied
Copy failed
const response = await fetch('{{BASE_URL}}/api/twilio/sms-consent', {
method: 'POST',
headers: {
"api-key": "{{API_KEY}}",
"Content-Type": "application/json",
},
body: JSON.stringify({
"phoneNumber": ""
}),
});
const data = await response.json();dotnet add package WinkPg.Api.Client
Copythe install command for C# (SDK)
Copied
Copy failed
C# (SDK) CopyC# (SDK)
Copied
Copy failed
using WinkPg.Api.Client.Api;
using WinkPg.Api.Client.Client;
using System.Text.Json;
var config = new Configuration { BasePath = "{{BASE_URL}}" };
config.AddApiKey("api-key", "{{API_KEY}}");
var api = new MessagingApi(config);
var body = JsonSerializer.Deserialize<RecordSmsConsentInput>("""
{
"phoneNumber": ""
}
""");
var result = await api.SmsConsentRecordConsentAsync(body);
Copythe install command for C# (raw HTTP)
Copied
Copy failed
C# (raw HTTP) CopyC# (raw HTTP)
Copied
Copy failed
using System.Text;
using var http = new HttpClient { BaseAddress = new Uri("{{BASE_URL}}") };
var request = new HttpRequestMessage(new HttpMethod("POST"), "/api/twilio/sms-consent");
request.Headers.Add("api-key", "{{API_KEY}}");
request.Content = new StringContent("""
{
"phoneNumber": ""
}
""", Encoding.UTF8, "application/json");
var response = await http.SendAsync(request);
response.EnsureSuccessStatusCode();
var json = await response.Content.ReadAsStringAsync();pip install winkpg-api
Copythe install command for Python (SDK)
Copied
Copy failed
Python (SDK) CopyPython (SDK)
Copied
Copy failed
import winkpg_api
configuration = winkpg_api.Configuration(host="{{BASE_URL}}")
configuration.api_key["ApiKey"] = "{{API_KEY}}"
with winkpg_api.ApiClient(configuration) as client:
api = winkpg_api.MessagingApi(client)
body = winkpg_api.RecordSmsConsentInput.from_dict({
"phoneNumber": ""
})
result = api.sms_consent_record_consent(body)pip install requests
Copythe install command for Python (raw HTTP)
Copied
Copy failed
Python (raw HTTP) CopyPython (raw HTTP)
Copied
Copy failed
import requests
headers = {
"api-key": "{{API_KEY}}",
"Content-Type": "application/json",
}
body = {
"phoneNumber": ""
}
response = requests.request(
"POST",
"{{BASE_URL}}/api/twilio/sms-consent",
headers=headers,
json=body,
)
response.raise_for_status()
data = response.json()
Parameters
Name
In
Type
Description
suppressNulls
required
query
boolean
If true, omit properties with null values.
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Request body
application/json
, required
Field
Type
Description
phoneNumber
required
string
Recipient phone number in any common format; normalized to E.164 before persisting.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
status
required
SmsConsentStatus
SmsConsentStatus
The status this transition sets (opted in or opted out).
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
OptedIn
The recipient has expressly consented to receive SMS from this merchant. Sends are allowed. OptedOut
The recipient has revoked consent (STOP keyword, carrier unsubscribe, or an operator action). The send-time gate blocks every SMS to this number for this merchant until a re-opt-in is recorded.
captureMethod
required
SmsConsentCaptureMethod
SmsConsentCaptureMethod
How the evidence for this transition was captured.
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Unknown
Capture method was not supplied. Treated as the least-authoritative evidence. WebForm
Recipient opted in through a public web form (e.g. a hosted checkout consent checkbox). VirtualTerminal
An operator captured consent while taking the payment in the Virtual Terminal. HostedPaymentPage
Consent was captured on a Hosted Payment Page flow. Import
The record was created from a bulk import of prior consent evidence. ApiRequest
Consent or opt-out was recorded through the API by an integrating system. AdminEntry
An administrator recorded the consent or opt-out manually. CarrierBackfill
Opt-out was back-filled from a carrier send-time signal (Twilio error 21610 on send). The platform learned of the revocation from the carrier rather than capturing it directly. Inbound STOP / START replies use InboundKeyword instead, which keeps a more precise evidence trail. InboundKeyword
Consent transition was captured from an inbound SMS keyword the recipient texted to the platform number (STOP / UNSUBSCRIBE / START / etc.), received on the Twilio inbound webhook. The inbound message SID is retained as the evidence reference.
evidenceText
required
string
Free-text proof-of-consent evidence (consent language shown, keyword received, operator note).
nullable max length 2000
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
evidenceReference
required
string
Stable reference to the transition source (flow id, form URL, message SID, import batch).
nullable max length 512
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
merchantId
required
string (uuid)
Merchant the consent is scoped to. Honoured only when the caller holds
`SmsConsent.ViewAllMerchants`; otherwise the caller's own merchant is used. Consent never transfers across merchants.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
This request body has no documented fields.
Responses
Response status
200
OK
OK
Body:
SmsConsentDto
SmsConsentDto
Each item has these fields.
Field
Type
Description
id
required
string (uuid)
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
phoneNumber
required
string
Canonical E.164 phone number this record governs.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
tenantId
required
string (uuid)
Tenant the record belongs to.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
merchantId
required
string (uuid)
Merchant the record is scoped to.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
status
required
SmsConsentStatus
SmsConsentStatus
Current consent state.
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
OptedIn
The recipient has expressly consented to receive SMS from this merchant. Sends are allowed. OptedOut
The recipient has revoked consent (STOP keyword, carrier unsubscribe, or an operator action). The send-time gate blocks every SMS to this number for this merchant until a re-opt-in is recorded.
captureMethod
required
SmsConsentCaptureMethod
SmsConsentCaptureMethod
How the most recent transition's evidence was captured.
