{
  "id": "CMP-175",
  "slug": "cmp-175",
  "title": "Subscriber attributes must be true where the API accepts nothing else",
  "statement": "On a CSP whose API accepts only true for the subscriber opt-in, opt-out and help attributes, none of the three may be submitted false.",
  "rationale": "This is a schema rejection rather than a vetting one: the call fails before the campaign exists, so there is no rejection reason to read and no campaign record to inspect. It bites exactly the submissions that are entitled to say false — a two-factor programme relying on the opt-out exemption TCR grants finds that its provider never implemented the exemption.",
  "layer": "CAMPAIGN",
  "layerSlug": "campaign",
  "object": "campaign.subscriber_optin + subscriber_optout + subscriber_help",
  "severity": "BLOCKING",
  "detectability": [
    "DETERMINISTIC"
  ],
  "failureClass": "RETRY_FIELD",
  "authorities": [
    "Plivo"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Send true for all three attributes on this provider, and back each one with real handling — declared keywords and a reply body — rather than leaning on the use-case exemption. Done when the payload carries three true values and three configured behaviours.",
  "example": "subscriber_optin: true · subscriber_optout: true · subscriber_help: true",
  "notes": "Plivo publishes \"Allowed value: true\" for all three fields. The provider condition is applied inside the check rather than as a `providers` tag: a tag resolves YES when the submission target is unknown, which would make this rule contradict CON-010's two-factor carve-out on every registration that has not chosen a provider yet. Passing on an unknown target is the honest reading — the exemption is real everywhere except here.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/campaign/cmp-175/",
  "markdown": "https://ekas.io/rules/10dlc/campaign/cmp-175.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}