MyTCRPlus API Documentation | Complete Developer Guide

API Overview

The MyTCRPlus API provides programmatic access to our comprehensive suite of TCPA and TCR (10DLC) compliance tools. Built for enterprises, compliance teams, and developers who need to validate brand information, messaging content, and ensure regulatory compliance for SMS campaigns.

Base URL

https://api.mytcrplus.com/v1

Key Features

JWT Authentication

Secure token-based auth with 30-day expiration

16 Compliance Tools

Complete validation, preview, templates, and calendar

Token-Based Usage

1 token per tool use, daily free token available

Production Ready

Rate limiting, CORS, comprehensive security

RESTful Design

JSON responses, standard HTTP methods

Token Purchase Integration

Seamless token purchasing and provisioning

API Capabilities

Brand Validation - Verify EIN, legal name, domain, and business information
Carrier Compliance - Scan carrier-specific requirements and rules
Consent Validation - Ensure proper consent mechanisms and language
Message Analysis - Validate SMS content for TCPA compliance
Document Generation - Create compliance documentation templates
Error Diagnostics - Decode TCR error codes and rejection reasons
ROI Analysis - Calculate build vs buy cost comparisons
Trust Scoring - Assess brand trust factors for registration
Approval Database - Query carrier approval rates by use case and trust score
Opt-Out Auditor - Validate opt-out keyword handling and compliance
Template Library - Access compliant message templates by category
Campaign Preview - Preview campaigns across different carriers
Diff Checker - Compare campaign changes for resubmission needs
Compliance Calendar - Generate registration timeline with milestones
Provider Checklists - Get provider-specific setup requirements
Use Case Selection - Recommend optimal TCR use case based on needs

Quick Start Guide

Get started with the MyTCRPlus API in 3 simple steps:

Step 1: Register an Account

curl -X POST https://api.mytcrplus.com/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "email": "your@email.com",
    "password": "SecurePass123!",
    "firstName": "John",
    "lastName": "Doe"
  }'

You'll receive 2 free trial tokens immediately

Step 2: Login to Get JWT Token

curl -X POST https://api.mytcrplus.com/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "your@email.com",
    "password": "SecurePass123!"
  }'

Save the returned token for subsequent requests

Step 3: Use a Compliance Tool

curl -X POST https://api.mytcrplus.com/v1/tools/brand-checker \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -d '{
    "ein": "12-3456789",
    "legalName": "Acme Corporation",
    "websiteDomain": "acme.com",
    "state": "CA",
    "businessType": "corporation"
  }'

This will consume 1 token and return compliance results

Free Daily Token

Every user gets 1 free token per day! Check /v1/tokens/check-daily-free to see if yours is available.

Authentication

All API requests (except registration, login, and health check) require a valid JWT token. Tokens are issued upon successful login and must be included in the Authorization header.

Request Header Format

Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...

Token Specifications

Property	Value	Description
`Algorithm`	HS256	HMAC with SHA-256
`Expiration`	30 days	Configurable via JWT_EXPIRY
`Payload`	userId, email, iat, exp	User identification and timestamps
`Storage`	Client-side	Stateless authentication

Password Requirements

Minimum 8 characters, maximum 72 characters
At least one uppercase letter (A-Z)
At least one lowercase letter (a-z)
At least one number (0-9)
At least one special character (!@#$%^&*)

Security Best Practices

Never expose JWT tokens in client-side code or public repositories
Store tokens securely (HttpOnly cookies or secure storage)
Implement token refresh logic before 30-day expiration
Use HTTPS for all API communications
Passwords are hashed with Argon2id (64MB memory, 4 iterations)

Authentication Endpoints

POST /v1/auth/register

Request Body

Parameter	Type	Required	Description
`email`	string	Required	Valid email address (must be unique)
`password`	string	Required	Must meet password requirements
`firstName`	string	Required	User's first name (max 50 chars)
`lastName`	string	Optional	User's last name (max 50 chars)

{
  "email": "user@example.com",
  "password": "SecurePass123!",
  "firstName": "John",
  "lastName": "Doe"
}

Response (201 Created)

{
  "success": true,
  "message": "Registration successful",
  "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
  "user": {
    "id": 1,
    "email": "user@example.com",
    "firstName": "John",
    "lastName": "Doe",
    "tokenBalance": 2,
    "trialTokensUsed": true,
    "lastDailyFreeDate": null,
    "createdAt": "2026-01-12T10:30:00Z"
  }
}

Error Responses

400 - Invalid email format or password doesn't meet requirements
409 - Email already registered
429 - Rate limit exceeded (3 attempts per 15 minutes)

POST /v1/auth/login

Authenticate with existing credentials and receive a JWT token valid for 30 days.

Request Body

Parameter	Type	Required	Description
`email`	string	Required	Registered email address
`password`	string	Required	User password

{
  "email": "user@example.com",
  "password": "SecurePass123!"
}

Response (200 OK)

{
  "success": true,
  "message": "Login successful",
  "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
  "user": {
    "id": 1,
    "email": "user@example.com",
    "firstName": "John",
    "lastName": "Doe",
    "tokenBalance": 195,
    "trialTokensUsed": true,
    "lastDailyFreeDate": "2026-01-12",
    "createdAt": "2026-01-10T14:20:00Z"
  }
}

Error Responses

400 - Missing email or password
401 - Invalid credentials or account locked
429 - Rate limit exceeded (5 attempts per 15 minutes)

After 5 failed login attempts, the account is locked for 30 minutes.

