# CON-023 — Evidence URLs must resolve without a login

> A submitted evidence URL must resolve, be publicly reachable, and not require authentication.

- **Rule ID:** CON-023
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `consent artifact URL`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Supply evidence only you hold
- **Required by:** TCR, Twilio, Bandwidth, AWS
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-023/

## Why this rule exists

The most common evidence failure in practice is a cloud-storage link that shows a "request access" wall to anyone outside the organisation. The submitter tested it while logged in and saw their own file, so the failure is invisible from their side.

## How to fix it

Set the link to "anyone with the link can view", or host the file somewhere public, then open it in a private browsing window to confirm.

## Common mistakes

- Google Drive and Dropbox default to organisation-only access, which looks fine to you and shows a wall to everyone else.
- A viewer page is not the file — link the direct image or PDF.