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Unknown
Capture method was not supplied. Treated as the least-authoritative evidence. WebForm
Recipient opted in through a public web form (e.g. a hosted checkout consent checkbox). VirtualTerminal
An operator captured consent while taking the payment in the Virtual Terminal. HostedPaymentPage
Consent was captured on a Hosted Payment Page flow. Import
The record was created from a bulk import of prior consent evidence. ApiRequest
Consent or opt-out was recorded through the API by an integrating system. AdminEntry
An administrator recorded the consent or opt-out manually. CarrierBackfill
Opt-out was back-filled from a carrier send-time signal (Twilio error 21610 on send). The platform learned of the revocation from the carrier rather than capturing it directly. Inbound STOP / START replies use InboundKeyword instead, which keeps a more precise evidence trail. InboundKeyword
Consent transition was captured from an inbound SMS keyword the recipient texted to the platform number (STOP / UNSUBSCRIBE / START / etc.), received on the Twilio inbound webhook. The inbound message SID is retained as the evidence reference.
statusChangedAt
required
string (date-time)
When the current status was last set (UTC).
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
evidenceText
required
string
Proof-of-consent evidence for the current status.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
evidenceReference
required
string
Stable reference for the current status's source.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
history
required
array of SmsConsentHistoryEntryDto
array of SmsConsentHistoryEntryDto
Append-only audit trail of every status transition, oldest first.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Fields of each SmsConsentHistoryEntryDto:
Field
Type
Description
status
required
SmsConsentStatus
SmsConsentStatus
The status this transition moved the record to.
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
OptedIn
The recipient has expressly consented to receive SMS from this merchant. Sends are allowed. OptedOut
The recipient has revoked consent (STOP keyword, carrier unsubscribe, or an operator action). The send-time gate blocks every SMS to this number for this merchant until a re-opt-in is recorded.
captureMethod
required
SmsConsentCaptureMethod
SmsConsentCaptureMethod
How this transition's evidence was captured.
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Unknown
Capture method was not supplied. Treated as the least-authoritative evidence. WebForm
Recipient opted in through a public web form (e.g. a hosted checkout consent checkbox). VirtualTerminal
An operator captured consent while taking the payment in the Virtual Terminal. HostedPaymentPage
Consent was captured on a Hosted Payment Page flow. Import
The record was created from a bulk import of prior consent evidence. ApiRequest
Consent or opt-out was recorded through the API by an integrating system. AdminEntry
An administrator recorded the consent or opt-out manually. CarrierBackfill
Opt-out was back-filled from a carrier send-time signal (Twilio error 21610 on send). The platform learned of the revocation from the carrier rather than capturing it directly. Inbound STOP / START replies use InboundKeyword instead, which keeps a more precise evidence trail. InboundKeyword
Consent transition was captured from an inbound SMS keyword the recipient texted to the platform number (STOP / UNSUBSCRIBE / START / etc.), received on the Twilio inbound webhook. The inbound message SID is retained as the evidence reference.
occurredAt
required
string (date-time)
When the transition occurred (UTC).
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
evidenceText
required
string
Proof-of-consent evidence for this transition.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
evidenceReference
required
string
Stable reference tying this transition to its source.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
This body has no documented fields.
This response has no documented body fields.
429
Too Many Requests
The request was refused because a rate limit was exceeded, or because something a later retry can clear stopped it. A rate limit refusal carries an `application/problem+json` body: wait at least the interval `Retry-After` names before retrying, then back off. Limits are tuned per deployment, so read the allowance from the response headers rather than assuming a fixed ceiling. Any other refusal carries the standard error envelope as `application/json`, and its `error.code` names the cause.
Body:
RemoteServiceErrorResponse
RemoteServiceErrorResponse
Each item has these fields.
Field
Type
Description
error
required
RemoteServiceErrorInfo
RemoteServiceErrorInfo
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
This response has no documented body fields.
Errors
400 401 403 404 500 501 default
400
Bad Request
Bad request. The request was malformed or failed validation. When validation rejected it, `error.validationErrors` names each member at fault and why. 401
Unauthorized
Unauthorized. The request carried no API key or signed-in session, or the key it carried is invalid, revoked or expired. 403
Forbidden
Forbidden. The API key lacks the scope this operation needs, the signed-in user lacks the permission, or a business rule refused the request. The error code in the body names the reason. 404
Not Found
Not found. The resource the request names does not exist or is not visible to the caller: a resource that belongs to a merchant or tenant outside the caller's scope is reported as not found. 500
Internal Server Error
Internal server error. The platform failed unexpectedly while handling the request. If it keeps failing, contact support and quote the correlation id, which the response carries in the `X-Correlation-Id` header and as `error.data.correlationId`. 501
Not Implemented
Not implemented. The operation is declared but has no implementation on this deployment, so no request to it can succeed. Retrying does not help. default
The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. The error reference lists the values `error.code` can take. The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. The error reference lists the values `error.code` can take.
Body:
RemoteServiceErrorResponse
RemoteServiceErrorResponse
Each item has these fields.
Field
Type
Description
error
required
RemoteServiceErrorInfo
RemoteServiceErrorInfo
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Fields of RemoteServiceErrorInfo:
Field
Type
Description
code
required
string
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
message
required
string
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
details
required
string
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
data
required
object
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
validationErrors
required
array of RemoteServiceValidationErrorInfo
array of RemoteServiceValidationErrorInfo
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
This body has no documented fields.
This response has no documented body fields.
Errors
A failed request returns the platform error envelope. The
error reference lists every value
error.code can carry and shows the four response shapes.
Codes declared by
Next steps