GET /v1/auth/verify Auth Required

Verify that your JWT token is valid and retrieve current user information.

Headers Required

Authorization: Bearer YOUR_JWT_TOKEN

Response (200 OK)

{
  "success": true,
  "user": {
    "id": 1,
    "email": "user@example.com",
    "firstName": "John",
    "lastName": "Doe",
    "tokenBalance": 195,
    "trialTokensUsed": true,
    "lastDailyFreeDate": "2026-01-12",
    "createdAt": "2026-01-10T14:20:00Z"
  }
}

Error Responses

401 - Missing, invalid, or expired token

POST /v1/auth/logout Auth Required

Logout endpoint for client-side token cleanup. Since authentication is stateless (JWT), this endpoint simply confirms the request. Clients should delete the stored token.

Response (200 OK)

{
  "success": true,
  "message": "Logout successful"
}

POST /v1/auth/forgot-password

Request a password reset token. An email will be sent with reset instructions (email functionality pending implementation).

Request Body

Parameter	Type	Required	Description
`email`	string	Required	Registered email address

{
  "email": "user@example.com"
}

Response (200 OK)

{
  "success": true,
  "message": "Password reset instructions sent to email"
}

Reset tokens expire after 1 hour and can only be used once.

POST /v1/auth/reset-password

Reset password using the token received via email.

Request Body

Parameter	Type	Required	Description
`token`	string	Required	Reset token from email
`newPassword`	string	Required	New password (must meet requirements)

{
  "token": "abc123def456...",
  "newPassword": "NewSecurePass123!"
}

Response (200 OK)

{
  "success": true,
  "message": "Password reset successful"
}

Error Responses

400 - Invalid token, expired token, or password doesn't meet requirements
429 - Rate limit exceeded (3 attempts per 15 minutes)

Token Management

Manage your usage tokens. Each compliance tool costs 1 token per use. Purchase tokens at mytcrplus.com/pricing

GET /v1/tokens/balance Auth Required

Get current token balance and daily free token availability.

Response (200 OK)

{
  "success": true,
  "balance": 195,
  "trialTokensUsed": true,
  "hasDailyFree": true
}

Response Fields

Field	Type	Description
`balance`	integer	Current token count
`trialTokensUsed`	boolean	Whether trial tokens were granted
`hasDailyFree`	boolean	Whether daily free token is available today

GET /v1/tokens/check-daily-free Auth Required

Check if the daily free token is available (without claiming it).

Response (200 OK)

{
  "success": true,
  "available": true,
  "lastClaimed": "2026-01-11"
}

POST /v1/tokens/use Auth Required

Manually deduct tokens (typically called internally by tool endpoints).

Request Body

Parameter	Type	Required	Description
`toolName`	string	Required	Name of the tool being used
`amount`	integer	Optional	Number of tokens (default: 1)

{
  "toolName": "Brand Checker",
  "amount": 1
}

Response (200 OK)

{
  "success": true,
  "balance": 194,
  "usedDailyFree": false
}

Error Responses

402 - Insufficient tokens (need to purchase more)

GET /v1/tokens/history?limit=50&offset=0 Auth Required

Get paginated transaction history with all token activities.

Query Parameters

Parameter	Type	Default	Description
`limit`	integer	50	Number of records (max 100)
`offset`	integer	0	Pagination offset

Response (200 OK)

{
  "success": true,
  "transactions": [
    {
      "id": 123,
      "type": "usage",
      "amount": -1,
      "balanceAfter": 194,
      "toolName": "Brand Checker",
      "notes": null,
      "orderId": null,
      "subscriptionId": null,
      "createdAt": "2026-01-12 15:30:00"
    },
    {
      "id": 122,
      "type": "daily_free",
      "amount": 1,
      "balanceAfter": 195,
      "toolName": null,
      "notes": "Daily free token",
      "orderId": null,
      "subscriptionId": null,
      "createdAt": "2026-01-12 09:00:00"
    },
    {
      "id": 121,
      "type": "purchase",
      "amount": 100,
      "balanceAfter": 194,
      "toolName": null,
      "notes": "Token package purchase",
      "orderId": 5678,
      "subscriptionId": null,
      "createdAt": "2026-01-11 14:20:00"
    }
  ],
  "total": 45,
  "limit": 50,
  "offset": 0
}

Transaction Types

trial - Initial 2 free tokens on registration
purchase - Tokens purchased from token store
daily_free - Daily free token grant
usage - Token used for a tool (negative amount)
refund - Token refunded

Token Packages Available

Trial: 2 tokens (free on registration)
Daily Free: 1 token per day (automatically available)
10 Tokens: Purchase at mytcrplus.com
20 Tokens: Purchase at mytcrplus.com
50 Tokens: Purchase at mytcrplus.com
100 Tokens: Purchase at mytcrplus.com

Compliance Tools (16 Tools)

Each tool endpoint requires authentication and consumes 1 token per request (unless using daily free token). All tools accept POST requests with JSON bodies and return detailed compliance analysis.

POST /v1/tools/brand-checker Auth Required 1 Token

Validates brand information for TCR registration compliance. Checks EIN format, legal name, domain ownership, and business entity details.

