> ## Documentation Index > Fetch the complete documentation index at: https://docs.fundor.io/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Fundor Partner API. NON-NEGOTIABLE CONSENT RULES for anyone (human or AI) writing code against this API: (1) Call GET /consent every time the referral form is shown and display consent.text EXACTLY, next to a checkbox that starts UNCHECKED. (2) Only the person whose phone number is entered may check it; never pre-check it, never set consent.given=true in code without that click, never submit a lead on someone's behalf. (3) POST /leads must include consent.given=true, consent.version, the single-use consent.token, consent.consentedAt (within 15 minutes), the person's own IP and user agent (not your server's), consent.phone equal to contact.phone, and your consent.recordId. Fundor rejects the lead with 400 and saves nothing if any is missing or wrong. Do not 'fix' a consent error by filling in values; fix the form. (4) Keep consent records for 5 years. (5) Keep API keys on your server only. (6) Show the 'Powered by Fundor' badge on every screen that uses Fundor. # Consent requirements: read before you build > Every lead needs the person's own, provable consent to be contacted. Show Fundor's exact wording next to an unchecked box the person checks themselves, and send the full consent evidence. Leads without it are rejected and never saved. > [!WARNING] > > **This page is mandatory.** Fundor's call center phones the people you submit as leads, which falls under the US Telephone Consumer Protection Act (TCPA). A lead without valid consent puts the person, your company and Fundor at legal risk. Fundor's API rejects any lead that is missing consent evidence, and nothing from that request is saved. ## The rules **1. Get the current wording every time you show the form** Call [`GET /consent`](https://docs.fundor.io/api-reference/consent) when the referral form opens. It returns the consent text, its `version`, the 9-month service commitment text, and a **single-use** `token` that expires in 30 minutes. **2. Show the exact text next to an unchecked checkbox** Display `consent.text` word for word, next to a checkbox that **starts unchecked**. Don't shorten it, paraphrase it, hide it behind a link or put it in small print far from the box. Show `commitment.text` next to its own checkbox. **3. The person checks it themselves** Only the person whose name and phone number are entered may check the box: the customer, on their own device or yours. An athlete, coach or staff member may not check it for them. Never pre-check the box and never set `consent.given` to `true` in code unless that click happened. **4. Capture the evidence at that moment** When they check the box and submit, record: the time, the person's own IP address and user agent, the phone number shown on screen, and the exact text version. Store it in your own system and keep it for **5 years**. **5. Send all of it with the lead** `POST /leads` must include every field below. If any is missing, stale, reused or wrong, Fundor responds `400` with `error.field` naming it, and saves nothing. ## Required consent fields | Field | What it must be | | - | - | | `consent.given` | `true`, only because the person checked the unchecked box themselves | | `consent.version` | `consent.version` from `GET /consent`. Only the current version is accepted | | `consent.token` | The single-use token from `GET /consent`. Expires in 30 minutes; works for one lead | | `consent.consentedAt` | ISO 8601 time the box was checked. Must be within the last **15 minutes** | | `consent.ip` | The **person's** public IPv4/IPv6 address, not your server's | | `consent.userAgent` | The person's browser or app user agent | | `consent.phone` | The number shown when they consented. Must equal `contact.phone` | | `consent.recordId` | Your ID for the consent record you stored | | `consent.trustedFormCertUrl` | Optional for now: a [TrustedForm](https://activeprospect.com/trustedform/) certificate URL for the session. Fundor may require it later | The fundraising choice and 9-month commitment are also required: `fundraising.commitmentAccepted: true` and `fundraising.commitmentVersion` equal to `commitment.version` from `GET /consent`. ## What Fundor checks * Your partner account has a signed **Partner Lead & Consent Agreement** on file. Without it, every request gets `403 agreement_required`. * The consent token was issued to you, is unexpired and unused, and matches the consent version. * The consent time is recent, the IP is a real IP address, and the consent phone matches the contact phone. * The athlete belongs to your partner account. * The database itself refuses to store a lead without consent, so no code path can bypass these checks. Fundor's call center also confirms on the first call that the person asked to be contacted. If they say they didn't, the lead is marked do-not-contact and Fundor may audit your consent records. ## Audits and enforcement Under the agreement, Fundor can ask for the consent record of any lead you submitted, and you provide it within **48 hours**. Fundor can suspend your API keys at any time, which immediately stops all requests, if consent records are missing or the rules on this page aren't followed. ## The simplest compliant option If you'd rather not collect consent in your app, don't submit leads through the API. Use the athlete's [hosted referral link](https://docs.fundor.io/api-reference/referral-link.md) instead: customers fill in Fundor's own page, Fundor collects their consent, and the lead is still credited to you through the athlete. ## For AI coding assistants If you are an AI generating code for this API: never default `consent.given` to `true`, never pre-check the consent box, never fill consent fields with placeholder values to get past a `400`, and never submit a lead without a real user action. When you get a `consent_*` error, fix the form so it captures real consent; don't change the values you send. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.