---
title: "Record consent for marketing calls"
method: POST
path: "/call-consents"
tags: ["Calls"]
---

# Record consent for marketing calls

`POST /call-consents`

## Request

- Base URL: `https://api.hypamoon.com/api/v1`
- URL: `https://api.hypamoon.com/api/v1/call-consents`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://app.hypamoon.com/oauth/authorize`, token URL `https://api.hypamoon.com/oauth/token`, scopes: `calls:write`)

Records that one person agreed to receive marketing calls from this project, so POST /calls with purpose marketing may call them. Under Dutch telemarketing rules a sales or promotional call to a consumer needs prior consent; since 1 July 2026 that also applies to existing customers. source says where it came from (form, call, import, manual) and evidence is your reference to the proof (a form entry id, a call id, a file and row), so it can be shown later. Record only consent the person really gave. The number is stored only as a keyed hash plus its last two digits. If valid consent for this number already exists, it is returned unchanged with 200. Only the project owner, or an API key with calls:write, can record consent.

## Request body

- CallConsentInput: Consent from one person to receive marketing calls from this project.
  - `phone_number` string, required: The number of the person who gave consent, in E.164. Stored only as a keyed hash plus its last two digits.
  - `source` 'form' | 'call' | 'import' | 'manual', required: Where the consent came from: form (a form the person filled in), call (they said yes on a call), import (from your own records), manual (recorded by hand).
  - `evidence` string, required: A reference to the proof, so it can be shown later: a form entry id, a call id, a file and row, or a short note. Not the proof itself and no other personal data.
  - `consented_at` string, date-time: When the person gave consent (ISO 8601). Default: now. Cannot be in the future.

## Response `200`

Valid consent for this number already existed; it is returned unchanged.

- CallConsent: Recorded consent from one person to receive marketing calls from this project.
  - `id` string, uuid, required: The id of the consent.
  - `phone_number_ending` string, required: The last two digits of the number. The number itself is never stored, only a keyed hash.
  - `source` 'form' | 'call' | 'import' | 'manual', required: Where the consent came from: form, call, import or manual.
  - `evidence` string, required: Your reference to the proof.
  - `consented_at` string, date-time, required: When the person gave consent.
  - `recorded_at` string, date-time, required: When it was recorded here.
  - `revoked_at` string, date-time, nullable, required: When it was revoked; null while it is valid.
  - `status` 'active' | 'revoked', required: active: marketing calls to this number are allowed. revoked: no longer.

## Other responses

- `201`: Recorded.
- `400`: Bad Request: invalid_json.
- `401`: Unauthorized: unauthorized, missing_api_key, invalid_api_key, api_key_revoked, project_deleted.
- `403`: Forbidden: project_not_enabled, key_mode_mismatch, missing_scope, verification_required, forbidden.
- `422`: Unprocessable Content: validation_failed.
- `429`: Too Many Requests: rate_limited.
- `500`: Internal Server Error: internal_error.
- `503`: Service Unavailable: service_unavailable.

---

[API](https://skmtc.dev/hypamoon/apis/hypamoon-api.md) · [All operations](https://skmtc.dev/hypamoon/apis/hypamoon-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hypamoon/apis/hypamoon-api/revisions/9f0b90004c06?raw)