Request Body

Parameter	Type	Required	Description
`ein`	string	Required	Employer Identification Number (format: 12-3456789)
`legalName`	string	Required	Legal business name
`websiteDomain`	string	Required	Company website domain
`state`	string	Required	State of registration (2-letter code)
`dbaName`	string	Optional	Doing Business As name
`businessType`	string	Optional	corporation, llc, partnership, sole_proprietor, non_profit

{
  "ein": "12-3456789",
  "legalName": "Acme Corporation",
  "dbaName": "Acme Tech",
  "websiteDomain": "acme.com",
  "state": "CA",
  "businessType": "corporation"
}

Response (200 OK)

{
  "success": true,
  "tool": "brand-checker",
  "tokenUsed": true,
  "balanceAfter": 194,
  "results": {
    "status": "pass",
    "score": 95,
    "errorCount": 0,
    "warningCount": 1,
    "passCount": 6,
    "checks": [
      {
        "status": "pass",
        "category": "EIN Format",
        "message": "EIN format valid (XX-XXXXXXX)",
        "details": "Format matches IRS requirements"
      },
      {
        "status": "pass",
        "category": "Legal Name",
        "message": "Legal name provided",
        "details": "Contains required entity designation"
      },
      {
        "status": "warning",
        "category": "Domain Age",
        "message": "Domain age not verified",
        "details": "Domains older than 30 days are preferred"
      }
    ]
  }
}

POST /v1/tools/message-validator Auth Required 1 Token

Validates SMS/MMS message content for TCPA compliance. Checks length, opt-out language, prohibited content, and segment count.

Request Body

Parameter	Type	Required	Description
`message`	string	Required	SMS message text to validate
`messageType`	string	Optional	promotional, transactional, conversational

{
  "message": "Get 20% off today! Reply STOP to unsubscribe. Terms at example.com/terms",
  "messageType": "promotional"
}

Response (200 OK)

{
  "success": true,
  "tool": "message-validator",
  "tokenUsed": true,
  "balanceAfter": 193,
  "results": {
    "status": "pass",
    "messageLength": 75,
    "segments": 1,
    "encoding": "GSM-7",
    "errorCount": 0,
    "warningCount": 0,
    "passCount": 5,
    "checks": [
      {
        "status": "pass",
        "category": "Message Length",
        "message": "Single segment message (75 characters)"
      },
      {
        "status": "pass",
        "category": "Opt-Out Language",
        "message": "Contains valid opt-out instruction (STOP)"
      }
    ]
  }
}

POST /v1/tools/carrier-scanner Auth Required 1 Token

Scans carrier-specific requirements and rules for major US carriers (Verizon, AT&T, T-Mobile, etc.).

Request Body

Parameter	Type	Required	Description
`carriers`	array	Optional	Specific carriers to check (or all if omitted)
`useCase`	string	Optional	Campaign use case type

{
  "carriers": ["verizon", "att", "tmobile"],
  "useCase": "marketing"
}

POST /v1/tools/consent-validator Auth Required 1 Token

Validates consent mechanisms and language for TCPA compliance. Ensures proper express written consent.

Request Body

Parameter	Type	Required	Description
`consentText`	string	Required	Consent language to validate
`consentMethod`	string	Optional	checkbox, signature, web_form, sms_optin

{
  "consentText": "By checking this box, I agree to receive marketing texts from Acme Corp at the number provided. Message frequency varies. Message and data rates may apply. Reply STOP to cancel.",
  "consentMethod": "checkbox"
}

POST /v1/tools/roi-calculator Auth Required 1 Token

Calculate ROI comparing build vs buy for compliance platform. Includes development costs, timeline, and opportunity costs.

Request Body

Parameter	Type	Required	Description
`campaignCount`	integer	Required	Number of campaigns to manage
`brandCount`	integer	Required	Number of brands
`launchTimeline`	integer	Required	Desired launch timeline (months)
`devRate`	number	Optional	Developer hourly rate (default: 150)
`complianceRate`	number	Optional	Compliance expert rate (default: 200)

{
  "campaignCount": 10,
  "brandCount": 2,
  "launchTimeline": 6,
  "devRate": 175,
  "complianceRate": 225,
  "annualRevenue": 1000000
}

Response (200 OK)

{
  "success": true,
  "tool": "roi-calculator",
  "tokenUsed": true,
  "results": {
    "build": {
      "total": 892500,
      "development": 420000,
      "compliance": 180000,
      "infrastructure": 72000,
      "maintenance": 120000,
      "opportunityCost": 100500,
      "devHours": 2400,
      "timeline": "12-18 months"
    },
    "buy": {
      "total": 47000,
      "setup": 5000,
      "monthly": 3500,
      "annual": 42000
    },
    "savings": 845500,
    "roi": 94.7,
    "paybackPeriod": "1.2 months",
    "recommendation": "Buy solution recommended"
  }
}

POST /v1/tools/trust-score Auth Required 1 Token

Calculate trust score for TCR brand registration based on business verification factors.

Request Body

Parameter	Type	Required	Description
`yearsInBusiness`	integer	Required	Years company has been operating
`hasDUNS`	boolean	Required	Has D-U-N-S number
`hasDomain`	boolean	Required	Has registered domain
`domainAge`	integer	Optional	Domain age in years
`hasPhysicalAddress`	boolean	Optional	Has verified physical address
`hasPrivacyPolicy`	boolean	Optional	Has published privacy policy
`hasTermsOfService`	boolean	Optional	Has published terms of service
`previousCompliance`	boolean	Optional	Previous compliance history

{
  "yearsInBusiness": 7,
  "hasDUNS": true,
  "hasDomain": true,
  "domainAge": 5,
  "hasPhysicalAddress": true,
  "hasPrivacyPolicy": true,
  "hasTermsOfService": true,
  "previousCompliance": true
}

Response (200 OK)

{
  "success": true,
  "tool": "trust-score",
  "tokenUsed": true,
  "results": {
    "score": 92,
    "maxScore": 100,
    "percentage": 92,
    "rating": "Excellent",
    "breakdown": [
      {
        "category": "Business Age",
        "points": 20,
        "maxPoints": 20,
        "status": "pass"
      },
      {
        "category": "DUNS Number",
        "points": 15,
        "maxPoints": 15,
        "status": "pass"
      }
    ],
    "recommendations": [
      "Excellent trust profile for TCR registration",
      "High likelihood of approval"
    ]
  }
}

POST /v1/tools/error-diagnostic Auth Required 1 Token

Diagnose TCR error codes and get detailed explanations with resolution steps.

