Read our compliance rules from the API
GET /v1/policy and the get_compliance_policy MCP tool return the rules WhoLayer enforces, as JSON. Free.
GET https://api.wholayer.com/v1/policy (or the get_compliance_policy MCP tool) returns a versioned JSON document generated from the same code that enforces it. It's free and works with read-only keys.
It covers:
- Person-level identification in the US only; outside the US, company level only and only after consent; sites set to wait for consent everywhere.
- Global Privacy Control: requests with
Sec-GPC: 1are dropped. - The sensitive-page categories and keywords where we never identify people.
- Where suppression is checked, the suppression sources, and the
451reason codes. - Retention periods for page events, the delivery log, revealed API people, and the idempotency cache.
- A reminder that phone numbers mustn't be used for calls or texts without the consent the TCPA requires.
Give it to your agent so it knows what WhoLayer will and won't do before it calls other tools.
Was this helpful?