Subscribe contact with evidence

Subscribe a contact to an active topic on the strength of evidence. consent_decision (provider, decisionRef, purposeId) always subscribes, also after an unsubscribe. import_attestation (importId, lawfulBasis; attestedBy is the caller) is accepted only as the contact's very first subscription to the topic, never after an unsubscribe, and never for a topic with doubleOptIn true. For double opt-in use subscriptions.request_confirmation instead; double_opt_in evidence is only ever produced by the public confirmation link. Marketing delivered through Nexus is attested to Nexus from the latest double opt-in, repermission or consent_decision record; an import_attestation alone is not consent and the send skips with no_consent_evidence.

Outcome

Before you start

Verify identity and pin the intended organization and environment before discovering the action.
Discover a granted Nurture workspace. The application permission is workspace:write; required workspace access is read_write. A permission alone does not supply a workspace grant.
Organization and workspace come from verified context. Select resourceType/resourceId separately from action input; body fields cannot grant a different organization or workspace. The first authorized product action can initialize an identity-only workspace mirror.
Obtain authorization for the documented effect or personal-data export before supplying CLI --confirm or MCP confirm:true.

Discover the target

topolo whoami --json
topolo actions get app_topolo_nurture.subscriptions.subscribe --detail --json
topolo resources topolo-nurture --json
topolo workspaces list topolo-nurture --json
topolo actions get app_topolo_nurture.contacts.list --detail --json

id: Nurture contact id in the selected workspace.

Request

POST /api/contacts/{id}/subscriptions

Save action input as payload.json. The reviewed plan separates path identifiers, query fields and HTTP body. Set NURTURE_WORKSPACE_ID from granted resource discovery; it is separate from action input.

Inspect and test this action in the signed action console. A test response still requires the verification below.

Input fields

Field	Required	Type	Constraints
`id`	Required	string	Nurture contact id in the selected workspace. {"minLength":1,"maxLength":64}
`topicKey`	Required	string	{"pattern":"^[a-z0-9][a-z0-9_-]{0,62}$"}
`evidence`	Required	See schema	{}

Exact input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 64
    },
    "topicKey": {
      "type": "string",
      "pattern": "^[a-z0-9][a-z0-9_-]{0,62}$"
    },
    "evidence": {
      "oneOf": [
        {
          "type": "object",
          "properties": {
            "kind": {
              "type": "string",
              "const": "consent_decision"
            },
            "provider": {
              "type": "string",
              "minLength": 1,
              "maxLength": 80
            },
            "decisionRef": {
              "type": "string",
              "minLength": 1,
              "maxLength": 200
            },
            "purposeId": {
              "type": "string",
              "minLength": 1,
              "maxLength": 120
            }
          },
          "required": [
            "kind",
            "provider",
            "decisionRef",
            "purposeId"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "kind": {
              "type": "string",
              "const": "import_attestation"
            },
            "importId": {
              "type": "string",
              "minLength": 1,
              "maxLength": 120
            },
            "lawfulBasis": {
              "type": "string",
              "enum": [
                "consent",
                "legitimate_interest",
                "contract"
              ]
            }
          },
          "required": [
            "kind",
            "importId",
            "lawfulBasis"
          ],
          "additionalProperties": false
        }
      ]
    }
  },
  "required": [
    "id",
    "topicKey",
    "evidence"
  ],
  "additionalProperties": false
}

Effects

Appends one subscribed_with_evidence event to the contact's subscription stream. Nothing is sent to the contact.

Interpret the response

The returned identifier path is $.subscription.topicKey for contact_subscription. Empty lists do not discover a target.

Call app_topolo_nurture.subscriptions.list and confirm the topic's state is subscribed.