Request Body

Parameter	Type	Required	Description
`errorCode`	string	Required	TCR error code or message
`context`	string	Optional	Additional error context

{
  "errorCode": "BRAND_IDENTITY_MISMATCH",
  "context": "EIN verification failed"
}

POST /v1/tools/rejection-decoder Auth Required 1 Token

Decode campaign or brand rejection reasons with actionable remediation steps.

Request Body

Parameter	Type	Required	Description
`rejectionReason`	string	Required	Rejection reason text
`entityType`	string	Optional	brand or campaign

{
  "rejectionReason": "Insufficient brand vetting documentation",
  "entityType": "brand"
}

POST /v1/tools/document-generator Auth Required 1 Token

Generate compliance documentation templates (privacy policies, consent forms, terms of service).

Request Body

Parameter	Type	Required	Description
`documentType`	string	Required	privacy_policy, terms_of_service, consent_form
`companyName`	string	Required	Company name for document
`additionalInfo`	object	Optional	Additional customization data

{
  "documentType": "consent_form",
  "companyName": "Acme Corporation",
  "additionalInfo": {
    "contactEmail": "privacy@acme.com",
    "messageTypes": ["promotional", "transactional"]
  }
}

POST /v1/tools/provider-checklist Auth Required 1 Token

Get provider-specific requirements checklist for major messaging platforms (Twilio, Bandwidth, Sinch, etc.).

Request Body

Parameter	Type	Required	Description
`provider`	string	Required	twilio, bandwidth, sinch, telnyx, vonage
`useCase`	string	Optional	Campaign use case type

{
  "provider": "twilio",
  "useCase": "marketing"
}

POST /v1/tools/use-case-selector Auth Required 1 Token

Recommend the appropriate TCR use case based on campaign characteristics and messaging patterns.

Request Body

Parameter	Type	Required	Description
`campaignDescription`	string	Required	Description of campaign purpose
`messageVolume`	string	Optional	low, medium, high, very_high
`hasAffiliates`	boolean	Optional	Whether campaign uses affiliates

{
  "campaignDescription": "Appointment reminders and confirmations for medical practice",
  "messageVolume": "medium",
  "hasAffiliates": false
}

POST /v1/tools/sanitize Auth Required 1 Token

Sanitize and validate various data types (HTML, email, URL, phone numbers).

Request Body

Parameter	Type	Required	Description
`type`	string	Required	escapeHTML, sanitizeEmail, sanitizeURL, sanitizePhone
`input`	string	Required	Data to sanitize

{
  "type": "sanitizePhone",
  "input": "(555) 123-4567"
}

Response (200 OK)

{
  "success": true,
  "tool": "sanitize",
  "tokenUsed": true,
  "results": {
    "original": "(555) 123-4567",
    "sanitized": "+15551234567",
    "type": "phone",
    "valid": true
  }
}

POST /v1/tools/approval-db Auth Required 1 Token

Database of carrier approval rates by use case and trust score tier. Provides approval statistics, expected timeline, and recommendations.

Request Body

Parameter	Type	Required	Description
`useCase`	string	Optional	2FA, CUSTOMER_CARE, MARKETING, MIXED, DELIVERY_NOTIFICATIONS
`trustScore`	integer	Optional	Trust score 0-100 (default: 50)

{
  "useCase": "MARKETING",
  "trustScore": 60
}

Response (200 OK)

{
  "success": true,
  "tool": "approval-db",
  "results": {
    "useCase": "MARKETING",
    "trustScore": 60,
    "tier": "standard",
    "approvalRate": 60,
    "avgApprovalDays": "7-10",
    "rejectionRisk": "High",
    "recommendations": [
      "Consider obtaining a DUNS number to improve trust score",
      "Start with a transactional use case (2FA, Customer Care) first"
    ]
  }
}

POST /v1/tools/opt-out-auditor Auth Required 1 Token NEW

Audits opt-out keyword handling and compliance. Validates STOP, HELP keywords, placement, and automated processing.

Request Body

Parameter	Type	Required	Description
`message`	string	Required	Message content to audit
`hasOptOutSystem`	boolean	Optional	Whether automated opt-out system is configured

{
  "message": "BrandName: Special offer! Reply STOP to opt out.",
  "hasOptOutSystem": true
}

Response (200 OK)

{
  "success": true,
  "tool": "opt-out-auditor",
  "results": {
    "status": "compliant",
    "score": 85,
    "maxScore": 100,
    "percentage": 85,
    "checks": [
      {
        "status": "pass",
        "category": "STOP Keyword",
        "message": "Required STOP keyword present",
        "points": 30
      }
    ],
    "hasOptOutSystem": true
  }
}

POST /v1/tools/template-library Auth Required 1 Token NEW

Provides compliant message templates by category. Includes marketing, transactional, authentication, and appointment templates.

