Getting started with creating a brand

The base URL for all endpoints is https://compliance.api.sinch.com (production server; data is processed and stored within Europe).

All API endpoints described below require authentication. You can authenticate your requests using one of the following two methods for the Authorization header:

    Bearer Token:
    Authorization: Bearer <YourAccessToken>

    Basic Authentication:
    Authorization: Basic <YourBase64EncodedCredentials>

Bearer tokens are obtained through the OAuth 2.0 client credentials flow. The username and password used to request the token are your Key ID and Key Secret from the Access keys section in the Sinch Customer Dashboard. Request the access token from https://auth.sinch.com/oauth2/token and send it on every subsequent call:

curl --location --request POST 'https://auth.sinch.com/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--user '<YourKeyId>:<YourKeySecret>' \
--data-urlencode 'grant_type=client_credentials'

Read operations require the read scope; create, update, delete and other write operations require the write scope. The examples in this document use Bearer tokens, but every request can equally be authenticated with Basic authentication.

Webhook deliveries sent by Sinch are authenticated separately, with an HMAC signature in the X-Sinch-Signature header (see Callback Event Reception).

Create Brand

Creates a new brand in DRAFT status for the specified project. Draft brands are editable and are not validated against process-specific rules until a Brand Order is created. All fields relevant to the intended registration process should be populated before submitting an order.

The only field required by the schema is displayName (unique per projectId and market code). Every other field becomes required depending on the registration process you intend to order. The optional contentProvider flag indicates whether the brand is a Content Provider or a standard Brand, which determines the order types available to it; it cannot be changed after creation.

Note: The Idempotency-Key header is not supported in this version. Submitting the same request twice may create duplicate resources — deduplicate on your side.

Request

curl --location --request POST 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <YourAccessToken>' \
--data-raw '{
  "displayName": "Acme Corp",
  "legalCompanyName": "Acme Corporation",
  "entityType": "CORPORATION",
  "verticalType": "TECHNOLOGY",
  "programType": "STANDARD",
  "website": "https://www.acmecorp.com",
  "companyEmail": "contact@acmecorp.com",
  "country": "US",
  "street": "123 Main Street",
  "city": "New York",
  "state": "New York",
  "stateCode": "NY",
  "zip": "10001",
  "taxCountry": "US",
  "federalTaxId": "123456789",
  "contactEmail": "contact@acmecorp.com",
  "contentProvider": false
}'

Response — 201 Created

{
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "displayName": "Acme Corp",
  "status": "DRAFT",
  "legalCompanyName": "Acme Corporation",
  "entityType": "CORPORATION",
  "verticalType": "TECHNOLOGY",
  "programType": "STANDARD",
  "website": "https://www.acmecorp.com",
  "companyEmail": "contact@acmecorp.com",
  "country": "US",
  "street": "123 Main Street",
  "city": "New York",
  "state": "New York",
  "stateCode": "NY",
  "zip": "10001",
  "taxCountry": "US",
  "federalTaxId": "123456789",
  "contactEmail": "contact@acmecorp.com",
  "contentProvider": false,
  "attachments": [],
  "logs": [],
  "channels": [],
  "createTime": "2025-10-14T10:58:27.095235Z",
  "updateTime": "2025-10-14T10:58:27.095235Z"
}

List Brands

Returns a paginated list of brands for the specified project. You can filter by status (repeat the parameter to filter by several statuses), displayName, channelName, or contentProvider, and order the results with sort. Sortable fields are displayName, status, createTime and updateTime, using a comma-separated list with an optional :asc / :desc suffix (ascending by default).

Pagination: use pageSize (default 20, maximum 100) and pageToken. The response carries the link to the following page in links.next, and the total number of matching resources in meta.totalCount. The same link is also returned in the RFC 8288 Link response header with rel="next". The absence of a next link means you reached the last page.

