> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Create a compliance profile > Create a new DRAFT compliance profile for a use case (10DLC brand/campaign, toll-free verification, phone-number-purchase KYC, WhatsApp/RCS brand verification, and so on). Country-specific use cases require `country_code` or a `countries` array; brand-level ones may omit it. The draft starts empty — fill its structured data and attach documents, then submit it for carrier review. Owner/admin/developer only. ## OpenAPI ````yaml /openapi.yaml post /api/v1/compliance/compliance-profiles openapi: 3.1.0 info: title: Devotel CPaaS API description: Orbit by Devotel — Communications Platform as a Service API version: 1.0.0 contact: name: Devotel url: https://devotel.io email: support@devotel.io license: name: Proprietary servers: - url: https://api.orbit.devotel.io description: Production security: - Bearer: [] - ApiKey: [] tags: - name: Messages description: >- Send and manage messages across all channels (SMS, WhatsApp, RCS, Email, Viber, etc.) - name: Fax description: >- List and track fax (MMS/T.38) transmissions on Telnyx-backed fax numbers (sending flows through the Messaging API) - name: Agents description: AI agent creation, configuration, and execution - name: Voice description: Voice calls, IVR, conferencing, and SIP trunking - name: OnCall description: On-call rotations and escalation policy planning for incident alerting - name: Webhooks description: Webhook endpoint management and delivery logs - name: Numbers description: Phone number search, provisioning, and configuration - name: Brand Identity description: >- Unified cross-channel brand trust posture (10DLC, toll-free, WhatsApp, RCS, branded calling, number KYC) - name: Contacts description: Contact management, segmentation, and lifecycle tracking - name: Campaigns description: Marketing campaign orchestration and analytics - name: Flows description: Automation flow builder and execution engine - name: Templates description: Message template management and approval workflows - name: Settings description: Organization, channel, and user preference settings - name: Verify description: OTP generation and verification across channels - name: Push description: Push notification delivery via FCM and APNs - name: Integrations description: Third-party service connections and OAuth management - name: CDP description: >- Customer Data Platform — activation surface (CRM object sync, streaming destinations, ad-audience activation) - name: Files description: >- Server-to-server media upload, listing, retrieval, and deletion (signed-URL backed) - name: Commerce description: >- Omnichannel conversational-commerce — persistent cart + checkout state machine, channel-agnostic hosted pay-by-link, native WhatsApp checkout, and AP2-style agent payment mandates. - name: Sync description: >- Real-time shared-state primitive (Twilio Sync parity) — Documents, Maps, Lists, and ephemeral Streams, with change events relayed over the /api/v1/ws/sync WebSocket gateway - name: Risk description: >- Unified cross-channel Trust & Fraud risk scoring — fuses SMS-pumping, URL-reputation, Verify Fraud Guard, and Voice Biometrics signals into one composite verdict queryable before a send or a call. - name: Orby description: >- In-dashboard Orby operator assistant: streamed assistant turns, conversation threads, product knowledge-base search, and the tool-action approval gate. Available to signed-in operators only (dashboard session auth — API-key requests are rejected). paths: /api/v1/compliance/compliance-profiles: post: tags: - Compliance summary: Create a compliance profile description: >- Create a new DRAFT compliance profile for a use case (10DLC brand/campaign, toll-free verification, phone-number-purchase KYC, WhatsApp/RCS brand verification, and so on). Country-specific use cases require `country_code` or a `countries` array; brand-level ones may omit it. The draft starts empty — fill its structured data and attach documents, then submit it for carrier review. Owner/admin/developer only. requestBody: required: true content: application/json: schema: type: object required: - name - use_case properties: name: type: string minLength: 1 maxLength: 200 description: Human-readable label for the profile. use_case: type: string enum: - phone_number_purchase - sms_sender_id_alphanumeric - sms_10dlc_brand_us - sms_10dlc_campaign_us - sms_tfv_us - whatsapp_business_verification - rcs_brand_verification - email_domain_verification - voice_carrier_kyc - other description: The regulatory use case this profile is built for. use_case_subtype: type: string nullable: true maxLength: 50 description: Optional sub-classification within the use case. country_code: type: string minLength: 2 maxLength: 2 description: >- Single ISO-3166 alpha-2 country. Required for country-specific use cases unless `countries` is given. countries: type: array maxItems: 50 items: type: string minLength: 2 maxLength: 2 description: >- Multiple ISO-3166 alpha-2 countries; submission fans out one carrier bundle per country. end_user_type: type: string enum: - business - individual default: business description: Whether the registrant is a business or an individual. example: name: Acme Inc — US 10DLC brand use_case: sms_10dlc_brand_us end_user_type: business responses: '201': description: The newly created draft profile. content: application/json: schema: type: object properties: data: $ref: '#/components/schemas/ComplianceProfile' meta: $ref: '#/components/schemas/ResponseMeta' example: data: id: cprof_7h3k9m2p4q1w name: Acme Inc — US 10DLC brand use_case: sms_10dlc_brand_us use_case_subtype: null country_code: US end_user_type: business status: draft rejected_reason: null submitted_at: null approved_at: null expires_at: null created_by_user_id: user_9f8e7d6c created_at: '2026-08-07T12:00:00.000Z' updated_at: '2026-08-07T12:00:00.000Z' metadata: {} meta: request_id: req_1a2b3c4d5e6f timestamp: '2026-08-07T12:00:00.000Z' components: schemas: ComplianceProfile: type: object description: >- A tenant KYC / regulatory compliance profile — the business/identity data and documents submitted to carriers for one use case + country. properties: id: type: string name: type: string use_case: type: string enum: - phone_number_purchase - sms_sender_id_alphanumeric - sms_10dlc_brand_us - sms_10dlc_campaign_us - sms_tfv_us - whatsapp_business_verification - rcs_brand_verification - email_domain_verification - voice_carrier_kyc - other use_case_subtype: type: string nullable: true country_code: type: string nullable: true description: >- ISO-3166 alpha-2 country, or null for a country-agnostic (brand-level) profile. end_user_type: type: string enum: - business - individual status: type: string enum: - draft - pending_review - approved - rejected - partially_rejected - expired rejected_reason: type: string nullable: true description: Compliance-safe rejection summary shown to the tenant, or null. submitted_at: type: string format: date-time nullable: true approved_at: type: string format: date-time nullable: true expires_at: type: string format: date-time nullable: true created_by_user_id: type: string nullable: true created_at: type: string format: date-time updated_at: type: string format: date-time metadata: type: object additionalProperties: true ResponseMeta: type: object required: - request_id - timestamp additionalProperties: false properties: request_id: type: string description: Unique request identifier (also returned as X-Request-Id header) timestamp: type: string format: date-time docs_url: type: string format: uri nullable: true securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Dashboard JWT token from Clerk ApiKey: type: apiKey name: X-API-Key in: header description: Server-to-server API key (dv_live_sk_*) ````