> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Record per-carrier vetting for a short-code application > Record a carrier's vetting decision for an SMS short-code application. The first vetting signal moves the application from `submitted` to `carrier_vetting` and seeds the per-carrier tracker (the US carriers for a US code); later calls update a single carrier's state within the multi-week review. Use it to relay each carrier's pending / approved / rejected decision so the timeline reflects real progress. Returns 409 if the application is not submitted or under review, and 404 if no application with that id belongs to the caller's organization. Requires the `numbers:write` scope (owner / admin). ## OpenAPI ````yaml /openapi.yaml post /api/v1/numbers/short-codes/{id}/vetting openapi: 3.1.0 info: title: Devotel CPaaS API description: Orbit by Devotel — Communications Platform as a Service API version: 1.0.0 contact: name: Devotel url: https://devotel.io email: support@devotel.io license: name: Proprietary servers: - url: https://api.orbit.devotel.io description: Production security: - Bearer: [] - ApiKey: [] tags: - name: Messages description: >- Send and manage messages across all channels (SMS, WhatsApp, RCS, Email, Viber, etc.) - name: Agents description: AI agent creation, configuration, and execution - name: Voice description: Voice calls, IVR, conferencing, and SIP trunking - name: Webhooks description: Webhook endpoint management and delivery logs - name: Numbers description: Phone number search, provisioning, and configuration - name: Contacts description: Contact management, segmentation, and lifecycle tracking - name: Campaigns description: Marketing campaign orchestration and analytics - name: Flows description: Automation flow builder and execution engine - name: Templates description: Message template management and approval workflows - name: Settings description: Organization, channel, and user preference settings - name: Verify description: OTP generation and verification across channels - name: Push description: Push notification delivery via FCM and APNs - name: Telegram description: >- Telegram bring-your-own-bot channel: connect a bot, verify a chat against the shared sandbox bot, and read unified channel state. Production sends go through the Messaging API. - name: USSD description: >- Menu-driven USSD for feature phones: define a menu tree, simulate session steps, and host the tenant-scoped aggregator callback. - name: Integrations description: Third-party service connections and OAuth management - name: Files description: >- Server-to-server media upload, listing, retrieval, and deletion (signed-URL backed) - name: Messaging Services description: >- Twilio MessagingService-parity containers bundling sender pool, opt-out list, inbound webhook, and sticky-sender/geomatch flags - name: Sender Pools description: >- Group sending numbers into pools with a selection strategy (sticky / round-robin / random) for outbound sends - name: Opt-Out Lists description: >- Per-list STOP / HELP / START keyword sets and auto-response copy (Twilio Advanced Opt-Out parity) - name: SMPP description: Tenant BYO-SMPP bind credentials and upstream termination carriers - name: Commerce description: >- Unified omnichannel conversational-commerce: cart/checkout state machine, cross-channel payment reconciliation, hosted pay-by-link, native WhatsApp checkout, and agentic-checkout payment mandates - name: Orby description: >- In-dashboard Orby operator assistant: streamed assistant turns, conversation threads, product knowledge-base search, and the tool-action approval gate. Available to signed-in operators only (dashboard session auth — API-key requests are rejected). paths: /api/v1/numbers/short-codes/{id}/vetting: post: tags: - Numbers summary: Record per-carrier vetting for a short-code application description: >- Record a carrier's vetting decision for an SMS short-code application. The first vetting signal moves the application from `submitted` to `carrier_vetting` and seeds the per-carrier tracker (the US carriers for a US code); later calls update a single carrier's state within the multi-week review. Use it to relay each carrier's pending / approved / rejected decision so the timeline reflects real progress. Returns 409 if the application is not submitted or under review, and 404 if no application with that id belongs to the caller's organization. Requires the `numbers:write` scope (owner / admin). parameters: - schema: type: string minLength: 1 in: path name: id required: true description: Resource identifier - name: Idempotency-Key in: header required: false description: >- Stripe-style idempotency token. Pass a stable, client-generated value (1-255 chars) to dedupe retries on transient timeouts. The same key+credential+path replays the original response for 24h on 2xx (5min on 4xx, 30s on 5xx). Returns 409 if a concurrent request with the same key is already in flight; replayed responses include the `Idempotency-Replay: true` response header. schema: type: string minLength: 1 maxLength: 255 - name: X-Test-Mode in: header required: false description: >- Sandbox opt-in for Clerk-session-authenticated requests. Set to `true` to route the call through the test-mode pipeline: no real provider delivery, no credits deducted, response `meta.test_mode: true`. **Ignored for live API keys (`dv_live_sk_*`)** — server-to-server clients must use a test-prefixed key (`dv_test_sk_*`) to exercise sandbox. Test-prefixed keys unconditionally enable sandbox regardless of this header. schema: type: string enum: - 'true' - 'false' requestBody: required: true content: application/json: schema: type: object additionalProperties: true description: The carrier's vetting decision to record. properties: carrier: type: string description: Carrier name, e.g. "AT&T" or "T-Mobile". status: type: string enum: - pending - approved - rejected description: The carrier's decision for this application. note: type: string description: >- Optional carrier note (e.g. the rejection reason or conditions). example: carrier: AT&T status: approved note: Program brief approved. description: The carrier's vetting decision to record. responses: '200': description: The short-code application with the updated carrier-vetting