Request

curl --location 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands?status=DRAFT&sort=createTime:desc&pageSize=20' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

{
  "brands": [
    {
      "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
      "displayName": "Acme Corp",
      "status": "DRAFT",
      "channels": [],
      "createTime": "2025-10-14T10:58:27.095235Z",
      "updateTime": "2025-10-14T10:58:27.095235Z"
    }
  ],
  "links": {
    "next": "https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands?pageToken=eyJsYXN0SWQiOiJiMWM3Y2NiZiJ9"
  },
  "meta": {
    "totalCount": 42
  }
}

Get Brand

Retrieves the full details of a specific brand by its brandId.

Request

curl --location 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

{
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "displayName": "Acme Corp",
  "status": "DRAFT",
  "legalCompanyName": "Acme Corporation",
  "entityType": "CORPORATION",
  "verticalType": "TECHNOLOGY",
  "programType": "STANDARD",
  "website": "https://www.acmecorp.com",
  "companyEmail": "contact@acmecorp.com",
  "country": "US",
  "street": "123 Main Street",
  "city": "New York",
  "state": "New York",
  "stateCode": "NY",
  "zip": "10001",
  "taxCountry": "US",
  "federalTaxId": "123456789",
  "contactEmail": "contact@acmecorp.com",
  "contentProvider": false,
  "attachments": [],
  "logs": [],
  "channels": [],
  "createTime": "2025-10-14T10:58:27.095235Z",
  "updateTime": "2025-10-14T10:58:27.095235Z"
}

Patch Brand

Performs a partial update of an existing brand. Fields omitted from the request body remain unchanged. Fields explicitly set to null are treated as a request to clear the value; if a field does not support clearing, the request fails with 400 Bad Request. Useful for updating a single field without resending the entire brand payload.

Brands in both DRAFT and ACTIVE status can be patched.

Regarding attachments, the patch operation never deletes existing attachments; it only adds the ones supplied in attachmentInputs. Only the latest version of each attachment type is kept per brand.

Request

curl --location --request PATCH 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <YourAccessToken>' \
--data-raw '{
  "displayName": "Acme Corp Patched",
  "website": "https://www.acmecorp-new.com",
  "street2": null
}'

Response

{
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "displayName": "Acme Corp Patched",
  "status": "DRAFT",
  "legalCompanyName": "Acme Corporation",
  "entityType": "CORPORATION",
  "verticalType": "TECHNOLOGY",
  "programType": "STANDARD",
  "website": "https://www.acmecorp-new.com",
  "companyEmail": "contact@acmecorp.com",
  "country": "US",
  "street": "456 Second Avenue",
  "city": "New York",
  "state": "New York",
  "stateCode": "NY",
  "zip": "10001",
  "taxCountry": "US",
  "federalTaxId": "123456789",
  "contactEmail": "contact@acmecorp.com",
  "contentProvider": false,
  "attachments": [],
  "logs": [],
  "channels": [],
  "createTime": "2025-10-14T10:58:27.095235Z",
  "updateTime": "2025-10-14T11:05:00.000000Z"
}

Delete Brand

Permanently deletes a brand. The brand must exist and be accessible from the specified project. This action cannot be undone.

Request

curl --location --request DELETE 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

HTTP 204 No Content

Import Brand

Imports an existing brand from an external registry (TCR or GCH) into your Sinch project, so you can manage it through the Compliance Brands API. The import process creates a brand and an associated brand order automatically, copying all existing third-party metadata from the original registration. Depending on the source registry, an email is sent to the brand's registered contact address to approve or deny the import request.

An imported brand cannot be directly modified through this API. For example, a brand imported via IMPORT_GCH_BRAND cannot have its Short Code registration details changed, although it can be extended to other services such as 10DLC. All maintenance and update operations remain the responsibility of the original registrant.

This operation is valid for:

IMPORT_TCR_BRAND — import from TCR (10DLC / RCS registrations). externalBrandId must be the TCR Brand ID.
IMPORT_GCH_BRAND — import from GCH (Short Code registrations). externalBrandId must be the GCH Account ID.

Required fields: displayName, importType and externalBrandId. callbackUrl is optional.

