Compliance

Saperly bakes TCPA compliance in. Consent, disclosures, and 10DLC registration are first-class objects enforced independently of any LLM — so a misbehaving model (or a model you swap out) can never route around them. Outbound voice or SMS to a peer without recorded consent is rejected before it goes out.

Base URL https://api.saperly.com. Authenticate with Authorization: Bearer sk_live_...; the workspace is resolved from the token.

Consent

Consent is recorded per (number, peer) pair: a ConsentRecord says this Saperly number has consent to contact that peer number. Saperly checks it automatically on every outbound message and call.

Consent types

Endpoints

The ConsentRecord shape

Worked flow: check, record, then contact

Always check consent before initiating outbound contact, record explicit_outbound consent when the peer opts in, then send. The source label is your audit trail — make it describe how consent was obtained.

# 1. Check before contacting
curl "https://api.saperly.com/consent/check?numberId=num_...&peerNumber=%2B15555550123" \
  -H "Authorization: Bearer $SAPERLY_API_KEY"
# -> { "hasConsent": false }

# 2. The peer opts in — record explicit outbound consent
curl -X POST https://api.saperly.com/consent \
  -H "Authorization: Bearer $SAPERLY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "numberId": "num_...",
    "peerNumber": "+15555550123",
    "consentType": "explicit_outbound",
    "source": "sms_optin"
  }'

# 3. Now the send/call is allowed (see Messaging / Voice)

import { Saperly } from '@saperly/sdk'

const saperly = new Saperly({ apiKey: process.env.SAPERLY_API_KEY! })

// 1. Check
const { hasConsent } = await saperly.consent.check({
  numberId: 'num_...',
  peerNumber: '+15555550123',
})

// 2. Record on opt-in
if (!hasConsent) {
  await saperly.consent.record({
    numberId: 'num_...',
    peerNumber: '+15555550123',
    consentType: 'explicit_outbound',
    source: 'sms_optin',
  })
}

// 3. Now send — see Messaging
await saperly.messages.send({
  fromNumberId: 'num_...',
  to: '+15555550123',
  body: 'Thanks for opting in!',
})

Revoking consent

POST /consent/revoke with { numberId, peerNumber } sets revokedAt and stops further outbound contact. Two things revoke consent without an explicit call:

• STOP — an inbound SMS with the STOP keyword automatically revokes the sender's consent. Subsequent outbound sends to that number are blocked.
• HELP — an inbound HELP keyword is logged (it does not change consent).

curl -X POST https://api.saperly.com/consent/revoke \
  -H "Authorization: Bearer $SAPERLY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "numberId": "num_...", "peerNumber": "+15555550123" }'

Disclosures

A disclosure is the AI notice spoken at the start of a call so the caller is told they are talking to an AI. It lives on the connection, not as a separate resource: each connection has complianceEnabled (a boolean, on by default) and a disclosure string. When compliance is on, the disclosure is spoken as the line's first, uninterruptible utterance — the TCPA notice — before the agent takes a turn, across every mode (hosted, manual, and OpenAI-realtime).

// The disclosure is a field on the connection — set it when you create or update one
await saperly.connections.create({
  name: 'support line',
  instructions: 'You are a friendly support agent for Acme Inc.',
  complianceEnabled: true,
  disclosure: 'You are speaking with an AI assistant for Acme.',
})

Leave disclosure empty with complianceEnabled on and Saperly fills a standard, org-named default so the line is never silently non-disclosing. Set complianceEnabled to false and there is no forced opener. When a recorded disclosure is the basis for contact, record it as a consent source (e.g. "call_recording_disclosure") so the provenance is captured in your audit trail.

10DLC

10DLC is the US carrier registration that certifies an application-to-person (A2P) SMS campaign. Registering a brand and campaign is what lets your US SMS deliver reliably instead of being filtered. Saperly tracks the registration and advances its status as carrier webhooks arrive.

Campaign status

The TenDlcCampaign shape

Registering a campaign

Register with { useCase, description }. The campaign starts pending; the final status arrives by webhook — listen for 10dlc status events rather than polling.

{
  "useCase": "customer_care",
  "description": "Appointment reminders and support replies for Acme Clinic."
}

Related

• Messaging — SMS sends; consent is enforced on every outbound message.
• Voice — outbound calls; consent is enforced before the call starts.
• Webhooks — receive STOP/HELP, delivery receipts, and 10DLC status events.
• Core concepts — where compliance sits in the Saperly model.
• API reference — every consent endpoint with a try-it playground.