Request Body

Parameter	Type	Required	Description
`category`	string	Optional	all, marketing, transactional, authentication, appointment
`businessName`	string	Optional	Your business name to personalize templates

{
  "category": "marketing",
  "businessName": "Acme Corp"
}

Response (200 OK)

{
  "success": true,
  "tool": "template-library",
  "results": {
    "category": "marketing",
    "businessName": "Acme Corp",
    "templateCount": 2,
    "templates": [
      {
        "name": "Promotional Sale",
        "template": "Acme Corp: Flash Sale! Get 20% off...",
        "useCase": "MARKETING",
        "charCount": 145
      }
    ]
  }
}

POST /v1/tools/campaign-preview Auth Required 1 Token NEW

Previews how campaign messages will appear on different carriers. Shows delivery expectations, filtering risk, and throughput limits.

Request Body

Parameter	Type	Required	Description
`message`	string	Required	Campaign message content
`useCase`	string	Optional	Campaign use case (default: MIXED)
`trustScore`	integer	Optional	Brand trust score (default: 50)

{
  "message": "Acme: Your order is ready! Reply STOP to opt out.",
  "useCase": "CUSTOMER_CARE",
  "trustScore": 75
}

Response (200 OK)

{
  "success": true,
  "tool": "campaign-preview",
  "results": {
    "message": "Acme: Your order is ready!...",
    "length": 52,
    "segments": 1,
    "useCase": "CUSTOMER_CARE",
    "trustScore": 75,
    "carrierPreviews": {
      "ATT": {
        "carrier": "AT&T",
        "expectedDelivery": "Within 5 minutes",
        "filteringRisk": "Low",
        "displayName": "Acme",
        "throughput": "600 msg/min"
      }
    },
    "warnings": []
  }
}

POST /v1/tools/diff-checker Auth Required 1 Token NEW

Compares before/after campaign changes to determine if resubmission is required. Analyzes impact level and provides recommendations.

Request Body

Parameter	Type	Required	Description
`before`	string	Required	Original campaign content
`after`	string	Required	Modified campaign content
`type`	string	Optional	Type of content (default: message)

{
  "before": "Acme: Sale today! Reply STOP to opt out.",
  "after": "Acme Corp: Big sale! Text STOP to unsubscribe.",
  "type": "message"
}

Response (200 OK)

{
  "success": true,
  "tool": "diff-checker",
  "results": {
    "type": "message",
    "impactLevel": "medium",
    "differenceCount": 2,
    "differences": [
      {
        "category": "Business Name",
        "before": "Acme",
        "after": "Acme Corp",
        "change": "Modified",
        "impact": "high"
      }
    ],
    "recommendation": "Significant changes detected. Recommend resubmitting campaign for review."
  }
}

POST /v1/tools/compliance-calendar Auth Required 1 Token NEW

Shows registration timeline with milestones and estimated launch date. Provides day-by-day tasks based on use case and trust score.

Request Body

Parameter	Type	Required	Description
`useCase`	string	Optional	Campaign use case (default: MIXED)
`trustScore`	integer	Optional	Brand trust score 0-100 (default: 50)
`startDate`	string	Optional	Start date YYYY-MM-DD (default: today)

{
  "useCase": "MARKETING",
  "trustScore": 60,
  "startDate": "2026-02-15"
}

Response (200 OK)

{
  "success": true,
  "tool": "compliance-calendar",
  "results": {
    "useCase": "MARKETING",
    "trustScore": 60,
    "startDate": "2026-02-15",
    "estimatedLaunchDate": "2026-02-24",
    "totalDays": 9,
    "milestones": [
      {
        "day": 0,
        "date": "2026-02-15",
        "phase": "Preparation",
        "tasks": [
          "Gather EIN, business documents",
          "Prepare website compliance elements"
        ],
        "status": "pending"
      }
    ]
  }
}

Common Tool Response Fields

All tool responses include these standard fields:

success - Boolean indicating success
tool - Tool identifier
tokenUsed - Whether a token was consumed
balanceAfter - Remaining token balance
results - Tool-specific results object

TCR Credentials (Multi-Tenant)

MyTCRPlus is not a CSP. Each customer provides their own TCR CSP credentials (SID + AuthToken), which are encrypted at rest with AES-256-GCM. Credentials are stored per-user and used for all TCR API operations on that customer's behalf.

How It Works

1. Customer (or admin) saves TCR credentials via the API
2. A unique webhook_token is generated for inbound TCR callbacks
3. Customer configures their TCR portal to send webhooks to https://api.mytcrplus.com/v1/tcr-webhooks/{webhook_token}
4. All brand/campaign operations use the customer's own CSP credentials

Admin Credential Management

GET /v1/tcr/credentials Admin

List all customer TCR credentials (SID/token masked). Supports ?status=active filter and pagination.

POST /v1/tcr/credentials Admin

Create TCR credentials for a user. Returns the webhookToken and webhookUrl.

Body: { userId, tcrSid, tcrAuthToken, tcrWebhookSecret?, tcrApiBaseUrl?, label? }

GET /v1/tcr/credentials/{id} Admin

Get credential detail (SID/token masked, shows webhookUrl).

PUT /v1/tcr/credentials/{id} Admin

Update credentials. Can change SID, AuthToken, secret, label, status, or base URL.

DELETE /v1/tcr/credentials/{id} Admin

Deactivate credentials (soft-delete). Existing brands/campaigns remain but no new API calls can use these credentials.

User Self-Service

GET /v1/tcr/my-credentials Auth

View your own TCR credentials (masked). Returns null if not yet configured.