Request — note the path is /us/brands/import

curl --location --request POST 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/import' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <YourAccessToken>' \
--data-raw '{
  "displayName": "My Imported TCR Brand",
  "importType": "IMPORT_TCR_BRAND",
  "externalBrandId": "BTCR123456",
  "callbackUrl": "https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49"
}'

Response — 201 Created

{
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "brandOrderId": "212421442412",
  "brandOwnerContactEmail": "co****@acmecorp.com"
}

Upload Attachment — File Upload

Uploads a file directly to a brand as an attachment. Use multipart/form-data with the binary file and the desired attachment type. Accepted types are COMPANY_LOGO and COMPANY_BANNER. Attachments are automatically associated with Brand Orders that require them, and only the latest version of each attachment type is kept per brand.

Request

curl --location --request POST 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/attachments' \
--header 'Authorization: Bearer <YourAccessToken>' \
--form 'file=@"/path/to/company-logo.png"' \
--form 'attachmentType="COMPANY_LOGO"'

Response — 201 Created

{
  "attachmentId": "d1c7ccbf919d462f8587dec95a1b11ee",
  "fileName": "company-logo.png",
  "attachmentType": "COMPANY_LOGO",
  "mimeType": "image/png",
  "uploadStatus": "COMPLETED",
  "createTime": "2025-10-14T11:00:00.000000Z",
  "updateTime": "2025-10-14T11:00:00.000000Z"
}

The uploadStatus can be COMPLETED, WAITING (processing still ongoing) or FAILED.

Upload Attachment — By URL

Instead of uploading a file directly, you can link an attachment by providing a publicly accessible URL via attachmentInputs in a PATCH request (the same array is also accepted when creating a brand). Sinch will fetch the file from the URL and associate it with the brand.

Request

curl --location --request PATCH 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <YourAccessToken>' \
--data-raw '{
  "attachmentInputs": [
    {
      "fileName": "company-banner.jpg",
      "attachmentType": "COMPANY_BANNER",
      "fileUrl": "https://www.acmecorp.com/assets/banner.jpg"
    }
  ]
}'

Response

{
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "displayName": "Acme Corp",
  "status": "DRAFT",
  "attachments": [
    {
      "attachmentId": "e1c7ccbf919d462f8587dec95a1b11ee",
      "fileName": "company-banner.jpg",
      "attachmentType": "COMPANY_BANNER",
      "mimeType": "image/jpeg",
      "uploadStatus": "COMPLETED",
      "createTime": "2025-10-14T11:01:00.000000Z",
      "updateTime": "2025-10-14T11:01:00.000000Z"
    }
  ],
  "createTime": "2025-10-14T10:58:27.095235Z",
  "updateTime": "2025-10-14T11:01:05.000000Z"
}

Download Attachment

Downloads the binary file for a specific attachment linked to a brand. The response is a binary stream (application/octet-stream).

Request

curl --location 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/attachments/d1c7ccbf919d462f8587dec95a1b11ee' \
--header 'Authorization: Bearer <YourAccessToken>' \
--output company-logo.png

Response

HTTP 200 OK
Content-Type: application/octet-stream

<binary file content saved to company-logo.png>

Delete Attachment

Removes an attachment from a brand. The attachment is permanently deleted and can no longer be associated with any brand orders.

Request

curl --location --request DELETE 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/attachments/d1c7ccbf919d462f8587dec95a1b11ee' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

HTTP 204 No Content

Create Brand Order — 10DLC Private Registration

Creates a Brand Order to register a brand for 10DLC (A2P SMS) traffic via TCR as a private brand (not shared with other CSPs). The fee is $5 USD and the brand receives the TENDLC channel on completion. The brand must have all required fields populated (company info, address, tax ID, contact email) before creating this order.