state. content: application/json: schema: type: object additionalProperties: true description: >- The short-code application with the updated carrier-vetting state. properties: data: type: object additionalProperties: true properties: id: type: string countryCode: type: string description: ISO-3166 alpha-2 country the code is provisioned in. leaseType: type: string enum: - dedicated - shared selection: type: string enum: - random - vanity requestedCode: type: - 'null' - string description: >- Requested code for a vanity selection (3–6 digits); absent for random. assignedCode: type: - 'null' - string description: >- The assigned code once reserved / provisioned (3–6 digits). leaseTermMonths: type: integer enum: - 3 - 6 - 12 status: type: string enum: - draft - submitted - carrier_vetting - provisioned - rejected - cancelled businessName: type: string programBrief: type: object additionalProperties: true properties: useCase: type: string description: type: string sampleMessages: type: array items: type: string messageFrequency: type: string optInDescription: type: string supportContact: type: string privacyPolicyUrl: type: - 'null' - string termsUrl: type: - 'null' - string carrierVetting: type: array items: type: object additionalProperties: true properties: carrier: type: string status: type: string enum: - pending - approved - rejected updatedAt: type: string format: date-time note: type: - 'null' - string createdAt: type: string format: date-time updatedAt: type: string format: date-time submittedAt: type: - 'null' - string format: date-time provisionedAt: type: - 'null' - string format: date-time leaseEndsAt: type: - 'null' - string format: date-time rejectionReason: type: - 'null' - string meta: type: object properties: request_id: type: string description: >- Unique request identifier (also returned in X-Request-Id header) timestamp: type: string format: date-time description: ISO 8601 UTC timestamp of the response example: data: id: shortcode_01J9Z8ABCDEF countryCode: US leaseType: dedicated selection: random requestedCode: null assignedCode: null leaseTermMonths: 12 status: carrier_vetting businessName: Acme Inc createdAt: '2026-08-11T12:00:00.000Z' updatedAt: '2026-08-18T10:05:00.000Z' submittedAt: '2026-08-12T09:15:00.000Z' carrierVetting: - carrier: AT&T status: approved updatedAt: '2026-08-18T10:05:00.000Z' note: Program brief approved. - carrier: T-Mobile status: pending updatedAt: '2026-08-12T09:15:00.000Z' note: null meta: request_id: req_01J9Z8ABCDEF timestamp: '2026-08-18T10:05:00.000Z' headers: Idempotency-Replay: description: >- Set to `true` when the response is a cached replay of a prior request with the same `Idempotency-Key`. Absent (or `false`) on first-write responses. schema: type: string '400': $ref: '#/components/responses/StandardError' '401': $ref: '#/components/responses/StandardError' '403': $ref: '#/components/responses/StandardError' '404': $ref: '#/components/responses/StandardError' '422': $ref: '#/components/responses/StandardError' '429': $ref: '#/components/responses/RateLimitedResponse' '500': $ref: '#/components/responses/StandardError' components: responses: StandardError: description: >- Standard error envelope. `error.code` is machine-readable; see the [error reference](https://docs.orbit.devotel.io/reference/error-codes) for the catalogue. content: application/json: schema: type: object properties: error: type: object required: - code - message - status properties: code: type: string description: Machine-readable error code (e.g. INVALID_PHONE_NUMBER) message: type: string description: Human-readable error description status: type: integer description: HTTP status code details: type: object additionalProperties: true description: Additional context about the error meta: type: object properties: request_id: type: string timestamp: type: string format: date-time docs_url: type: string format: uri description: Link to relevant error documentation RateLimitedResponse: description: >- Rate limit exceeded. Wait `error.retry_after` seconds (or read the `Retry-After` header) before retrying. Returned when the request would exceed the bucket identified by `X-RateLimit-Bucket`. headers: X-RateLimit-Limit: description: Total request quota for the current window. schema: type: integer minimum: 0 X-RateLimit-Remaining: description: Requests remaining in the current window. schema: type: integer minimum: 0 X-RateLimit-Reset: description: >- Absolute unix-epoch-seconds timestamp at which the current window resets. schema: type: integer minimum: 0 X-RateLimit-Bucket: description: >- Name of the rate-limit bucket the request was bound by (e.g. `auth-write`, `money`, `agent-invoke`, or `custom:/`). Stripe-style — lets clients see which named cap they hit. schema: type: string RateLimit-Limit: description: >- draft-ietf-httpapi-ratelimit-headers no-prefix mirror of `X-RateLimit-Limit`. Some SDKs read only this form. schema: type: integer minimum: 0 RateLimit-Remaining: description: >- draft-ietf-httpapi-ratelimit-headers no-prefix mirror of `X-RateLimit-Remaining`. schema: type: integer minimum: 0 RateLimit-Reset: description: >- draft-ietf-httpapi-ratelimit-headers no-prefix mirror — delta seconds from now until the window resets (NOT epoch). schema: type: integer minimum: 0 Retry-After: description: >- RFC 7231 §7.1.3 — number of seconds the client should wait before retrying. schema: type: integer minimum: 1 content: application/json: schema: type: object properties: error: type: object required: - code - message - status - retry_after properties: code: type: string enum: - RATE_LIMITED description: >- Always `RATE_LIMITED` — the global request-limiter 429. Distinct from `RATE_LIMIT_EXCEEDED`, the live per-recipient/per-tenant/per-resource frequency-cap 429 (not retired). message: type: string status: type: integer enum: - 429 retry_after: type: integer minimum: 1 description: >- Seconds to wait before retrying. Mirrors `Retry-After` header. meta: type: object properties: request_id: type: string timestamp: type: string format: date-time docs_url: type: string format: uri securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Dashboard JWT token from Clerk ApiKey: type: apiKey name: X-API-Key in: header description: Server-to-server API key (dv_live_sk_*) ````