{
  "id": "CMP-131",
  "slug": "cmp-131",
  "title": "Evidence must travel by the route the submission target actually offers",
  "statement": "Evidence must reach the reviewer through the channel the submission target provides, whether an upload field, a TCR attachment, or a URL inside the flow.",
  "rationale": "Every platform exposes exactly one evidence channel and none of them is the same: one has a multimedia upload field, one attaches the form to TCR, one accepts files only in its console and needs a URL in the payload when you use the API. Evidence lodged in the wrong place is not late or malformed — it is invisible, and the rejection reads as though nothing was ever attached.",
  "layer": "CAMPAIGN",
  "layerSlug": "campaign",
  "object": "evidence channel + campaign.message_flow",
  "severity": "HIGH",
  "detectability": [
    "DETERMINISTIC"
  ],
  "failureClass": "TERMINAL_EVIDENCE",
  "authorities": [
    "Bandwidth",
    "Telnyx",
    "Bird"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Use your target's channel: Bandwidth's \"CTA, Privacy Policy and/or Terms and Conditions Multimedia Upload\" field; a TCR attachment on the express-consent form for Telnyx; Bird's console attachments, or the proof URL inside the messageFlow JSON when you submit by API because attachments there are UI-only. Done when the evidence is reachable from the submission itself rather than from your own console.",
  "example": "Submitting to Bird by API: messageFlow ends with \"Opt-in proof: https://cdn.acmecoffee.com/compliance/optin.png\" because attachments cannot be sent over the API.",
  "pitfalls": [
    "Attaching in the console and submitting by API is the combination that silently loses the evidence: the file is visible to you and absent from the payload the reviewer receives."
  ],
  "notes": "Three catalog rows, one obligation with the destination as its parameter — Bandwidth's upload field (CMP-131), Telnyx's TCR attachment (CMP-133) and Bird's API workaround (CMP-134). Written as one rule because a submitter has exactly one target and needs exactly one instruction; three rules would report the same gap three times with two of them irrelevant. We can see that evidence exists and whether the flow text carries a URL, but not which UI field a file was uploaded through, so the check settles the observable half and the remediation carries the rest.",
  "catalogIds": [
    "CMP-133",
    "CMP-134"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/campaign/cmp-131/",
  "markdown": "https://ekas.io/rules/10dlc/campaign/cmp-131.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}