# CMP-131 — Evidence must travel by the route the submission target actually offers

> Evidence must reach the reviewer through the channel the submission target provides, whether an upload field, a TCR attachment, or a URL inside the flow.

- **Rule ID:** CMP-131
- **Layer:** Campaign (`CAMPAIGN`)
- **Checks:** `evidence channel + campaign.message_flow`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Deterministic (settled in code from the submitted values)
- **Fix type:** Supply evidence only you hold
- **Required by:** Bandwidth, Telnyx, Bird
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/campaign/cmp-131/

## Why this rule exists

Every platform exposes exactly one evidence channel and none of them is the same: one has a multimedia upload field, one attaches the form to TCR, one accepts files only in its console and needs a URL in the payload when you use the API. Evidence lodged in the wrong place is not late or malformed — it is invisible, and the rejection reads as though nothing was ever attached.

## How to fix it

Use your target's channel: Bandwidth's "CTA, Privacy Policy and/or Terms and Conditions Multimedia Upload" field; a TCR attachment on the express-consent form for Telnyx; Bird's console attachments, or the proof URL inside the messageFlow JSON when you submit by API because attachments there are UI-only. Done when the evidence is reachable from the submission itself rather than from your own console.

## Example of a compliant value

```text
Submitting to Bird by API: messageFlow ends with "Opt-in proof: https://cdn.acmecoffee.com/compliance/optin.png" because attachments cannot be sent over the API.
```

## Common mistakes

- Attaching in the console and submitting by API is the combination that silently loses the evidence: the file is visible to you and absent from the payload the reviewer receives.

## Notes

Three catalog rows, one obligation with the destination as its parameter — Bandwidth's upload field (CMP-131), Telnyx's TCR attachment (CMP-133) and Bird's API workaround (CMP-134). Written as one rule because a submitter has exactly one target and needs exactly one instruction; three rules would report the same gap three times with two of them irrelevant. We can see that evidence exists and whether the flow text carries a URL, but not which UI field a file was uploaded through, so the check settles the observable half and the remediation carries the rest.