POST /v1/tcr/my-credentials Auth

Save your own TCR credentials. Returns your unique webhookUrl to configure in TCR's portal.

Body: { tcrSid, tcrAuthToken, tcrWebhookSecret?, label? }

PUT /v1/tcr/my-credentials Auth

Update your own credentials.

POST /v1/tcr/my-credentials/test Auth

Test your TCR connection. Calls GET /csp/profile with your credentials and returns the CSP display name if successful.

TCR API (10DLC Brand & Campaign Management)

Full integration with The Campaign Registry (TCR) CSP API for 10DLC brand registration, campaign management, and compliance tracking. Each customer provides their own CSP credentials (see TCR Credentials above). Admin and authenticated users with credentials can perform operations.

Access Model

Admin: Full CRUD on all brands/campaigns. Must pass credentialId or userId in the request body (or query string for GET) to specify which customer's TCR credentials to use.
Authenticated User (with credentials): Full CRUD on their own brands and campaigns. The system automatically uses their stored TCR credentials. Consumes 1 token per call.
Authenticated User (no credentials): Read-only access to their own local records (no TCR API calls). Consumes 1 token per call.

Brand Endpoints

GET /v1/tcr/brands Auth Required

List brands. Admin sees all brands. Users see only their own (token-gated).

Parameter	Type	Description
`page`	integer	Page number (default: 1)
`limit`	integer	Results per page (10-100, default: 25)
`status`	string	Filter by brand_status (PENDING, ACTIVE, FAILED, etc.)

POST /v1/tcr/brands Auth Required

Register a new brand with TCR. Creates a local record and calls the TCR CSP API. Admin must provide credentialId or userId. Users use their own credentials.

Field	Type	Description
`entityType` required	string	PRIVATE_PROFIT, PUBLIC_PROFIT, NON_PROFIT, GOVERNMENT, SOLE_PROPRIETOR
`brandName` required	string	Display name for the brand
`ein` required	string	Employer Identification Number
`phone` required	string	Business phone number
`street` required	string	Street address
`city` required	string	City
`state` required	string	State/province
`postalCode` required	string	Postal/ZIP code
`country` required	string	ISO 2-letter country code (e.g. US)
`email` required	string	Business email
`vertical` required	string	Industry vertical (use /v1/tcr/enums/verticals)
`companyName` optional	string	Legal company name (defaults to brandName)
`website` optional	string	Business website URL
`userId` optional	integer	Assign brand to a user
`altBusinessId` optional	string	Alternate business ID (DUNS, LEI, etc.)
`altBusinessIdType` optional	string	Type of alternate ID
`stockSymbol` optional	string	Stock ticker symbol
`stockExchange` optional	string	Stock exchange (NASDAQ, NYSE, etc.)

{
  "success": true,
  "message": "Brand registered with TCR",
  "localId": 42,
  "tcrBrandId": "BXXXXXX",
  "identityStatus": "SELF_DECLARED",
  "tcrResponse": { ... }
}

GET /v1/tcr/brands/{brandId} Auth Required

Get brand detail by TCR brand ID (BXXXXXX) or local numeric ID. Users can only view their own brands.

PUT /v1/tcr/brands/{brandId} Auth Required

Update an existing brand at TCR and locally. Users can only update their own brands.

DELETE /v1/tcr/brands/{brandId} Auth Required

Deregister a brand from TCR and soft-delete locally (status set to DELETED). Users can only delete their own brands.

POST /v1/tcr/brands/{brandId}/vet Auth Required

Request external vetting for a brand. Requires evpId (external vetting provider ID) in body. Users can only vet their own brands.

GET /v1/tcr/brands/{brandId}/feedback Auth Required

Get vetting feedback/results from TCR for a brand. Users can only view feedback for their own brands.

Campaign Endpoints

GET /v1/tcr/campaigns Auth Required

List campaigns. Admin sees all. Users see only their own (token-gated).

Parameter	Type	Description
`page`	integer	Page number (default: 1)
`limit`	integer	Results per page (10-100, default: 25)
`status`	string	Filter by campaign_status
`brandId`	string	Filter by TCR brand ID

POST /v1/tcr/campaigns Auth Required

Create a new campaign via the TCR campaign builder. Admin must provide credentialId or userId. Users use their own credentials.

Field	Type	Description
`brandId` required	string	TCR brand ID or local brand ID
`usecase` required	string	MIXED, MARKETING, CUSTOMER_CARE, etc.
`description` required	string	Campaign description for TCR review
`sample1` required	string	Sample message #1 (at least one required)
`messageFlow` required	string	How subscribers opt in to receive messages
`sample2-5` optional	string	Additional sample messages (up to 5)
`embeddedLink` optional	boolean	Messages contain links
`embeddedPhone` optional	boolean	Messages contain phone numbers
`numberPool` optional	boolean	Campaign uses a number pool
`subscriberOptin` optional	boolean	Opt-in supported (default: true)
`subscriberOptout` optional	boolean	Opt-out supported (default: true)
`subscriberHelp` optional	boolean	Help keyword supported (default: true)
`helpMessage` optional	string	Auto-reply to HELP keyword
`optoutMessage` optional	string	Auto-reply to STOP keyword

{
  "success": true,
  "message": "Campaign created with TCR",
  "localId": 15,
  "tcrCampaignId": "CXXXXXX",
  "status": "PENDING",
  "tcrResponse": { ... }
}

GET /v1/tcr/campaigns/{campaignId} Auth Required

Get campaign detail by TCR campaign ID (CXXXXXX) or local numeric ID. Users can only view their own.