Exact success schema:

{
  "type": "object",
  "required": [
    "subscription"
  ],
  "properties": {
    "subscription": {
      "type": "object",
      "required": [
        "topicKey",
        "state"
      ],
      "properties": {
        "topicKey": {
          "type": "string"
        },
        "topicId": {
          "type": "string"
        },
        "topicName": {
          "type": "string"
        },
        "doubleOptIn": {
          "type": "boolean"
        },
        "state": {
          "type": "string",
          "enum": [
            "none",
            "pending_confirmation",
            "subscribed",
            "unsubscribed"
          ]
        },
        "since": {
          "type": [
            "string",
            "null"
          ]
        },
        "evidence": {
          "type": [
            "array",
            "null"
          ],
          "items": {
            "type": "object"
          }
        }
      }
    }
  }
}

Worked examples

Actual dispatcher and migration-created SQLite or Worker handlers; identity/workspace and external service dependencies are simulated. Fixture identifiers and timestamps are synthetic. These responses establish no live authorization, paid generation, credential provisioning or message delivery. Replace synthetic identifiers using credential-scoped discovery. A local success is not evidence of a deployed effect, configured provider or delivered message.

Successful request

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{
  "id": "nct_5343bec9ee3743269b15515100f009ff",
  "topicKey": "news",
  "evidence": {
    "kind": "consent_decision",
    "provider": "signup-form",
    "decisionRef": "form_1",
    "purposeId": "news"
  }
}

CLI:

topolo actions validate app_topolo_nurture.subscriptions.subscribe --data @payload.json --json
topolo actions plan app_topolo_nurture.subscriptions.subscribe --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_nurture.subscriptions.subscribe --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_nurture.subscriptions.subscribe",
    "input": {
      "id": "nct_5343bec9ee3743269b15515100f009ff",
      "topicKey": "news",
      "evidence": {
        "kind": "consent_decision",
        "provider": "signup-form",
        "decisionRef": "form_1",
        "purposeId": "news"
      }
    },
    "resourceType": "workspace",
    "resourceId": "<identifier returned by resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 201:

{
  "subscription": {
    "topicKey": "news",
    "topicId": "topic_921562fd62f9455d8413b97c201b3367",
    "topicName": "News",
    "doubleOptIn": true,
    "state": "subscribed",
    "since": "2026-10-01T00:24:00.001Z",
    "evidence": [
      {
        "kind": "consent_decision",
        "provider": "signup-form",
        "decisionRef": "form_1",
        "purposeId": "news"
      }
    ]
  }
}

HTTP 201. Call app_topolo_nurture.subscriptions.list and confirm the topic's state is subscribed.

Another supported request

Input · payload.json:

{
  "id": "nct_08d797fb395b4a4199a35d787aee9aaa",
  "topicKey": "news",
  "evidence": {
    "kind": "consent_decision",
    "provider": "signup-form",
    "decisionRef": "form_1",
    "purposeId": "news"
  }
}

CLI:

topolo actions validate app_topolo_nurture.subscriptions.subscribe --data @payload.json --json
topolo actions plan app_topolo_nurture.subscriptions.subscribe --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_nurture.subscriptions.subscribe --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_nurture.subscriptions.subscribe",
    "input": {
      "id": "nct_08d797fb395b4a4199a35d787aee9aaa",
      "topicKey": "news",
      "evidence": {
        "kind": "consent_decision",
        "provider": "signup-form",
        "decisionRef": "form_1",
        "purposeId": "news"
      }
    },
    "resourceType": "workspace",
    "resourceId": "<identifier returned by resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 201:

{
  "subscription": {
    "topicKey": "news",
    "topicId": "topic_435f69a6fed94bda858f258f5350188f",
    "topicName": "News",
    "doubleOptIn": true,
    "state": "subscribed",
    "since": "2026-10-01T09:00:00.000Z",
    "evidence": [
      {
        "kind": "consent_decision",
        "provider": "signup-form",
        "decisionRef": "form_1",
        "purposeId": "news"
      }
    ]
  }
}

HTTP 201. Call app_topolo_nurture.subscriptions.list and confirm the topic's state is subscribed.

