> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thrad.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity and consent

> Send matching data safely and control whether an event can be measured.

Pre-hashed email and phone are the recommended default. Send lowercase 64-character SHA-256 values in `emails_sha256` and `phone_numbers_sha256`; include both whenever you collected them and consent permits it.

Thrad also accepts `external_ids_sha256`, `first_names_sha256`, and `last_names_sha256`. Each field accepts up to three unique values. Geographic fields (`countries`, `cities`, `regions`, and `postal_codes`) remain raw.

## Plaintext convenience fields

For a simpler first integration, Thrad can hash plaintext `emails`, `phone_numbers`, `external_ids`, `first_names`, and `last_names` at ingress. Plaintext is normalized and discarded before logs, errors, canonical records, or queues are created. Prefer pre-hashing when it is easy to do in your service.

```json theme={null}
{
  "user": {
    "emails": ["customer@example.com"],
    "phone_numbers": ["+1 (415) 555-0123"],
    "external_ids": ["customer-123"]
  }
}
```

Do not send plaintext fields in `data.custom_fields` or any other field. Use either form only when measurement consent is present.

## Normalization before hashing

* email: trim and lowercase;
* phone: convert to international digits-only form, remove `+` or `00` and punctuation, then keep 8–15 digits;
* external ID: trim only; preserve case;
* first and last name: lowercase and remove whitespace and ASCII punctuation; preserve non-ASCII characters.

| Field | Input | Normalized value | SHA-256 |
| - | - | - | - |
| email | `Test@Example.COM` | `test@example.com` | `973dfe463ec85785f5f95af5ba3906eedb2d931c24e69824a89ea65dba4e813b` |
| phone | `+1 (415) 555-0123` | `14155550123` | `413ba75461ab5f99d36820e561ea97e2bd80f9cb586f7ecea6cf4c496518950a` |
| external ID | `customer-123` | `customer-123` | `a28b5da378b043b0e62b924e1b055bb96ada180943e81cfc9838cf9933a91f03` |

## Consent and routing

`consent.measurement` and `consent.personalization` default to `true`. Set `measurement: false` when the user has not consented to measurement. The event is returned as `suppressed` and is neither recorded nor forwarded.

The same canonical event can route to Thrad, OpenAI, or both. A signed Thrad click context (`click_id`, `click_exp`, and `click_sig`) enables Thrad attribution. An OpenAI reference (`oppref`, `oppcref`, or `obref`) or a supported advanced-matching identifier enables OpenAI eligibility. Your API response does not expose provider credentials or routing internals.

Use `context.oppref` unchanged when your server captured it from the browser flow. Send `user.obref` unchanged when available and permitted by measurement consent.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.