PUT /v1/tcr/campaigns/{campaignId} Auth Required

Update an existing campaign at TCR and locally. Users can only update their own campaigns.

DELETE /v1/tcr/campaigns/{campaignId} Auth Required

Deactivate a campaign at TCR and locally. Users can only deactivate their own campaigns.

GET /v1/tcr/campaigns/{campaignId}/sharing Auth Required

Get MNO (carrier) sharing status for a campaign — which carriers accepted or rejected. Users can only view their own campaigns.

GET /v1/tcr/campaigns/{campaignId}/operation-status Auth Required

Get DCA (Direct Connect Aggregator) vetting and operation status for a campaign. Users can only view their own campaigns.

CSP Profile, Enums & Admin Utilities

GET /v1/tcr/csp-profile Auth Required

View the CSP profile at TCR using the customer's credentials. Users see their own CSP profile.

PUT /v1/tcr/csp-profile Admin Only

Update the CSP profile at TCR. Admin must provide credentialId or userId.

GET /v1/tcr/enums/{type} Auth Required

Fetch TCR enum/lookup values. Uses the caller's TCR credentials (admin must pass credentialId or userId). Valid types:

entity-types — Brand entity types (PRIVATE_PROFIT, etc.)
verticals — Industry verticals
usecases — Campaign use cases (MIXED, MARKETING, etc.)
alt-business-ids — Alt business ID types (DUNS, LEI, etc.)
brand-relationships — Brand relationship types

GET /v1/tcr/webhook-events Admin Only

View incoming TCR webhook events (brand/campaign status changes).

Parameter	Type	Description
`page`, `limit`	integer	Pagination
`status`	string	received, processed, or failed
`eventType`	string	Filter by event type
`credentialId`	integer	Filter by credential set

GET /v1/tcr/api-logs Admin Only

View outbound TCR API call logs (method, endpoint, response code, duration).

Parameter	Type	Description
`page`, `limit`	integer	Pagination
`method`	string	Filter by HTTP method (GET, POST, etc.)
`endpoint`	string	Search by API endpoint path
`credentialId`	integer	Filter by credential set

POST /v1/tcr/sync/brand/{brandId} Admin Only

Re-sync a brand from TCR — fetches latest data and updates the local record.

POST /v1/tcr/sync/campaign/{campaignId} Admin Only

Re-sync a campaign from TCR — fetches latest status, score, and updates locally.

TCR Webhooks (Inbound Callbacks)

TCR sends webhook callbacks when brand or campaign statuses change. Each customer has a unique webhook URL generated when their credentials are saved. The webhook_token in the URL identifies the customer and their HMAC secret for signature verification.

Per-Customer Webhook URL

Each customer configures their TCR portal to POST callbacks to their unique URL:

https://api.mytcrplus.com/v1/tcr-webhooks/{webhook_token}

The webhook_token is returned when credentials are created via POST /v1/tcr/credentials or POST /v1/tcr/my-credentials.

POST /v1/tcr-webhooks/{webhook_token} Server-to-Server

Receives POST callbacks from TCR. The webhook_token identifies the customer. Signature is verified via HMAC-SHA256 using the customer's stored webhook secret. Signature is expected in the X-TCR-Webhook-Signature header (hex or base64).

Supported Event Types

Brand Events

BRAND_IDENTITY_STATUS_UPDATE — Verification status changed
BRAND_STATUS_UPDATE — General brand status change
BRAND_SCORE_UPDATE — Trust score recalculated
BRAND_DELETE — Brand was deleted

Campaign Events

CAMPAIGN_DCA_COMPLETE — DCA vetting complete
CAMPAIGN_STATUS_UPDATE — Campaign status changed
CAMPAIGN_MNO_REVIEW — Carrier review update
CAMPAIGN_SHARE_STATUS_UPDATE — MNO sharing status
CAMPAIGN_EXPIRED — Campaign expired
CAMPAIGN_BILLED — Billing event

Automatic Status Sync

When a webhook is received, the local tcr_brands or tcr_campaigns table is automatically updated with the new status, score, and timestamp. Updates are scoped to the customer's credential_id for tenant isolation. All events are logged to tcr_webhook_events for auditing.

Security Features

The MyTCRPlus API implements comprehensive security measures to protect user data and prevent abuse.

Authentication & Authorization

JWT-based stateless authentication
HS256 algorithm with secure secret key
30-day token expiration
Token verification on protected endpoints

Password Security

Argon2id hashing (memory-hard)
64MB memory cost, 4 iterations
Strong password requirements enforced
Account lockout after 5 failed attempts

Data Protection

SQL injection prevention (PDO prepared statements)
XSS protection via Content-Security-Policy
CORS protection with allowed origins
Timing attack prevention (hash_equals)

HTTP Security Headers

Strict-Transport-Security (HSTS)
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

Production Security Checklist

All communications over HTTPS
Environment variables stored securely (.env never committed)
Database credentials rotated regularly
JWT secret key is cryptographically random (64 characters)
Rate limiting enabled on all endpoints
Failed login tracking and account lockout

Error Handling

All errors return appropriate HTTP status codes with a JSON error response.

