Connect compliance footer to Brand kit

Outcome

Switch the footer to brand mode: every message rendered from now on takes its postal address (communications.legalFooter.registeredAddress) and opt-out sentence (communications.legalFooter.unsubscribeText) live from the Brand kit bound to this workspace for Engage, so a new kit version is picked up on the next render. Brand is checked first: 424 brand_not_connected when Brand is not connected to Engage, 424 brand_unavailable when Brand cannot be reached or no kit is bound, 409 brand_postal_address_missing when the kit has no registered address; the mode is unchanged in every error case. The resolved kit is cached as last-known-good. Manual values are kept. Already rendered and approved messages keep their footer. Verify with sending.compliance.get (mode brand, effective.source brand); roll back with sending.compliance.disconnect_brand.

Before you start

• Verify the intended environment, signed-in credential, authorized organization and the action permission workspace:write.
• Discover and select an authorized canonical Engage workspace. Pass resourceType=workspace and resourceId separately from action input.
• Review the exact effects and obtain approval before CLI --confirm or MCP confirm:true. A local capture does not authorize a live mutation.

Discover the target

topolo whoami --json
topolo actions get app_topolo_engage.sending.compliance.connect_brand --json
topolo workspaces list topolo-engage --json

Set ENGAGE_WORKSPACE_ID to the identifier of the selected authorized workspace.

Input contract

This action accepts an empty input object ({}). Resource context is supplied separately when required.

Validate, plan and execute

Build payload.json from the current schema and discovered identifiers. The action description above defines its behavior, limits, side effects and declared errors.

: "${ENGAGE_WORKSPACE_ID:?Set ENGAGE_WORKSPACE_ID to your selected workspace identifier}"
topolo actions validate app_topolo_engage.sending.compliance.connect_brand --data @payload.json --json
topolo actions plan app_topolo_engage.sending.compliance.connect_brand --resource-type workspace --resource-id "$ENGAGE_WORKSPACE_ID" --data @payload.json --confirm --json

Review the plan and approve its exact effects before executing the unchanged request.

: "${ENGAGE_WORKSPACE_ID:?Set ENGAGE_WORKSPACE_ID to your selected workspace identifier}"
topolo actions call app_topolo_engage.sending.compliance.connect_brand --resource-type workspace --resource-id "$ENGAGE_WORKSPACE_ID" --data @payload.json --confirm --json

For MCP, use topolo_get_action, topolo_validate_action, topolo_plan_action and topolo_call_action. Pass resource context separately where required; confirm:true is required for mutations.

Captured successful requests and responses

Captured HTTP 200 · runner with a footer connected to Brand > holds when the connected kit has no registered address or no unsubscribe text

Action input

{}

Actual local response

{
  "compliance": {
    "mode": "brand",
    "effective": {
      "source": "brand",
      "postalAddress": "Brand Ltd\n1 Old Road",
      "optOutText": "Brand v1 opt-out.",
      "legalName": null,
      "brandKitRef": "bk_1",
      "brandVersionRef": "bkv_1",
      "resolvedAt": "2026-10-06T08:30:00.000Z",
      "missing": [],
      "complete": true
    },
    "manual": {
      "postalAddress": "Example Ltd\n1 Example Street\nLondon",
      "optOutText": "Test opt-out sentence for fixtures.",
      "source": "manual",
      "updatedAt": "2026-10-06T08:30:00.000Z"
    },
    "senderNameOverride": null,
    "lastBrandResolve": {
      "kitRef": "bk_1",
      "versionRef": "bkv_1",
      "resolvedAt": "2026-10-06T08:30:00.000Z",
      "postalAddress": "Brand Ltd\n1 Old Road",
      "optOutText": "Brand v1 opt-out.",
      "legalName": null
    },
    "missing": [],
    "complete": true
  },
  "brand": {
    "available": true,
    "reason": null
  }
}

Source test: runner with a footer connected to Brand > holds when the connected kit has no registered address or no unsubscribe text. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 200 · runner with a footer connected to Brand > an edited pending message keeps the footer provenance of the version it supersedes

