Consent Management: Vendor Instructions

Chaya David
  • Updated
Follow

Overview

Fullpath's Consent Management Platform maintains a single source of truth for dealership communication-consent data — including whether a contact has opted in or out of email, SMS, and phone-call communication. As an integrated vendor, you connect to that record in two directions:

  • Read — look up the current consent status Fullpath holds for a contact at a given dealership.
  • Write — report opt-ins and opt-outs captured in your system, so the dealership's record stays current.

You integrate once. The same endpoints serve every dealership you work with, as soon as that dealership requests a connection with you.

Requirement: Onboarding must be complete before you begin — your legal agreements need to be signed and you need to have received your API key via the secure link Fullpath sends. See Consent Management: Vendor Instructions for the full onboarding process.

 

Before You Start

  • Confirm your API key is stored securely and available to your integration.
  • Every request sends your key as Authorization: Bearer <api_key>.

Getting connected, at a glance:

  1. Find your dealerships and their client keys.
  2. Look up current consent for a contact.
  3. Send consent updates captured in your system.

 

Step 1 — Find Your Dealerships

Call GET /dealers to retrieve the dealerships integrated with your vendor account. For each dealership, you receive its name, its unique client_key, and the status of the integration (pending or connected).

Note: When a dealership requests an integration with you, this is where you'll find the client_key you'll use to query and update consent for that specific dealer.

 

Step 2 — Look Up Consent for a Contact

Call GET /{contact_type}/consent with the contact's email address or phone number and the dealership's client_key. You get back the normalized contact value, whether the contact is opted in or out, and when that consent was recorded.

Note: If Fullpath has no record for the contact, you still receive a successful response with null values rather than an error.

 

Step 3 — Send Consent Updates

Call POST /{contact_type}/consents to submit opt-in and opt-out events captured in your system — from a single contact up to 500 contacts per request. Each entry carries the contact value, the opt-in/opt-out flag, and the timestamp of when the consent event occurred.

 

What Happens After You Send an Update

Every update you send is stored in Fullpath's CDP and becomes part of the dealership's single source of truth. The dealership can see all of the changes inside their Fullpath dashboard and track updates arriving from your integration alongside every other integrated vendor.

 

Quick Reference

Endpoint Purpose Key inputs
GET /dealers List your integrated dealerships, their client keys, and integration status. —
GET /{contact_type}/consent Look up the current consent status for one contact at one dealership. contact_value, client_key
POST /{contact_type}/consents Store consent updates (opt-ins / opt-outs) for up to 500 contacts at one dealership. client_key, contacts[]

 

Good to Know

  • Contact types: Consent is tracked per channel. The contact_type in the URL path is one of email, phone_sms, or phone_call.
     
  • Normalization: Contact values are normalized server-side. Emails are lowercased and phone numbers are standardized before lookup and storage, so formatting differences on your side won't create duplicate records.
     
  • Rate limits: 100 requests per minute per API key. For bulk submissions, batch contacts into the POST endpoint (up to 500 per request) rather than sending one request per contact.
     
  • Key rotation: API keys are valid for 180 days. You'll receive an email reminder two weeks before expiry with details on how to rotate.
     
Tip: For the full technical specification — parameters, schemas, examples, and error responses — see the Consent Management API reference documentation.

 

Learn More