Topolo Consent

Consent, privacy permissioning, GPC enforcement, DSR, and audit infrastructure for Topolo products and customer surfaces.

publicverified 2026-07-29consentprivacyapplication

What It Is

Topolo Consent is the Topolo Platform consent and privacy permissioning service. It is designed for websites, native apps, AI agents, kiosks, IoT surfaces, and Topolo-powered organizations that need a shared answer to whether data can be used for a specific privacy, analytics, marketing, or operational purpose.

The SDKs and API surface includes copyable web, Flutter, iOS, and Android quick-start snippets for the selected workspace. Native SDK onboarding uses platform sub-tabs, shows the publishable SDK key, active methods, local-first/offline sync behavior, and app identifiers, and avoids implying one native SDK is dominant.

Native app identifiers are configured from the selected workspace surface settings. They represent the allowed Flutter app ID, iOS bundle ID, and Android package name for that workspace, and the workspace switcher can mark one active workspace as the organization default.

Authenticated Consent sections expose direct URLs for dashboard, configuration, preference builder, cookie scanner, SDKs/API, DSR requests, audit logs, and settings so operators can open or share a specific admin surface without re-navigating from the dashboard.

Architecture

Topolo Consent uses a Cloudflare Worker for public SDK/config APIs, admin APIs, SDK delivery, and ongoing cookie scanning. The read path is cacheable and local-first, while consent writes are explicit-project-key scoped, idempotent, and queue-friendly for high-volume traffic.

Workspace Management

The shared Topolo workspace control reads and manages app-scoped workspace identity through Topolo Auth: authenticated users can list, create, rename, choose a default, and delete an eligible workspace. Workspace IDs and slugs remain stable and exactly one default is explicit. The selected platform workspace scopes this application's app-owned records; the app retains only domain-specific deletion guards for default or non-empty workspaces.

Runtime Surfaces

Hosts:

  • production: https://consent.topolo.app
  • staging: https://consent.stg.topolo.us

API Reference

Core routes:

  • canUseData(identity, purpose) through POST /api/can-use-data
  • getConsent through GET|POST /api/get-consent
  • setConsent through POST /api/set-consent
  • syncIdentity through POST /api/sync-identity
  • exportAudit through POST /api/export-audit
  • submitDSR through POST /api/submit-dsr

The public read path is cacheable and local-first. Public config resolves the effective regulatory mode from the end user's Cloudflare country and region, with the configured workspace mode used only as a fallback when location is unavailable. Unknown projects and unknown non-essential data use fail closed, while essential app functionality stays unblocked. Project configuration can include a visible operational compliance profile for jurisdictions, rights, opt-out signals, native-app controls, retention posture, and verification checks.

Public SDK calls must include a project key. Production does not serve implicit demo configuration when a project key is missing or unknown. Person-likeness access is not authorized by Consent alone; Agent/Auth and Voice own that subject-user and company-admin authorization boundary.

Auth and Permissions

The admin dashboard uses Topolo Auth through app id app_8FIGR7Q7zP9r. Authenticated operators see the first-party short name Consent in the platform shell, can switch workspaces and create new workspaces from the top toolbar switcher, then use the single combined Dashboard that opens on consent-rate KPIs, restricted-use blocks, governed surfaces, and compact dashboard tabs for Overview, Consent, Rights, Signals, and Evidence. Granular charts for purpose activity, DSR pipeline, signal coverage, recent audit evidence, and compliance posture live behind those tabs rather than all competing on the first screen. Workspace creation and detailed setup live in the switcher and Configure surface rather than the primary Dashboard. Cookie Scanner monitors configured domains for server-set cookies and known vendor script hints, categorizes findings by purpose, and preserves compact scan history. Archived workspaces remain visible to authenticated operators but no longer serve public SDK configuration. Deletion is guarded when consent, DSR, or audit records exist. Public SDK routes are available before login because customer sites and native apps must capture consent before a user has a Topolo session.