Use US_10DLC_TCR_PUBLIC_BRAND_REGISTRATION instead if the brand is a public company. Standard and enhanced vetting are ordered with the *_STANDARD_BRAND_REGISTRATION and *_ENHANCED_BRAND_REGISTRATION processes, and US_10DLC_TCR_PRIVATE_MOCK / US_10DLC_TCR_PUBLIC_MOCK are free processes for testing the TCR integration without being granted the channel. See Reference — Brand Order processes for the full list.

Only metadataName is required in the body; callbackUrl is optional.

Note: The Idempotency-Key header is not supported in this version — submitting the same request twice may create duplicate orders.

Request

curl --location --request POST 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/orders' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <YourAccessToken>' \
--data-raw '{
  "metadataName": "US_10DLC_TCR_PRIVATE_BRAND_REGISTRATION",
  "callbackUrl": "https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49"
}'

Response — 201 Created

{
  "brandOrderId": "212421442412",
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "status": "NEW",
  "metadataName": "US_10DLC_TCR_PRIVATE_BRAND_REGISTRATION",
  "logs": [
    {
      "createTime": "2025-10-14T11:05:00.000000Z",
      "message": "Brand order created.",
      "brandCurrentState": "NEW"
    }
  ],
  "channels": [],
  "thirdPartyMetadata": [],
  "pricing": {
    "amount": "5.00",
    "currencyCode": "USD"
  },
  "callbackUrl": "https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49",
  "createTime": "2025-10-14T11:05:00.000000Z",
  "updateTime": "2025-10-14T11:05:00.000000Z"
}

Create Brand Order — Short Code (GCH)

Creates a Brand Order to register a brand for Short Code traffic via GCH. There is now a single unified process, US_SC_GCH: the specific GCH sub-process is derived automatically from the brand's programType field — STANDARD → standard process, GOVERNMENT → government process, CHARITY → charity process, POLITICAL → political process. The process is free of charge and grants the SHORT_CODE channel on completion. For Content Provider entities, use US_SC_GCH_CONTENT_PROVIDER.

The brand must include the Short Code-specific fields: firstName, lastName, phoneNumber (E.164), registrationCountry, registrationState and stateCode. Depending on the programType, additional fields are mandatory:

POLITICAL — politicalToken (Campaign Verify token), politicalType and politicalUrl.
GOVERNMENT — governmentWebsite and governmentType (plus governmentTypeOther when governmentType is OTHER).
CHARITY — charitableAccreditation.

scType (VANITY / RANDOM) and the free-text scText apply to the legacy US_SC_REGISTRY process.

Request

curl --location --request POST 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/orders' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <YourAccessToken>' \
--data-raw '{
  "metadataName": "US_SC_GCH",
  "callbackUrl": "https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49"
}'

Response — 201 Created

{
  "brandOrderId": "212421442413",
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "status": "NEW",
  "metadataName": "US_SC_GCH",
  "logs": [
    {
      "createTime": "2025-10-14T11:06:00.000000Z",
      "message": "Brand order created.",
      "brandCurrentState": "NEW"
    }
  ],
  "channels": [],
  "thirdPartyMetadata": [],
  "callbackUrl": "https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49",
  "createTime": "2025-10-14T11:06:00.000000Z",
  "updateTime": "2025-10-14T11:06:00.000000Z"
}

Create Brand Order — 10DLC Sole Proprietor

Registers a brand as a Sole Proprietor for 10DLC messaging via TCR without an Employer Identification Number (EIN). The fee is $5.50 USD.

The brand must have a mobilePhoneNumber that is a valid US or CA number: when the order is created, a One-Time Password (OTP) is automatically sent by SMS to that number. The registration is only finalised once the OTP is submitted through the Verify OTP endpoint.

