Sharing evidence with lead buyers

Why sharing matters

If you sell leads to other companies or buy leads from a generator, consent evidence has to move with the lead. The company running the website (the lead generator) captures evidence when a consumer submits a form; the company that purchases and dials the lead (the lead buyer) needs that proof for TCPA compliance.

ExpressConsent makes this handoff a single step on each side: the generator gets a share URL when they capture the CDR, and the buyer opens that URL with a single POST.

Roles

Billing & access

How an org gets access to a CDR

Each org has independent access. An org can access a CDR if either of these is true:

• The org paid for it — via auto-collect at capture time, or by POSTing to a share URL (which collects by default), or by calling POST /v1/cdrs/:cdrId/collect.
• The org received it via a share URL from a payer — if the share URL was generated by an org that has paid for the CDR, the recipient gets full download access for free. No billing.

The one detail to know about re-sharing

Free access flows one hop forward from a payer. That covers the vast majority of cases: generator pays → shares to buyers → buyers download for free.

If a buyer who got free access then re-shares the CDR to their downstream partner, that downstream partner’s POST collects the CDR (default behavior), so they pay just like a normal buyer. This keeps a single payment from cascading indefinitely across an unbounded chain of re-shares while still letting any payer freely distribute evidence to their own direct partners.

Common scenarios

• Lead generator pays, sells to one or many buyers. Auto-collect is on (the default). Every buyer the generator hands the share URL to gets free download access on their first POST.
• Lead generator does not pay; the buyer pays. Generator turns auto-collect off. They capture and share to a buyer. The buyer’s POST to the share URL collects the CDR for them — one step, one billable event.
• Same lead sold to multiple buyers, each pays independently. Generator does not pay. Generator sends a share URL to each buyer. Each buyer’s POST is an independent collect; each is billed separately.
• Buyer re-sells the lead. A paid buyer can re-share to a downstream buyer. The downstream buyer’s POST collects (and bills) for them, just like any other recipient. Free access does not cascade past one hop.

Option 1: Auto-share at capture time (recommended)

The simplest approach. Pass autoShare: true to captureCDR() and the share URL is generated server-side during the upload. No extra API call needed.

document.getElementById('form').addEventListener('submit', async () => {
  const result = await window.ExpressConsent.captureCDR({
    autoShare: true,
    custom: { leadId: 'your-internal-lead-id' },
  });

  // result.cdrId        → "abc_123"
  // result.shareUrl     → "https://api-next.expressconsent.com/v1/shares/xYz..."
  // result.shareToken   → "xYz..."
  // result.shareExpiresAt → 1741234567890

  // Post the lead to your buyer — include the share URL
  await fetch('https://buyer-crm.example.com/leads', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      phone: formData.phone,
      email: formData.email,
      consentUrl: result.shareUrl,
      cdrId: result.cdrId,
    }),
  });
});

The returned shareUrl is a full absolute URL. Pass it directly to your lead buyer — they POST to it with their own ExpressConsent API key to receive the evidence.

Custom expiry

By default, share URLs expire after 30 days (max 2 years). To customize, pass an options object instead of true:

// Custom 7-day expiry (default is 30 days)
const result = await window.ExpressConsent.captureCDR({
  autoShare: { expiresInMs: 7 * 24 * 60 * 60 * 1000 },
});

Option 2: Share via API (server-side)

If you need to generate share URLs from your server (for example, sharing a CDR after the fact, or re-sharing a CDR you received from another org), use the API endpoint.

# Generate a share URL server-side (alternative to autoShare)
curl -sS -X POST \
  -H "X-API-Key: $EC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"expiresInMs": 2592000000}' \
  "$EC_API_BASE_URL/v1/cdrs/abc_123/share"

See the POST /v1/cdrs/:cdrId/share reference for full details.

How lead buyers receive evidence

The lead buyer POSTs to the share URL with their own ExpressConsent API key:

# Lead buyer opens the share URL with their own ExpressConsent API key.
# Default behavior: the CDR is added to the buyer's org and they are billed
# for it. If the lead generator has already paid, the buyer is granted free
# access instead of being billed.
curl -sS -X POST \
  -H "X-API-Key: $BUYER_API_KEY" \
  "https://api-next.expressconsent.com/v1/shares/xYzToken123"

Response

{
  "ok": true,
  "data": {
    "claimed": true,
    "alreadyClaimed": false,
    "cdrId": "abc_123",
    "domainId": "example.com",
    "shareEventId": "se_abc123def456"
  }
}

What happens on a successful POST:

• The CDR appears under the buyer’s organization in the dashboard.
• The buyer is billed for the CDR unless the lead generator has already paid for it — in which case the buyer gets free download access instead.
• The buyer can immediately view the CDR, download the evidence image, or generate a PDF report.
• POSTing the same URL twice is safe (alreadyClaimed: true on the second call). Billing is never duplicated for the same org.

Save without paying (opt-out)

If a buyer wants to save the share to their org without being billed yet (for example, to track a lead before deciding to dial it), pass { "collect": false }:

# Optional: save the share to your org without billing yourself.
# Use this if you want visibility on a lead without committing to the cost yet.
# You can collect (pay) later via POST /v1/cdrs/:cdrId/collect.
curl -sS -X POST \
  -H "X-API-Key: $BUYER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"collect": false}' \
  "https://api-next.expressconsent.com/v1/shares/xYzToken123"

The CDR shows up in the buyer’s account but is not billed and the buyer cannot download. They can collect later by calling POST /v1/cdrs/:cdrId/collect. If the lead generator was already a payer, free access is granted on the original POST regardless of collect: false — the generator wanted you to have it.

End-to-end flow

1. Consumer submits form on the lead generator’s site.
2. Lead generator calls captureCDR({ autoShare: true }) — gets back cdrId + shareUrl.
3. Lead generator posts the lead to the buyer’s CRM/API, including the shareUrl.
4. Lead buyer POSTs to the shareUrl with their API key. The CDR is now under both organizations and the buyer can download immediately. Whoever needs to be billed (generator or buyer) is billed in this single step — no extra calls.

Co-registration & multiple buyers

If you sell the same lead to multiple buyers, each buyer POSTs to their own share URL independently. Each receive is tracked separately and (if the generator hasn’t paid) each buyer is billed for their own copy.

For co-registration flows where different buyers should see different pages, use sub-group Package CDRs to control which CDRs each buyer can access.

Package CDR sharing (coming soon)

Package CDRs bundle multiple CDRs from the same user session into a single composite evidence document. Package CDR sharing will let you share an entire multi-step consent flow in a single share URL, so the buyer sees the complete picture.

For now, share individual CDRs using the methods above. When a buyer receives multiple CDRs from the same session, they automatically appear together in the buyer’s Package CDRs view. See the Package CDRs documentation for more details.

Related docs