The admin UI follows the shared Topolo platform shell. Workspace selection and creation happen from the top toolbar, while Configure edits the active workspace through focused tabs for settings, surfaces, purposes, and vendors. Cookie Scanner monitors configured domains for server-set cookies and known vendor script hints, categorizes findings by purpose, and preserves compact scan history. DSR intake does not seed fake customer data, and Settings edits the active workspace legal profile and verification checklist.

Data Ownership

Consent state, consent events, project configuration, cookie scan history, DSR requests, and audit exports are organization-scoped at the service boundary. Web, Flutter, Swift, and Kotlin SDKs use publishable SDK keys, cache configuration locally, evaluate network-backed canUseData, queue consent writes, and keep host apps working when the network is degraded.

Mobile Experience

The checked-in mobile experience contract is approved in native_capability mode. Its fallback route is /projects, its offline policy is read_through_cache, and it requires organization context.

Published permissions: workspace:read, workspace:write.

  • /projects uses /api/projects with the record.list template and consent.projects.list data source.
  • /projects/:key uses /api/projects/:key/config with the record.detail template and consent.projects.detail data source.
  • /dsr uses /api/dsr-requests with the task.queue template and consent.dsr.list data source.
  • /dsr/:id uses /api/dsr-requests/:id with the record.detail template and consent.dsr.detail data source.
  • /audit uses /api/logs with the activity.timeline template and consent.audit.timeline data source.

The native clients consume this manifest as an explicit rendering contract. A web mode record intentionally opens the product web experience; native_capability publishes the listed native routes and actions. Do not infer unlisted native behavior.

Deployments

Deployment metadata lives in apps/TopoloConsent/topolo.cloudcontrol.json. Production deploys from main; staging deploys from the staging branch. The service uses the standard Topolo local CI/deploy contract, pnpm@10.11.0, and published Topolo platform packages rather than local package links.

Production and staging are provisioned with D1, KV, Queue, and R2 bindings. The public readiness route at GET /api/readiness reports whether those bindings are available without exposing secrets.

The SoulCycle demo is an authenticated staging workspace linked to the staging Auth org SoulCycle Pitch Demo; it is accessed through the normal Topolo Consent sign-in flow. The demo is configured as a CPRA-first representative enterprise workspace with GPC, Do Not Sell or Share, Google Consent Mode v2, ATT, Android consent surfaces, DSR samples, and audit evidence. It is not legal advice or legal certification.

Topolo also dogfoods Consent on the public TopoloOne marketing site through the topolo-one-marketing project. On staging, stg.topolo.us loads the Consent web SDK from https://consent.stg.topolo.us and records analytics, personalization, and advertising decisions from the host site's banner while keeping the host site local-first if Consent is degraded.

Failure Modes

  • Unknown non-essential purposes fail closed.
  • Missing project keys fail closed or return project_key_required.
  • GPC opt-out signals deny restricted purposes before remote lookup.
  • SDK network failures queue writes and do not block host rendering.
  • Cookie scan target failures are recorded per domain and do not stop consent collection.
  • Admin dashboard downtime does not stop public consent collection, and the dashboard shows a degraded state instead of fabricated project data.
  • GDPR or marketing consent is treated as authorization to impersonate a person's likeness.

Debugging

  • GET /api/config?projectKey=soulcycle-demo
  • GET /api/config?projectKey=soulcycle-demo with Cloudflare country/region headers in tests
  • GET /api/config
  • GET /api/readiness
  • POST /api/can-use-data
  • GET /api/health

Use It

Open Topolo Consent for the human product surface. The system handbook records its current hosts, ownership, Auth scopes, storage, deployment, failure modes, and machine artifact.

Discover the credential-scoped automation surface before making an API call:

topolo services --query topolo-consent --json
topolo actions --service topolo-consent --json
topolo actions capabilities --service topolo-consent --json

Choose an action, inspect it with topolo actions get <action-id> --json, then validate and plan a published example. The Agent Actions reference exposes the same public schemas, effects, examples, verification, and recovery guidance.

Example workflow:

  1. Confirm the active identity and organization with topolo whoami --json.
  2. Discover Topolo Consent and select one published action rather than guessing a route.
  3. Inspect its input/output schemas and published example.
  4. Validate and plan the exact payload; obtain confirmation for a mutation.
  5. Execute and perform every published verification step.