Request

curl --location --request POST 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/orders' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <YourAccessToken>' \
--data-raw '{
  "metadataName": "US_10DLC_TCR_SOLE_PROPRIETOR",
  "callbackUrl": "https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49"
}'

Response — 201 Created

{
  "brandOrderId": "212421442414",
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "status": "NEW",
  "metadataName": "US_10DLC_TCR_SOLE_PROPRIETOR",
  "logs": [],
  "channels": [],
  "thirdPartyMetadata": [],
  "pricing": {
    "amount": "5.50",
    "currencyCode": "USD"
  },
  "callbackUrl": "https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49",
  "createTime": "2025-10-14T11:07:00.000000Z",
  "updateTime": "2025-10-14T11:07:00.000000Z"
}

List Brand Orders — All

Returns a paginated list of all brand orders across all brands in the specified project. You can filter by status (repeatable) or metadataName, and sort by metadataName, status, createTime or updateTime. Pagination follows the same pageSize / pageToken + links.next / meta.totalCount model as List Brands.

Request

curl --location 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/orders?pageSize=20&sort=createTime:desc' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

{
  "orders": [
    {
      "brandOrderId": "212421442412",
      "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
      "status": "NEW",
      "metadataName": "US_10DLC_TCR_PRIVATE_BRAND_REGISTRATION",
      "createTime": "2025-10-14T11:05:00.000000Z",
      "updateTime": "2025-10-14T11:05:00.000000Z"
    },
    {
      "brandOrderId": "212421442413",
      "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
      "status": "NEW",
      "metadataName": "US_SC_GCH",
      "createTime": "2025-10-14T11:06:00.000000Z",
      "updateTime": "2025-10-14T11:06:00.000000Z"
    }
  ],
  "links": {},
  "meta": {
    "totalCount": 2
  }
}

List Brand Orders — By Brand

Returns a paginated list of orders for a specific brand. Supports the same status, metadataName, sort, pageSize and pageToken parameters as the project-wide listing.

Request

curl --location 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/orders?status=NEW' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

{
  "orders": [
    {
      "brandOrderId": "212421442412",
      "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
      "status": "NEW",
      "metadataName": "US_10DLC_TCR_PRIVATE_BRAND_REGISTRATION",
      "createTime": "2025-10-14T11:05:00.000000Z",
      "updateTime": "2025-10-14T11:05:00.000000Z"
    }
  ],
  "links": {},
  "meta": {
    "totalCount": 1
  }
}

Get Brand Order

Retrieves the full details of a specific brand order, including its current status, associated channels, third-party metadata (e.g., TCR brand ID), pricing, and status history logs.

Request

curl --location 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/orders/212421442412' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

{
  "brandOrderId": "212421442412",
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "status": "COMPLETED",
  "metadataName": "US_10DLC_TCR_PRIVATE_BRAND_REGISTRATION",
  "logs": [
    {
      "createTime": "2025-10-14T11:05:00.000000Z",
      "message": "Brand order created.",
      "brandCurrentState": "NEW"
    },
    {
      "createTime": "2025-10-14T11:10:00.000000Z",
      "brandCurrentState": "COMPLETED",
      "brandPreviousState": "PENDING"
    }
  ],
  "channels": ["TENDLC"],
  "thirdPartyMetadata": [
    {
      "name": "TCR_BRAND_ID",
      "value": "BTCR789012"
    }
  ],
  "pricing": {
    "amount": "5.00",
    "currencyCode": "USD"
  },
  "callbackUrl": "https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49",
  "createTime": "2025-10-14T11:05:00.000000Z",
  "updateTime": "2025-10-14T11:10:00.000000Z"
}

Delete Brand Order

Deletes a brand order. This permanently removes the order record. Use this operation with caution — it cannot be undone.

Request

curl --location --request DELETE 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/orders/212421442412' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

HTTP 204 No Content

Retry Brand Order

Retries a brand order that is in INCOMPLETE or NEW status. When retried, the order fetches the latest brand properties and attachments and reapplies all validations. Use this when you have updated the brand after an order was marked as INCOMPLETE due to missing or incorrect data. No request body is needed.

