honkio-ca Compliance / DNCL API

openapi: 3.2.0
info:
  title: HonkIO Compliance / DNCL API
  description: 'Canadian-focused SMS gateway API.


    ## Canadian Compliance

    - **CASL**: All commercial messages require consent. Use `/v1/compliance/consents` to record.

    - **DNCL**: CRTC Do Not Call List checking is coming soon (not yet enforced).

    - **PIPEDA / Quebec Law 25**: Data is stored in Canada (ca-central-1). Requests are processed in the United States in transit. Right-to-erasure available.


    ## Authentication

    Provide your API key via `Authorization: Bearer mk_live_...` or `X-API-Key: mk_live_...`.

    Test keys never send, never charge and can''t change live data; they work before your first top-up.


    ## Rate limits

    100 requests per second per account. Every authenticated response carries `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset`.


    ## Pagination

    Shape follows the route family, not one convention across the API: documented here rather than changed. Messages listings return `{ data, meta: { page, limit, total, pages } }`. Contacts, Contact Groups, Lists and Verify listings return `{ data, total, limit, offset }`. Compliance consent and opt-out listings accept `page`/`limit` and return `{ data }`, with no total. Account transactions use a cursor: pass `before`, get back `has_more`.'
  version: 1.0.0
  contact:
    name: HonkIO Support
    email: support@honkio.ca
servers:
- url: https://api.honkio.ca
  description: Production
- url: http://localhost:3000
  description: Local development
security:
- apiKey: []
- apiKeyHeader: []
tags:
- name: Compliance / DNCL
  description: CRTC Do Not Call List lookups (coming soon)
paths:
  /v1/compliance/dncl/check:
    post:
      summary: Check if a phone number is on the CRTC Do Not Call List
      tags:
      - Compliance / DNCL
      description: 'CRTC DNCL checking is coming soon: every call currently answers 501 DNCL_COMING_SOON.


        Requires `compliance:r`.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - phone_number
              properties:
                phone_number:
                  type: string
      security:
      - apiKey: []
      - apiKeyHeader: []
      x-honkio-permission: compliance:r
      responses:
        '200':
          description: The number's DNCL status, once DNCL checking is enabled. Field names are camelCase.
          content:
            application/json:
              schema:
                description: The number's DNCL status, once DNCL checking is enabled. Field names are camelCase.
                type: object
                additionalProperties: true
                required:
                - phoneNumber
                - isRegistered
                - checkedAt
                - fromCache
                properties:
                  phoneNumber:
                    type: string
                  isRegistered:
                    type: boolean
                  checkedAt:
                    type: string
                    format: date-time
                  fromCache:
                    type: boolean
        '401':
          description: Missing, invalid, revoked or expired API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '402':
          description: The account has no balance, or a LIVE key was used before the first top-up.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: The API key lacks the permission this operation requires, or the account is suspended or closed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          description: 'VALIDATION_ERROR: the request failed validation; details names the fields.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: 'Rate limit reached: 100 requests per second per account, or a route-specific limit (Retry-After set where one applies).'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '501':
          description: 'DNCL_COMING_SOON: DNCL checking is not enabled yet.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: postV1ComplianceDnclCheck
      x-operation-id-source: derived
  /v1/compliance/dncl/batch-check:
    post:
      summary: Check multiple numbers against the CRTC DNCL
      tags:
      - Compliance / DNCL
      description: 'CRTC DNCL checking is coming soon: every call currently answers 501 DNCL_COMING_SOON.


        Requires `compliance:r`.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - phone_numbers
              properties:
                phone_numbers:
                  type: array
                  items:
                    type: string
                  maxItems: 100
      security:
      - apiKey: []
      - apiKeyHeader: []
      x-honkio-permission: compliance:r
      responses:
        '200':
          description: Each number's DNCL status, once DNCL checking is enabled.
          content:
            application/json:
              schema:
                description: Each number's DNCL status, once DNCL checking is enabled.
                type: object
                additionalProperties: true
                required:
                - results
                properties:
                  results:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
                      required:
                      - phoneNumber
                      - isRegistered
                      - checkedAt
                      - fromCache
                      properties:
                        phoneNumber:
                          type: string
                        isRegistered:
                          type: boolean
                        checkedAt:
                          type: string
                          format: date-time
                        fromCache:
                          type: boolean
        '401':
          description: Missing, invalid, revoked or expired API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '402':
          description: The account has no balance, or a LIVE key was used before the first top-up.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: The API key lacks the permission this operation requires, or the account is suspended or closed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          description: 'VALIDATION_ERROR: the request failed validation; details names the fields.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: 'Rate limit reached: 100 requests per second per account, or a route-specific limit (Retry-After set where one applies).'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '501':
          description: 'DNCL_COMING_SOON: DNCL checking is not enabled yet.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: postV1ComplianceDnclBatchCheck
      x-operation-id-source: derived
components:
  schemas:
    Error:
      type: object
      description: Standard error body. The one visible exception is the OAuth 2.1 surface (/oauth/token, /oauth/register, /oauth/revoke), which follows RFC 6749/7591/7009 and answers { error, error_description } instead.
      required:
      - code
      - message
      - statusCode
      properties:
        code:
          type: string
          description: Machine-readable error code, e.g. VALIDATION_ERROR.
        message:
          type: string
          description: Human-readable message in the request's locale (Accept-Language).
        messageEn:
          type: string
          description: English message, always present alongside message.
        messageFr:
          type: string
          description: French message, always present alongside message.
        statusCode:
          type: integer
          description: The HTTP status, repeated in the body.
        details:
          description: 'Present on some errors: an AJV validation array, or error-specific structured detail.'
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: API Key
      description: Use `mk_live_...` for production or `mk_test_...` for testing.
    apiKeyHeader:
      type: apiKey
      in: header
      name: X-API-Key
      description: 'Alternative to the Authorization header: send `mk_live_...` or `mk_test_...` as X-API-Key directly.'