Change Log / Verification

  • Verified the native_capability mobile experience contract and its 5 published route(s) against apps/TopoloConsent origin/staging 038c0d005a69 on 2026-07-27.

  • Reconciled this page against apps/TopoloConsent origin/staging 95696e7307a9 on 2026-07-24 after reviewing every docs-relevant commit since its previous verification watermark. Dependency-only currency commits were checked by the fleet production-dependency gate and did not change this page's product contract.

  • Reconciled workspace verification on 2026-06-28 against apps/TopoloConsent commits through 528e823; reviewed 100 commits since 2026-06-18, including 528e823 chore(deps): refresh @topolo-io/app-shell pins (package.json + lockfile); c48af2b Stop blocking startup on i18n readiness; edfe64e Compact scanner empty states; d1ea6e2 Fix consent project row action layout.

  • 2026-05-08: Added native SDK active behavior, end-user-location regulatory mode resolution, and cookie scanner coverage.

  • 2026-05-07: Clarified public Consent coverage as privacy/GDPR permissioning rather than the person-likeness authorization boundary.

  • 2026-05-07: Production admin UX verified for workspace switching, Configure tabs, focused add dialogs, SDK install snippets, audit exports, and DSR evidence workflows.

  • 2026-05-07: DSR intake now starts with empty customer fields and Settings can save legal profile/checklist changes.

  • 2026-05-06: Reworked the Dashboard into a tabbed customer-facing operations view that opens on KPIs and an executive overview, with granular Consent, Rights, Signals, and Evidence dashboards available without crowding the first screen.

  • 2026-05-06: Added TopoloOne public-site dogfooding through the topolo-one-marketing Consent project so staging can show Consent in use on a real Topolo-owned website.

  • 2026-05-06: Combined Overview and Dashboard into one Dashboard navigation entry, set platform chrome to the short name Consent, and added favicon, app manifest, Apple touch icon, and PNG Open Graph assets.

  • 2026-05-06: Completed runtime/deployment hardening with pnpm, published Topolo package dependencies, shared Worker error reporting, standard CI/deploy/ops workflows, and CloudControl quality targets.

  • 2026-05-06: Corrected staging deployment metadata so staging deploys from the staging branch, while production remains on main.

  • 2026-05-06: Updated Consent to the shared UI Kit release that persists dark/light mode as a user-level Topolo platform preference.

  • 2026-05-06: Reframed the former Projects page as a workspace Dashboard combining active workspace context, readiness, lifecycle controls, registry actions, and create-workspace access.

  • 2026-05-06: Added visible project compliance-profile support and configured the authenticated SoulCycle staging workspace with CPRA-first operational settings, representative vendors, DSR samples, native consent posture, and audit evidence.

  • 2026-05-06: Moved active project switching into the top toolbar as a workspace-style project switcher with create-project access inside the menu.

  • 2026-05-06: Added authenticated Projects management for archive, restore, and guarded deletion.

  • 2026-05-06: Added an always-visible New project action in the authenticated dashboard header so operators can create additional organization-scoped projects without hunting through Configure.

  • 2026-05-06: Retired the legacy demo browser path entirely; the SoulCycle demo is only the authenticated Consent platform workspace.

  • 2026-05-06: Added authenticated configuration, consent-builder, DSR status/intake, audit filter, and audit export workflows. Public APIs now require explicit project keys instead of falling back to demo configuration.

  • 2026-05-06: Admin dashboard data is now organization-scoped and backed by persisted project, audit log, and DSR rows; unknown project keys fail closed on public APIs.

  • 2026-05-06: Production Cloudflare data resources were provisioned and bound for the Consent Worker.

  • 2026-05-06: Staging Auth now has a SoulCycle Pitch Demo org for the authenticated Consent demo.

  • 2026-05-06: Staging was provisioned with Cloudflare data resources and an authenticated SoulCycle workspace seed.

  • 2026-05-06: Topolo Consent created as a first-party Topolo application/service from the Consent OS execution plan.