# Verdict to evidence

Source: https://docs.usetone.ai/flows/compliance-evidence

> The loop a compliance-only integration runs, and what it can prove afterwards.

If you dial on your own carrier, Tone never sees the call. What it can hold is the
record that you asked before dialling, what it was told, and what happened next —
which is what a complaint is answered with.

| # | Call | What it records |
|---|---|---|
| 1 | `POST /v1/compliance/check` | Five audit rows and a verdict, before you dial |
| 2 | *You dial, on your own carrier* | — |
| 3 | `POST /v1/compliance/call-outcomes` | What happened, tied to the verdict by `checkId` |
| 4 | `GET /v1/compliance/evidence?e164=` | Everything above, assembled |

## 1. Ask

```bash
curl "$TONE_API/v1/compliance/check" -X POST \
  -H "Authorization: Bearer $TONE_KEY" -H 'content-type: application/json' \
  -d '{"e164":"+919876543210","purpose":"promotional"}'
```

`200` either way — a refusal is a verdict, not an error. `allowed` is the answer;
`blockedBy` names the check that stopped it; `checks[]` carries the persisted
rows, each with a citable `id`.

Batch up to 100 with `POST /v1/compliance/check/batch`. Each number runs the full
gate and is metered as its own verdict.

## 2. Dial

Tone is not in this step. The verdict is advisory to your dialer — it does not
stop you, and honouring it is the point of asking.

## 3. Report back

```bash
curl "$TONE_API/v1/compliance/call-outcomes" -X POST \
  -H "Authorization: Bearer $TONE_KEY" -H 'content-type: application/json' \
  -d '{"e164":"+919876543210","outcome":"connected","checkId":"8814",
       "callReference":"acme-crm-4417","durationSeconds":45}'
```

`checkId` is what turns two records into one story. `callReference` is your own
id, echoed back so you can reconcile against your CDR.

🔴 `opt_out` and `complaint` are not labels. They suppress the number through the
same path a mid-call opt-out uses — `opt_out` applies the 90-day lockout,
`complaint` suppresses permanently — and revoke every consent on record in the
same transaction. That is what keeps one suppression list across a mixed estate.

## 4. Prove it

```bash
curl -H "Authorization: Bearer $TONE_KEY" \
  "$TONE_API/v1/compliance/evidence?e164=%2B919876543210"
```

Every check, consent record, suppression entry and reported outcome, with
timestamps and a `truncated` flag that tells you honestly when there was more.

## What this does and does not give you

It gives you a contemporaneous, append-only record that you checked, what you
were told, and what you did — which is the thing you cannot reconstruct after a
complaint arrives.

🔴 It is **not** a safe harbour. TCCCPR liability stays with the sender and the
Principal Entity; there is no statutory protection for having used a vendor. And
the DNC verdict is your own list plus Tone's cross-customer suppression plus
carrier metadata **labelled as such** — not authoritative NCPR scrubbing, which
is not available to telemarketers at all.

Claiming otherwise is the line we will not cross, and neither should you.

## SIP has no pre-dial hook

A `byo_sip` number is dialled by your platform straight to the carrier, so there
is nothing for Tone to intercept. The verdict API *is* your pre-flight; the
carrier CDR, synced back as priced call records, is the evidence.