---
title: "Read our compliance rules from the API"
description: "GET /v1/policy and the get_compliance_policy MCP tool return the rules WhoLayer enforces, as JSON. Free."
url: https://wholayer.com/help/compliance-policy-api
---

# Read our compliance rules from the API

> GET /v1/policy and the get_compliance_policy MCP tool return the rules WhoLayer enforces, as JSON. Free.

Category: Data API and MCP

`GET https://api.wholayer.com/v1/policy` (or the `get_compliance_policy` MCP tool) returns a versioned JSON document generated from the same code that enforces it. It's free and works with read-only keys.

It covers:
- Person-level identification in the US only; outside the US, company level only and only after consent; sites set to wait for consent everywhere.
- Global Privacy Control: requests with `Sec-GPC: 1` are dropped.
- The sensitive-page categories and keywords where we never identify people.
- Where suppression is checked, the suppression sources, and the `451` reason codes.
- Retention periods for page events, the delivery log, revealed API people, and the idempotency cache.
- A reminder that phone numbers mustn't be used for calls or texts without the consent the TCPA requires.

Give it to your agent so it knows what WhoLayer will and won't do before it calls other tools.

## Related

- [API error codes and what to do](https://wholayer.com/help/api-errors.md)
- [How opt-outs and suppression work](https://wholayer.com/help/how-suppression-works.md)
- [Upload your own suppression list](https://wholayer.com/help/your-suppression-list.md)