Action input

{}

Actual local response

{
  "compliance": {
    "mode": "brand",
    "effective": {
      "source": "brand",
      "postalAddress": "Brand Ltd\n1 Old Road",
      "optOutText": "Brand v1 opt-out.",
      "legalName": null,
      "brandKitRef": "bk_1",
      "brandVersionRef": "bkv_1",
      "resolvedAt": "2026-10-05T09:00:00.000Z",
      "missing": [],
      "complete": true
    },
    "manual": {
      "postalAddress": "Example Ltd\n1 Example Street\nLondon",
      "optOutText": "Test opt-out sentence for fixtures.",
      "source": "manual",
      "updatedAt": "2026-10-05T09:00:00.000Z"
    },
    "senderNameOverride": null,
    "lastBrandResolve": {
      "kitRef": "bk_1",
      "versionRef": "bkv_1",
      "resolvedAt": "2026-10-05T09:00:00.000Z",
      "postalAddress": "Brand Ltd\n1 Old Road",
      "optOutText": "Brand v1 opt-out.",
      "legalName": null
    },
    "missing": [],
    "complete": true
  },
  "brand": {
    "available": true,
    "reason": null
  }
}

Source test: runner with a footer connected to Brand > an edited pending message keeps the footer provenance of the version it supersedes. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 200 · sending.compliance.* actions > connects to Brand: live footer with kit and version, manual values kept and cached as last-known-good

Action input

{}

Actual local response

{
  "compliance": {
    "mode": "brand",
    "effective": {
      "source": "brand",
      "postalAddress": "Brand Ltd\n9 Lane\nBath",
      "optOutText": "Brand opt-out sentence.",
      "legalName": "Brand Ltd",
      "brandKitRef": "bk_1",
      "brandVersionRef": "bkv_3",
      "resolvedAt": "2026-10-06T08:30:00.000Z",
      "missing": [],
      "complete": true
    },
    "manual": {
      "postalAddress": "Example Ltd\n1 Example Street\nLondon",
      "optOutText": "Test opt-out sentence for fixtures.",
      "source": "manual",
      "updatedAt": "2026-10-06T08:30:00.000Z"
    },
    "senderNameOverride": null,
    "lastBrandResolve": {
      "kitRef": "bk_1",
      "versionRef": "bkv_3",
      "resolvedAt": "2026-10-06T08:30:00.000Z",
      "postalAddress": "Brand Ltd\n9 Lane\nBath",
      "optOutText": "Brand opt-out sentence.",
      "legalName": "Brand Ltd"
    },
    "missing": [],
    "complete": true
  },
  "brand": {
    "available": true,
    "reason": null
  }
}

Source test: sending.compliance.* actions > connects to Brand: live footer with kit and version, manual values kept and cached as last-known-good. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 200 · sending.compliance.* actions > copies the cached Brand values while Brand is down, keeping a manual address the kit lacks

Action input

{}

Actual local response

{
  "compliance": {
    "mode": "brand",
    "effective": {
      "source": "brand",
      "postalAddress": "Brand Ltd\n9 Lane\nBath",
      "optOutText": "Brand opt-out sentence.",
      "legalName": "Brand Ltd",
      "brandKitRef": "bk_1",
      "brandVersionRef": "bkv_3",
      "resolvedAt": "2026-10-06T08:30:00.000Z",
      "missing": [],
      "complete": true
    },
    "manual": {
      "postalAddress": "Brand Ltd\n9 Lane\nBath",
      "optOutText": "Brand opt-out sentence.",
      "source": "brand",
      "updatedAt": "2026-10-06T08:30:00.000Z"
    },
    "senderNameOverride": null,
    "lastBrandResolve": {
      "kitRef": "bk_1",
      "versionRef": "bkv_3",
      "resolvedAt": "2026-10-06T08:30:00.000Z",
      "postalAddress": "Brand Ltd\n9 Lane\nBath",
      "optOutText": "Brand opt-out sentence.",
      "legalName": "Brand Ltd"
    },
    "missing": [],
    "complete": true
  },
  "brand": {
    "available": true,
    "reason": null
  }
}

Source test: sending.compliance.* actions > copies the cached Brand values while Brand is down, keeping a manual address the kit lacks. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Effects and response meaning

• Switch the footer to brand mode: every message rendered from now on takes its postal address (communications.legalFooter.registeredAddress) and opt-out sentence (communications.legalFooter.unsubscribeText) live from the Brand kit bound to this workspace for Engage, so a new kit version is picked up on the next render. Brand is checked first: 424 brand_not_connected when Brand is not connected to Engage, 424 brand_unavailable when Brand cannot be reached or no kit is bound, 409 brand_postal_address_missing when the kit has no registered address; the mode is unchanged in every error case. The resolved kit is cached as last-known-good. Manual values are kept. Already rendered and approved messages keep their footer. Verify with sending.compliance.get (mode brand, effective.source brand); roll back with sending.compliance.disconnect_brand.