Refused request · not_found

Input · payload.json:

{
  "id": "nct_4945f75a6f054baa89c0d210c36204ed",
  "topicKey": "news",
  "evidence": {
    "kind": "consent_decision",
    "provider": "signup-form",
    "decisionRef": "form_1",
    "purposeId": "news"
  }
}

CLI:

topolo actions validate app_topolo_nurture.subscriptions.subscribe --data @payload.json --json
topolo actions plan app_topolo_nurture.subscriptions.subscribe --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 404:

{
  "error": {
    "code": "not_found",
    "message": "Contact was not found in this workspace."
  }
}

HTTP 404. Preserve the refusal details and do not claim success.

Refused request · evidence_insufficient

Input · payload.json:

{
  "id": "nct_f032e86686be431b9f2e77c3b7a0e491",
  "topicKey": "digest",
  "evidence": {
    "kind": "import_attestation",
    "importId": "imp_1",
    "lawfulBasis": "consent"
  }
}

CLI:

topolo actions validate app_topolo_nurture.subscriptions.subscribe --data @payload.json --json
topolo actions plan app_topolo_nurture.subscriptions.subscribe --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 409:

{
  "error": {
    "code": "evidence_insufficient",
    "message": "An import attestation only counts for a first subscription; send a consent decision or use double opt-in."
  }
}

HTTP 409. Preserve the refusal details and do not claim success.

Refused request · double_opt_in_required

Input · payload.json:

{
  "id": "nct_d6a1f31f64654ac3888804eef09e2588",
  "topicKey": "news",
  "evidence": {
    "kind": "import_attestation",
    "importId": "imp_1",
    "lawfulBasis": "consent"
  }
}

CLI:

topolo actions validate app_topolo_nurture.subscriptions.subscribe --data @payload.json --json
topolo actions plan app_topolo_nurture.subscriptions.subscribe --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 409:

{
  "error": {
    "code": "double_opt_in_required",
    "message": "This topic requires double opt-in; request a confirmation or record a consent decision."
  }
}

HTTP 409. Preserve the refusal details and do not claim success.

Verify the result

Call app_topolo_nurture.subscriptions.list and confirm the topic's state is subscribed.

Errors and recovery

organization_required (HTTP 403): Select an organization available to the verified caller before choosing a Nurture workspace.
permission_denied (HTTP 403): Grant the credential the required Nurture workspace permission.
workspace_required (HTTP 409): Create a Nurture workspace, or pass the workspace resource context.
invalid_input (HTTP 422): Correct the fields named in error.details using inputSchema, then retry.
not_found (HTTP 404): List contacts to find a valid id in this workspace.
topic_unavailable (HTTP 422): Call app_topolo_nurture.subscription_topics.list and use the key of an active topic.
double_opt_in_required (HTTP 409): The topic requires double opt-in: call app_topolo_nurture.subscriptions.request_confirmation or send a consent_decision.
evidence_insufficient (HTTP 409): An import attestation does not count here; send consent_decision evidence or use double opt-in.

Auth or gateway failures may precede this handler. Preserve the exact response shape, error string/code, request id and credential context; no synthetic fixture establishes live credential access.

Recovery boundary

Unsubscribe the contact from the topic; the history is kept.

List contact subscriptions: Read a contact's subscription state for every active topic of the workspace: none, pending_confirmation, subscribed or unsubscribed, with since and the evidence that subscribed them. State is resolved by @topolo-io/audience from Nurture's own subscription stream and suppression ledger; an unsubscribe is always a ledger event.
Unsubscribe contact from topic: Unsubscribe a contact from one topic (active or archived) by appending a topic-scoped unsubscribed event to the suppression ledger, the single source of unsubscribes. Marketing for that topic is blocked until the contact re-subscribes with double opt-in or a consent decision.

Evidence

Actual dispatcher and migration-created SQLite or Worker handlers; identity/workspace and external service dependencies are simulated. Fixture identifiers and timestamps are synthetic. These responses establish no live authorization, paid generation, credential provisioning or message delivery. Test scenario and capture digests are retained with each fixture.

Subscribe contact with evidence

Outcome

Before you start

Discover the target

Request

Input fields

Effects

Interpret the response

Worked examples

Successful request

Another supported request

Refused request · not_found

Refused request · evidence_insufficient

Refused request · double_opt_in_required

Verify the result

Errors and recovery

Recovery boundary

Related actions

Evidence