Request — the action is now a sub-resource, /orders/{orderId}/retry

curl --location --request POST 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/orders/212421442412/retry' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

{
  "brandOrderId": "212421442412",
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "status": "NEW",
  "metadataName": "US_10DLC_TCR_PRIVATE_BRAND_REGISTRATION",
  "logs": [
    {
      "createTime": "2025-10-14T11:20:00.000000Z",
      "brandCurrentState": "NEW",
      "brandPreviousState": "INCOMPLETE"
    }
  ],
  "channels": [],
  "thirdPartyMetadata": [],
  "pricing": {
    "amount": "5.00",
    "currencyCode": "USD"
  },
  "callbackUrl": "https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49",
  "createTime": "2025-10-14T11:05:00.000000Z",
  "updateTime": "2025-10-14T11:20:00.000000Z"
}

Resend Brand Confirmation Email

Resends the brand registration confirmation email to the end-customer (brand owner contact). Certain product verification processes require the end-customer's approval by email to complete the brand registration; if the email was lost or never received, call this endpoint to trigger a resend.

The order must be in PENDING status, and this functionality is currently available only for 10DLC / RCS (TCR) registration processes.

Request

curl --location --request POST 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/orders/212421442412/resendConfirmationEmail' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

{
  "brandOrderId": "212421442412",
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "status": "PENDING",
  "metadataName": "US_10DLC_TCR_PRIVATE_BRAND_REGISTRATION",
  "logs": [],
  "channels": [],
  "thirdPartyMetadata": [],
  "pricing": {
    "amount": "5.00",
    "currencyCode": "USD"
  },
  "callbackUrl": "https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49",
  "createTime": "2025-10-14T11:05:00.000000Z",
  "updateTime": "2025-10-14T11:25:00.000000Z"
}

Verify OTP — Sole Proprietor

Verifies the One-Time Password (OTP) received on the brand's registered mobile phone number to complete a US_10DLC_TCR_SOLE_PROPRIETOR order. After the order is created, the OTP is sent automatically by SMS to the brand's mobilePhoneNumber; submit the code here to finalise the registration.

Requirement: to receive the OTP, the brand's mobilePhoneNumber must be a valid United States (US) or Canadian (CA) phone number.

Request

curl --location --request POST 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/orders/212421442414/verifyOtp' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <YourAccessToken>' \
--data-raw '{
  "otp": "27FUY2"
}'

Response

{
  "brandOrderId": "212421442414",
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "status": "COMPLETED",
  "metadataName": "US_10DLC_TCR_SOLE_PROPRIETOR",
  "logs": [],
  "channels": ["TENDLC"],
  "thirdPartyMetadata": [
    {
      "name": "TCR_BRAND_ID",
      "value": "B123ABC"
    }
  ],
  "pricing": {
    "amount": "5.50",
    "currencyCode": "USD"
  },
  "callbackUrl": "https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49",
  "createTime": "2025-10-14T11:07:00.000000Z",
  "updateTime": "2025-10-14T11:10:00.000000Z"
}

Resend OTP — Sole Proprietor

Triggers a resend of the One-Time Password required to verify a US_10DLC_TCR_SOLE_PROPRIETOR order. Use it when the initial OTP expired or was never received. The new OTP is sent to the brand's registered mobilePhoneNumber, which must be a valid US or CA number. No request body is needed.

Request

curl --location --request POST 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/orders/212421442414/resendOtp' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

{
  "brandOrderId": "212421442414",
  "brandId": "b1c7ccbf919d462f8587dec95a1b11ee",
  "status": "PENDING",
  "metadataName": "US_10DLC_TCR_SOLE_PROPRIETOR",
  "logs": [],
  "channels": [],
  "thirdPartyMetadata": [],
  "pricing": {
    "amount": "5.50",
    "currencyCode": "USD"
  },
  "callbackUrl": "https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49",
  "createTime": "2025-10-14T11:07:00.000000Z",
  "updateTime": "2025-10-14T11:12:00.000000Z"
}

Get Callback Configuration

Retrieves the current callback configuration for a project. The HMAC secret used to sign callback events is masked — only the last characters are visible, returned in hmacSecretMask. To obtain a full secret value, either set your own with Set Callback HMAC Secret or generate one with Rotate Callback HMAC Secret.

