API & Integration Guide

Base URL

All API requests are made to:

https://api.econsent.org

The API is served through CloudFront for low-latency global access.

Authentication

All API requests require a Bearer token passed in the Authorization header:

Authorization: Bearer YOUR_API_TOKEN

Generate or rotate your API token from your dashboard under Settings > API Keys.

Verification API

Verify a consent certificate by submitting a phone number or email to confirm a consumer provided consent.

Verify a Certificate

POST https://api.econsent.org/api/events/verify

Request body:

{
  "phone": "+15551234567"
}

Response:

{
  "success": true,
  "certificate": {
    "id": "cert_abc123",
    "url": "https://app.econsent.org/certificate/cert_abc123",
    "created_at": "2025-01-15T14:30:00Z",
    "ip_address": "192.168.1.1",
    "consent_text": "I agree to be contacted...",
    "has_replay": true,
    "hash": "sha256:a1b2c3d4..."
  }
}

Webhooks

Configure webhooks in your dashboard under Channels > Webhooks to receive real-time notifications when new certificates are created.

Webhook Signing

All webhook payloads are signed with HMAC-SHA256. Verify the signature using the X-EConsent-Signature header and your webhook signing secret:

X-EConsent-Signature: sha256=<hmac_signature>

Compare this signature against the HMAC-SHA256 hash of the raw request body using your signing secret. Always validate signatures before processing webhook data.

Webhook Requirements

• Your endpoint must use HTTPS
• Your endpoint must return a 2xx status code within 10 seconds
• Failed deliveries are retried with exponential backoff

Rate Limits

API requests are rate-limited based on your plan:

Full API Documentation

For detailed endpoint references, code examples, and SDK information, visit our full API documentation.

Support

For integration assistance, contact support@econsent.org.