Verify the outcome

• Check the response against the declared output schema and the requested operation. For mutations, use the action-specific read described in the action description before any dependent operation.

Recover

For an uncertain result, inspect current retained state with a read action before retrying. Do not replay a mutation unless its contract explicitly guarantees idempotency.

Refused requests

Captured HTTP 424 · runDueSends > renders the footer from manual settings and the sender name override, with Brand down

Action input

{}

Actual local response

{
  "error": {
    "code": "brand_unavailable",
    "message": "Brand could not be reached. The footer mode was not changed; try again later."
  }
}

Source test: runDueSends > renders the footer from manual settings and the sender name override, with Brand down. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 403 · sending.compliance.* actions > validates input and permission

Action input

{}

Actual local response

{
  "error": {
    "code": "permission_denied",
    "message": "The credential lacks workspace:write.",
    "details": {
      "requiredPermission": "workspace:write"
    }
  }
}

Source test: sending.compliance.* actions > validates input and permission. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 424 · sending.compliance.* actions > refuses to connect when Brand is not connected, unbound, unreachable or has no address, leaving the mode unchanged

Action input

{}

Actual local response

{
  "error": {
    "code": "brand_not_connected",
    "message": "Brand is not connected to Engage. Keep the footer in manual mode."
  }
}

Source test: sending.compliance.* actions > refuses to connect when Brand is not connected, unbound, unreachable or has no address, leaving the mode unchanged. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 409 · sending.compliance.* actions > refuses to connect when Brand is not connected, unbound, unreachable or has no address, leaving the mode unchanged

Action input

{}

Actual local response

{
  "error": {
    "code": "brand_postal_address_missing",
    "message": "The Brand kit has no registered address in its email legal footer. Add one in Brand, then connect again."
  }
}

Source test: sending.compliance.* actions > refuses to connect when Brand is not connected, unbound, unreachable or has no address, leaving the mode unchanged. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 424 · sending.compliance.* actions > refuses to connect when Brand is not connected, unbound, unreachable or has no address, leaving the mode unchanged

Action input

{}

Actual local response

{
  "error": {
    "code": "brand_unavailable",
    "message": "No published Brand kit is bound to this workspace for Engage. The footer mode was not changed."
  }
}

Source test: sending.compliance.* actions > refuses to connect when Brand is not connected, unbound, unreachable or has no address, leaving the mode unchanged. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Error recovery

• HTTP 424 brand_unavailable: Preserve the request and inspect the declared dependency state. Retry only after the transient or configuration cause is resolved; do not infer that the operation completed.
• HTTP 403 permission_denied: Stop and inspect the current credential and selected resource. It needs workspace:write; do not broaden access or switch organization automatically.
• HTTP 424 brand_not_connected: Read the refusal details and current action contract, correct the stated cause, then validate and plan again. Do not retry unchanged or infer success.
• HTTP 409 brand_postal_address_missing: Read the refusal details and current action contract, correct the stated cause, then validate and plan again. Do not retry unchanged or infer success.

Related actions

• Get sending settings
• Update sending settings
• Get compliance footer
• Update manual compliance footer
• Disconnect compliance footer from Brand kit
• Get sender health policy
• Update sender health policy
• Get WhatsApp sending settings
• Update WhatsApp sending settings

Evidence and limits

• /api/sending-settings/compliance/connect-brand

• Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

• Widget/bootstrap use actual app handler but mocked worker runtime and app identity.

• No gateway execution, live permissions, external delivery or deployed proof.

These are local route captures with synthetic identity and simulated dependencies. They do not prove live authorization, gateway execution, production state, or external delivery.