Request

curl --location 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/callbackConfig' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

{
  "projectId": "a1b2c3d4e5f67890abcdef1234567890",
  "hmacSecretMask": "••••••1b11ee"
}

Set Callback HMAC Secret

Sets a customer-provided HMAC secret for the project. The full secret is returned once in the response body — this is the only time it is visible in plain text, so store it securely straight away. After updating the secret, all incoming callbacks are signed with the new value; update your webhook handler accordingly.

Request

curl --location --request PATCH 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/callbackConfig' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <YourAccessToken>' \
--data-raw '{
  "hmacSecret": "myNewSecretKey456"
}'

Response

{
  "projectId": "a1b2c3d4e5f67890abcdef1234567890",
  "hmacSecret": "myNewSecretKey456"
}

Rotate Callback HMAC Secret

Asks Sinch to generate a new, cryptographically random HMAC secret for the project and replace the existing one. The full secret is returned once in the response body and never again in plain text — store it securely immediately. Use this instead of Set Callback HMAC Secret when you do not want to supply your own value.

Request

curl --location --request POST 'https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/callbackConfig/rotate' \
--header 'Authorization: Bearer <YourAccessToken>'

Response

{
  "projectId": "a1b2c3d4e5f67890abcdef1234567890",
  "hmacSecret": "f9a3dd714c2e4f87b901abc123def456"
}

Callback Event Reception

When you provide a callbackUrl in a Create Brand Order or Import Brand request, Sinch will send an HTTP POST to that URL every time the brand order status changes. The URL must be a valid URL and reachable from Sinch.

The callback payload follows the CloudEvents v1.0 specification (structured content mode, Content-Type: application/json) with the required envelope fields specversion, id, source, type and time. The type field uses the reverse-DNS prefix com.sinch.registrations.brand.order.v1 and the event version is its last component. Sinch signs each request with an HMAC-SHA256 signature computed over the request body using the project's HMAC secret, and sends it in the X-Sinch-Signature header — validate it on your side to ensure the event is authentic.

Your handler is expected to ingest the event and respond with 200 OK; run your business logic asynchronously outside the callback request. Delivery order is not guaranteed, so the handler must tolerate out-of-order or unexpected events and can call Get Brand Order to fetch the latest state. Treat events with the same source + id as duplicates.

Typical status progression:

NEW → brand order created and queued
PENDING → order is under review; a confirmation email (or an OTP, for Sole Proprietor) may be sent to the brand owner
COMPLETED → brand is approved and channels are activated
REJECTED / INCOMPLETE → action required; check the comments field for details
PENDING_REVIEW → the brand/order was updated after being INCOMPLETE and is waiting for a new review
ARCHIVED → the order was cancelled and can no longer be updated or submitted

Callback Payload Example

POST https://webhook.site/d73ba377-90c3-4029-9a99-fe5a7d485b49
Content-Type: application/json
X-Sinch-Signature: abc123...

{
  "specversion": "1.0",
  "id": "ee34ccbf919d462f8587dec95a1b11ee",
  "source": "https://compliance.api.sinch.com/v1/projects/a1b2c3d4e5f67890abcdef1234567890/us/brands/b1c7ccbf919d462f8587dec95a1b11ee/orders/212421442412",
  "type": "com.sinch.registrations.brand.order.v1.BrandOrderStatusUpdate",
  "time": "2025-10-14T11:10:00.000000Z",
  "data": {
    "projectId": "a1b2c3d4e5f67890abcdef1234567890",
    "resourceId": "212421442412",
    "resourceType": "US_10DLC_TCR_PRIVATE_BRAND_REGISTRATION",
    "status": "COMPLETED",
    "comments": "Brand registration approved by TCR."
  }
}

To validate the signature, compute HMAC-SHA256 of the raw request body using your hmacSecret and compare it to the value in X-Sinch-Signature.

Error Responses

Errors are returned as RFC 7807 problem details with Content-Type: application/problem+json. The body always contains type (URI identifying the problem type) and title (short summary), plus either a structured errors list with a JSON pointer per offending field, or a plain-text detail.

