VICIfast
All lead platforms

TrustedForm + VICIdial

TrustedForm + VICIdial consent certificates

How a TrustedForm certificate arrives with a lead, how claiming actually works, and where to store it in VICIdial so it is there when asked for.

Platforms in this category

  • TrustedForm

When teams ask us for this

You buy leads and need the consent evidence

The certificate URL arrives with the lead, is claimed on ingestion and is written to a VICIdial field you can produce years later.

You want bad leads rejected before an agent dials

Page scanning asserts your disclosure language was present. A lead whose scan fails never reaches the hopper.

You are asked to prove consent long after the fact

The certificate and the timestamp you claimed it at live on the dialer, which you will still have after the buying relationship ends.

You run multiple sellers with different field names

Each seller names the certificate field differently. The mapping is per-seller and is part of the setup.

TrustedForm certifies that a consumer consented, and hands you a certificate URL with the lead. The certificate is the evidence. If it arrives, gets written into a VICIdial field and is claimed before it expires, you can produce it years later. If it lands in a field nobody mapped, you bought a lead and threw away the only proof you had.

Integrations on demand. We are not an ActiveProspect partner and there is no connector to switch on. Our team wires the claim step and the field mapping as scoped work, quoted per setup.

What actually arrives

A certificate URL, beginning https://cert.trustedform.com. It comes as one more field on the lead post, usually named xxTrustedFormCertUrl or whatever your seller's spec calls it.

By itself the URL is a pointer. It is not proof until you claim it.

Claiming is a POST, and the details matter

ActiveProspect's API is specific about this:

  • Send an HTTP POST to the certificate URL. Any other method does not claim it.
  • Accept: application/json
  • Content-Type: application/json or application/x-www-form-urlencoded
  • Authenticate with HTTP Basic, username API, password being your API key from the Settings tab.

And one security rule worth repeating, because it is theirs and it is blunt: do not send the request unless the URL starts with https://cert.trustedform.com. A seller who controls the URL you POST to also controls where your credentials go.

Claiming does three things - verifies the certificate is real, stores it against your account for later, and returns the certificate data programmatically.

You can also scan the page the consent was given on. required_scan_terms asserts that your disclosure language was present; forbidden_scan_terms asserts that something you never want associated with your brand was not. A lead whose scan fails is a lead you can reject before it reaches an agent.

Where it goes in VICIdial

The certificate URL belongs in a custom field on the lead, written at the same moment the lead is created:

non_agent_api.php?function=add_lead
  &phone_number=...&list_id=...
  &vendor_lead_code=<seller lead id>

with the certificate written to the campaign's custom fields alongside. The claim result - the outcome, and the timestamp you claimed at - belongs there too. A certificate URL with no record of when you claimed it is weaker evidence than one with.

It also runs the other way

Everything above is traffic arriving. The dialer can call TrustedForm as well: VICIdial fires their API mid-call with the lead substituted into the URL, and the caller is transferred live if TrustedForm accepts. Here the outbound call is the claim itself, which happens on ingestion rather than mid-call. The certificate is what makes a transfer saleable to a buyer who demands proof of consent.

A transfer accepted during the conversation is worth considerably more than a record posted after it, and it is a separate piece of work from the inbound path. See live transfer on a buyer API response for the hooks and the failure modes.

Gotchas

Certificates expire. Claim on arrival, as part of ingestion, not in a nightly batch. A lead that sat in a queue over a long weekend can arrive at the claim step too late.

Claim before you dial, not after. If the scan fails or the certificate is bogus, the cheapest outcome is that no agent ever calls the number.

One certificate, one lead. Do not carry a certificate across a re-post or a duplicate record. It documents one consent event.

Retention outlives the campaign. The reason to keep this in VICIdial rather than only in the seller's portal is that you will still have the dialer long after the buying relationship ends.

Related: consent and TCPA certification and our TCPA guidance.

Questions we get asked

Are you an ActiveProspect partner?
No. There is no certified connector. We wire the claim step and the field mapping to your server as scoped work, quoted per setup.
What does claiming a certificate actually do?
It verifies the certificate is genuine, stores it against your account for later reference, and returns the certificate data programmatically.
Why does the claim have to be a POST?
ActiveProspect's API only treats a POST as a claim. A GET views the same response without claiming it, which leaves you without the stored evidence.
Is there a security risk in claiming?
Yes, and it is theirs to warn about: never send the request unless the URL begins with https://cert.trustedform.com. A seller who controls that URL also controls where your credentials go.
When should the claim happen?
On arrival, as part of ingestion. Certificates expire, and a lead that sat in a queue over a long weekend can reach a nightly batch too late.
Where is the certificate stored in VICIdial?
In a custom field on the lead, written at creation alongside the claim outcome and the timestamp. A certificate with no record of when it was claimed is weaker evidence.

TrustedForm is a trademark of its respective owner. VICIfast is not affiliated with, endorsed by or a partner of TrustedForm. The name is used here only to describe how their platform can be connected to VICIdial, which we do as scoped work on request. See all consent and tcpa certification platforms.

Try VICIfast free for 7 days.

One click to provision. Cancel any time before day 7 - we don’t charge until then.

See pricing