TCPA Consent Certificate API - Lead Verification Data

Check the consent certificate behind a lead before you call it. One flat row per certificate, carrying the proof, the contradictions and the session behind both.

What this actor does

• Answers the question you actually have about a lead: may I call this person. The provider computes one overall outcome across every check it ran, and its own guidance is to base the purchase decision on that value. It is the first column in the dataset, with the reason next to it.
• Catches the lead whose details do not match its own certificate. Lead matching tests the email and the phone number the lead arrived with against the ones recorded during the session. A mismatch means the certificate is real but belongs to somebody else, which is the single most useful signal a certificate carries and the one a spot check never finds.
• Reads the consent language, not just its presence. Verification checks whether the wording was approved, whether it named your advertiser in a one-to-one manner, whether the opt-in was a real tick rather than a pre-selected box, and whether the text was large enough and contrasted enough to be read at all.
• Scans the page for what must and must not be there. Give it the disclosure you require and the incentive words you forbid, and each certificate reports which terms were found and which were missing, case and whitespace insensitive.
• Returns the session, not a verdict alone. Page URL, parent page when framed, domain, approximate location from the IP, browser, operating system, time on page, keystrokes per minute and the provider's own bot determination all come back as ordinary columns you can sort and filter.
• Never reads "we did not check" as "it failed". An operation that was not asked for writes null rather than false. That distinction matters when the column is going to be evidence.
• Treats an expired certificate as an answer, not an error. Certificates age out, and a list of a thousand will contain some that have. Those become rows carrying the reason, and the run keeps going.
• Keeps the one operation that writes behind an explicit switch. Retaining a certificate stores it against your account at the provider's price. It is off unless you ask for it, and the run says so in the log when you do.
• Charges nothing for a miss. Only certificates the provider actually answered for are billed.

Input

Field	What it does
certificates	Certificate URLs or ids, one per line. A URL is reduced to its id for you.
leads	One object per lead: certificate plus email, phone, reference, vendor, campaignId.
operations	Insights, match lead, verify, retain.
apiKey	Your own API key.
insightsProperties	Which session data points to ask for. Empty means all.
scanRequired / scanForbidden	Text that must and must not appear on the page.
scanDelimiter	Delimiter wrapping wildcards inside a scan term.
advertiserName	Legal entity name for the one-to-one consent check.
minFontSizePx / minContrastRatio	Readability thresholds for the consent language.
optInTypesAllowed	Manual, pre-selected, non-interactive.
matchEmail / matchPhone	Contact details to test against every certificate in the plain list.
retainVendor / retainReference / retainCampaignId	Recorded on your copy when retaining.
onlySuccessfulOutcome	Keep only certificates whose overall outcome succeeded.
onlyMatchedLeads	Keep only leads whose contact details matched.
onlyApprovedConsent	Keep only certificates that passed the consent checks.
excludeBotDetected	Drop traffic flagged as non-human.
minSecondsOnPage	Drop sessions shorter than this.
skipNotFound	Leave misses out of the dataset.
maxResults	Row ceiling, and therefore the cost ceiling.
requestsPerMinute	Pacing.

Example output

{
  "certificateId": "eb9fc4dd9bed9ad451a5648946cf4bf09b5bb947",
  "certificateUrl": "https://cert.trustedform.com/eb9fc4dd9bed9ad451a5648946cf4bf09b5bb947",
  "found": true,
  "outcome": "success",
  "outcomeReason": null,
  "matchLeadRequested": true,
  "matchLeadRan": true,
  "matchLeadSuccess": true,
  "emailMatch": true,
  "phoneMatch": false,
  "verifyRequested": true,
  "verifySuccess": true,
  "languageApproved": true,
  "oneToOneConsent": true,
  "optInTypesSatisfied": true,
  "consentLanguages": ["By clicking on the 'Get Rates' button below, I consent to be contacted"],
  "advertiserName": "Acme Inc.",
  "pageUrl": "https://www.example.com/contact.html",
  "domain": "example.com",
  "createdAt": "2024-09-18T17:07:09Z",
  "expiresAt": "2024-12-20T17:07:09Z",
  "secondsOnPage": 1129,
  "botDetected": false,
  "isFramed": false,
  "isMasked": false,
  "formInputMethod": ["typing"],
  "formInputKpm": 234.93,
  "ip": "192.168.0.1",
  "geoCity": "Dallas",
  "geoState": "Texas",
  "geoCountryCode": "US",
  "geoTimeZone": "America/Chicago",
  "browserName": "Chrome",
  "browserVersion": "128.0.0.0",
  "osName": "Mac OS X",
  "osIsMobile": false,
  "scanSuccess": false,
  "requiredTermsFound": [],
  "requiredTermsMissing": ["offer"]
}

FAQ

What is a consent certificate?

A consent certificate is a record of the web session in which somebody submitted a form. It captures the page they were on, the wording they were shown, how they filled the form in, roughly where they were and what they were using, and it is addressed by its own URL. When a lead is bought or sold, that URL travels with it as the evidence that consent was given.

Why does the certificate need checking at all if the lead came with one?

Because a certificate proves that a session happened, not that it was this person's session. The certificate can be perfectly valid and still be attached to a different lead, which is why lead matching exists: it tests the email address and phone number on the lead against the ones recorded during the session. A certificate that does not match the lead it arrived with is the clearest sign available that the lead should not be contacted.

What is one-to-one consent?

One-to-one consent means the consumer agreed to be contacted by one named business rather than by an unspecified list of partners. The verify operation compares the consent wording on the page against the advertiser legal name you supply, normalising case, spacing and punctuation before it compares. Without an advertiser name the check cannot run and the column comes back empty rather than false.

What does the bot detection actually look at?

The provider derives it from the recorded session events using its own algorithms, and reports a single determination of whether those events were likely produced by a non-human. This actor returns it alongside the raw signals that inform the same judgement: seconds on page, keystrokes per minute, words per minute and how the fields were filled in, so you can set your own threshold instead of relying only on the flag.

What happens to certificates that have expired?

They come back as rows with the reason and are not charged for. Certificates have an expiry date, and any real list will contain some that have passed it. Sandboxed certificates, malformed ids and operations your account is not contracted for behave the same way: the run records them and moves on rather than stopping.

Does this actor cost anything at the provider?

Yes. This is a bring-your-own-key actor, so calls are made against your own account and billed by the provider on their own terms. Only the data points actually returned are charged for on their side. On this side you are charged per row saved, and never for a miss.

Which operation changes something?

Retain, and only retain. It stores the certificate against your account so it stays available after it would otherwise have expired, and that is a purchase. The other three operations read. Retain is off by default and the run logs a warning when it is switched on.

Can I run this without an API key?

No, and the actor will tell you so rather than failing. Every call is made with your own account's key, which you paste into the API key field or set as a secret. The key is never written to the dataset or shared between runs.

Keyword map

TCPA consent certificate API, lead consent verification, one-to-one consent check, lead certificate insights API, consent language verification, lead matching API, TCPA compliance data, certificate claim API, lead authenticity check, bot detection on lead forms, session replay metadata API, page scan consent proof, lead buyer verification, consent proof automation.