Status	Meaning
400	BAD_REQUEST — any validation error.
401	UNAUTHENTICATED — missing or invalid credentials. A WWW-Authenticate header is returned.
403	PERMISSION_DENIED — the authenticated user cannot perform this operation.
404	NOT_FOUND — the project, brand, order or attachment does not exist.
429	RESOURCE_EXHAUSTED — rate limit exceeded.
INTERNAL — internal server error, typically a server bug.

Field-level validation error { "type": "https://developers.sinch.com/docs/errors/registry/validation-error", "title": "Validation Error", "errors": [ { "pointer": "/displayName", "detail": "Brand Name already exists for this brand type" } ] }

Plain-text error { "type": "https://developers.sinch.com/docs/errors/registry/not-found", "title": "Not Found", "detail": "Project not found" }

Reference — Enumerations

Brand status (status): DRAFT, ACTIVE, ARCHIVED.
Brand order status (status): NEW, PENDING, PENDING_REVIEW, REJECTED, INCOMPLETE, COMPLETED, ARCHIVED.
Channel (channels): TENDLC (10DLC, via TCR), RCS (via TCR), SHORT_CODE (via GCH).
Entity type: CORPORATION, LLC, PARTNERSHIP, S_CORPORATION.
Program type: STANDARD, GOVERNMENT, CHARITY, POLITICAL.
Vertical type: PROFESSIONAL, REAL_ESTATE, HEALTHCARE, HUMAN_RESOURCES, ENERGY, ENTERTAINMENT, RETAIL, TRANSPORTATION, AGRICULTURE, INSURANCE, POSTAL, EDUCATION, HOSPITALITY, FINANCIAL, POLITICAL, GAMBLING, LEGAL, CONSTRUCTION, NGO, MANUFACTURING, GOVERNMENT, TECHNOLOGY, COMMUNICATION.
Political / government type: FEDERAL, LOCAL, TRIBAL, STATE, OTHER.
Short Code type (scType): VANITY, RANDOM.
Attachment type: COMPANY_LOGO, COMPANY_BANNER. Upload status: COMPLETED, WAITING, FAILED.
Import type: IMPORT_TCR_BRAND, IMPORT_GCH_BRAND.

Reference — Brand Order processes (metadataName)

Values accepted when creating an order:

Short Code (GCH): US_SC_GCH, US_SC_GCH_CONTENT_PROVIDER.
10DLC (TCR): US_10DLC_TCR_PRIVATE_BRAND_REGISTRATION, US_10DLC_TCR_PUBLIC_BRAND_REGISTRATION, US_10DLC_TCR_PRIVATE_BRAND_UPDATE, US_10DLC_TCR_PUBLIC_BRAND_UPDATE, US_10DLC_TCR_PRIVATE_MOCK, US_10DLC_TCR_PUBLIC_MOCK, US_10DLC_TCR_SOLE_PROPRIETOR, US_10DLC_TCR_PRIVATE_STANDARD_BRAND_REGISTRATION, US_10DLC_TCR_PRIVATE_ENHANCED_BRAND_REGISTRATION, US_10DLC_TCR_PUBLIC_STANDARD_BRAND_REGISTRATION, US_10DLC_TCR_PUBLIC_ENHANCED_BRAND_REGISTRATION.
RCS (TCR): US_RCS_TCR_PRIVATE_BRAND_REGISTRATION, US_RCS_TCR_PUBLIC_BRAND_REGISTRATION, US_RCS_TCR_UPDATE_ASSETS.

US_SC_REGISTRY can appear in existing orders and in filters, but it is a legacy read-only process and cannot be used for new orders.

Indicative fees defined in the contract: $5 for private/public 10DLC brand registration, $5.50 for Sole Proprietor, $50 ($45 with an existing TCR ID) for standard vetting, $105 for enhanced vetting; brand update, mock and GCH Short Code processes are free of charge. For confirmed pricing, consult your Account Manager or the Sinch Customer Dashboard.