Error Response Format

{
  "error": "Detailed error message describing what went wrong"
}

HTTP Status Codes

200

Request successful

201

Created

Resource created successfully (e.g., registration)

400

Bad Request

Invalid request parameters, malformed JSON, or validation errors

401

Unauthorized

Missing, invalid, or expired authentication token

402

Payment Required

Insufficient tokens - purchase more at mytcrplus.com/pricing

404

Not Found

Endpoint or resource not found

405

Method Not Allowed

HTTP method not supported for this endpoint

409

Conflict

Resource already exists (e.g., duplicate email registration)

429

Too Many Requests

Rate limit exceeded - wait before retrying

500

Internal Server Error

Server error - contact support if persistent

Common Error Examples

Invalid JWT Token

{
  "error": "Invalid or expired token"
}

Insufficient Tokens

{
  "error": "Insufficient tokens. Please purchase more tokens at mytcrplus.com"
}

Validation Error

{
  "error": "Password must be at least 8 characters and contain uppercase, lowercase, number, and special character"
}

Rate Limit Exceeded

{
  "error": "Too many requests. Please try again later."
}

Rate Limiting

API requests are rate-limited by IP address to prevent abuse and ensure fair usage. Rate limits vary by endpoint type.

Rate Limit Configuration

Endpoint Type	Max Requests	Time Window	Tracking
General API	20	15 minutes	By IP address
Login	5	15 minutes	By IP address
Registration	3	15 minutes	By IP address
Password Reset	3	15 minutes	By IP address

General requests per 15-minute window

Rate Limit Response

When rate limit is exceeded, you'll receive a 429 Too Many Requests response:

{
  "error": "Too many requests. Please try again later."
}

Account Lockout Policy

After 5 failed login attempts, accounts are locked for 30 minutes to prevent brute force attacks.

Tracks failed attempts by email address and IP
30-minute automatic unlock
Manual unlock via password reset

Code Examples

JavaScript/Node.js

// Register and login
const registerResponse = await fetch('https://api.mytcrplus.com/v1/auth/register', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    email: 'user@example.com',
    password: 'SecurePass123!',
    firstName: 'John',
    lastName: 'Doe'
  })
});

const { token, user } = await registerResponse.json();
console.log(`Registered with ${user.tokenBalance} tokens`);

// Use brand checker tool
const brandResponse = await fetch('https://api.mytcrplus.com/v1/tools/brand-checker', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': `Bearer ${token}`
  },
  body: JSON.stringify({
    ein: '12-3456789',
    legalName: 'Acme Corporation',
    websiteDomain: 'acme.com',
    state: 'CA',
    businessType: 'corporation'
  })
});

const brandResult = await brandResponse.json();
console.log(`Brand check status: ${brandResult.results.status}`);
console.log(`Score: ${brandResult.results.score}/100`);
console.log(`Tokens remaining: ${brandResult.balanceAfter}`);

// Check token balance
const balanceResponse = await fetch('https://api.mytcrplus.com/v1/tokens/balance', {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${token}`
  }
});

const balance = await balanceResponse.json();
console.log(`Current balance: ${balance.balance} tokens`);

Python

import requests

# Login
login_data = {
    'email': 'user@example.com',
    'password': 'SecurePass123!'
}

response = requests.post(
    'https://api.mytcrplus.com/v1/auth/login',
    json=login_data
)

data = response.json()
token = data['token']
print(f"Logged in with {data['user']['tokenBalance']} tokens")

# Use message validator
headers = {
    'Content-Type': 'application/json',
    'Authorization': f'Bearer {token}'
}

message_data = {
    'message': 'Get 20% off! Reply STOP to unsubscribe.',
    'messageType': 'promotional'
}

response = requests.post(
    'https://api.mytcrplus.com/v1/tools/message-validator',
    json=message_data,
    headers=headers
)

result = response.json()
print(f"Message status: {result['results']['status']}")
print(f"Segments: {result['results']['segments']}")
print(f"Balance: {result['balanceAfter']}")

PHP

 'user@example.com',
    'password' => 'SecurePass123!'
];

$ch = curl_init('https://api.mytcrplus.com/v1/auth/login');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($loginData));
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = json_decode(curl_exec($ch), true);
$token = $response['token'];
echo "Token balance: {$response['user']['tokenBalance']}\n";

// Use ROI calculator
$roiData = [
    'campaignCount' => 10,
    'brandCount' => 2,
    'launchTimeline' => 6,
    'devRate' => 175,
    'complianceRate' => 225,
    'annualRevenue' => 1000000
];

$ch = curl_init('https://api.mytcrplus.com/v1/tools/roi-calculator');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($roiData));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'Authorization: Bearer ' . $token
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$result = json_decode(curl_exec($ch), true);
echo "Build cost: ${$result['results']['build']['total']}\n";
echo "Buy cost: ${$result['results']['buy']['total']}\n";
echo "Savings: ${$result['results']['savings']}\n";
echo "ROI: {$result['results']['roi']}%\n";
?>

cURL

# Register
curl -X POST https://api.mytcrplus.com/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "SecurePass123!",
    "firstName": "John",
    "lastName": "Doe"
  }'

# Login and save token
TOKEN=$(curl -X POST https://api.mytcrplus.com/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "SecurePass123!"
  }' | jq -r '.token')

# Use trust score tool
curl -X POST https://api.mytcrplus.com/v1/tools/trust-score \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{
    "yearsInBusiness": 7,
    "hasDUNS": true,
    "hasDomain": true,
    "domainAge": 5,
    "hasPhysicalAddress": true,
    "hasPrivacyPolicy": true,
    "hasTermsOfService": true,
    "previousCompliance": true
  }'

# Check balance
curl -X GET https://api.mytcrplus.com/v1/tokens/balance \
  -H "Authorization: Bearer $TOKEN"

Additional Resources

Main Website

Learn more about MyTCRPlus

Purchase Tokens

Buy token packages

Support

Get help and contact us

API Health

Check API status