> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# CPNI (FCC U.S. Telecommunications)

> Record CPNI marketing-use consent decisions and run the annual §64.2009(e) certification lifecycle — from open to FCC filing — with a signed attestation export.

# CPNI (FCC U.S. Telecommunications)

**Customer Proprietary Network Information (CPNI)** is the data a
telecommunications provider collects while delivering service — call
detail records, line usage patterns, and customer-billing information.
The FCC's CPNI rules (47 CFR §64.2001–§64.2011) control how that data
may be used for marketing, approved by customers, and certified
annually.

If you use Orbit's US voice or SMS surfaces and your organization acts
as a telecommunications carrier toward your downstream customers, these
rules apply to you. Orbit gives you the register to **record** the
consent decisions and certifications the rules call for.

All endpoints below are rooted at
`https://api.orbit.devotel.io/api/v1/compliance/cpni`.

<Warning>
  Orbit records and attests compliance evidence — it does not by itself
  make your use of CPNI lawful, and this page is not legal advice.
  You remain responsible for delivering customer notices and for any
  filings you certify.
</Warning>

***

## Orbit's role: tenant-owned record-keeping

CPNI compliance is a control you own. Orbit maintains the auditable
register — the §64.2007/§64.2008 marketing-use consent decisions and
the §64.2009(e) annual certification wheel — but it does not mandate
or enforce those steps. You decide when notices go out and whether you
adopt opt-in (§64.2007(c)) or opt-out (§64.2007(b)(1)) approval;
Orbit records whatever you decide and computes which customers
currently permit marketing use.

Two things Orbit deliberately **never** does:

* **Customer notices.** The §64.2008 notice-and-approval notices are
  sent between you and your customer, out-of-band. Orbit attests that a
  notice was given — it never sends a notice for you.
* **Direct law-enforcement notification.** On a CPNI breach, the
  §64.2011 USSS/FBI notification duty falls to you outside Orbit; the
  count of those notifications belongs on your annual certification.
* **Out-of-band filings.** Filing with the FCC (EB Docket 06-36) is a
  step you take with the Commission; Orbit records the filing
  reference and timestamp.

That boundary keeps the register accurate: it attests what happened,
and it never pretends to deliver what it cannot.

***

## Reading the register — RBAC

**RBAC:** reads are open to any authenticated tenant member; writes
require an owner or admin role (same pattern as other regulatory
controls on the compliance surface, e.g. breach incidents).

`GET /compliance/cpni` returns the combined posture — the consent
summary plus the certification summary — in one call. Use it for a
dashboard tile or a pre-audit snapshot.

```bash theme={null}
curl https://api.orbit.devotel.io/api/v1/compliance/cpni \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

```json theme={null}
{
  "consent": {
    "summary": {
      "total": 3,
      "opted_in": 1,
      "opted_out": 1,
      "pending": 1,
      "not_asked": 0,
      "marketing_permitted": 1
    }
  },
  "certifications": {
    "summary": {
      "draft": 1,
      "certified": 0,
      "filed": 1,
      "overdue": 0
    }
  }
}
```

***

## Recording a consent decision

`POST /compliance/cpni/consent` (admin) records one customer's current
decision. Records upsert by `customer_ref` — a customer has one
current decision at a time.

**Opt-in approval** (express affirmative consent, §64.2007(c)):

```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/cpni/consent \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "customer_ref": "acct-1092",
    "status": "opted_in",
    "method": "opt_in",
    "purpose": "marketing_use",
    "channel": "web_form",
    "captured_at": "2026-08-01T14:20:00Z",
    "notes": "Customer approved marketing use of usage data at signup."
  }'
```

**Opt-out notice** (§64.2007(b)(1), with the 30-day §64.2008(d)(1)
window): record `status: "pending"` with the instant the notice was
sent. Once 30 days elapse without an objection, the summary counts
the customer as permitting marketing use.

```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/cpni/consent \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "customer_ref": "acct-1093",
    "status": "pending",
    "method": "opt_out",
    "purpose": "marketing_use",
    "channel": "email",
    "notice_sent_at": "2026-08-01T09:00:00Z",
    "notes": "Opt-out CPNI notice emailed; 30-day window closes 2026-08-31."
  }'
```

| Field            | Type                  | Notes                                                                                          |
| ---------------- | --------------------- | ---------------------------------------------------------------------------------------------- |
| `customer_ref`   | string                | Your own customer identifier (account number, contact id, or label). Required.                 |
| `status`         | enum                  | `not_asked`, `opted_in`, `opted_out`, or `pending`. Required.                                  |
| `method`         | enum                  | `opt_in` (express approval) or `opt_out` (notice-based). Required.                             |
| `purpose`        | string                | What the decision covers, e.g. `marketing_use`.                                                |
| `channel`        | string                | How the decision was captured (`web_form`, `email`, `paper`, `csr` …).                         |
| `notice_sent_at` | string (ISO-8601 UTC) | When the §64.2008 notice was given. Starts the 30-day window for a `pending` opt-out decision. |
| `captured_at`    | string (ISO-8601 UTC) | Instant of the customer's choice (defaults to now).                                            |
| `notes`          | string                | Free text, up to 2000 characters.                                                              |

Returns `201 Created` with the stored record. A missing `customer_ref`
or an unknown enum returns `422 VALIDATION_ERROR` with per-field
messages.

`GET /compliance/cpni/consent` lists the register with the summary
counts; `GET /compliance/cpni/consent/{id}` fetches a single record.

<Note>
  A customer can revoke oral approval at any time. Re-posting a new
  decision for the same `customer_ref` replaces the current one and
  returns `200 OK` instead of `201`.
</Note>

***

## Running the annual certification

§64.2009(e) requires carriers to certify annually — with an officer's
signature — that their operating procedures ensure CPNI rule
compliance. The certification is due with the FCC by **March 1 of the
following year**, and EB Docket 06-36 tracks the filing.

The lifecycle has three states: `draft` → `certified` → `filed`.

**1. Open the certification** (admin):

```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/cpni/certifications \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "year": 2026,
    "officer_name": "Maya Chen",
    "officer_title": "Chief Compliance Officer",
    "statement": "Our operating procedures comply with the CPNI rules established by the FCC (47 CFR §64.2001–§64.2011).",
    "complaint_summary": {
      "total": 4,
      "improper_access": 1,
      "improper_disclosure": 0,
      "other": 3
    },
    "law_enforcement_notifications": 0,
    "actions_taken": "Two data-broker attempts investigated and terminated."
  }'
```

One certification per calendar year. Duplicate years return `409`.
Returns `201` with the record in `draft`.

**2. Certify** (admin) — moving to `certified` requires the signing
officer, their title, the compliance statement, and `compliant: true`:

```bash theme={null}
curl -X PATCH https://api.orbit.devotel.io/api/v1/compliance/cpni/certifications/{id} \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "certified",
    "officer_name": "Maya Chen",
    "officer_title": "Chief Compliance Officer",
    "compliant": true,
    "statement": "I certify that our operating procedures ensure CPNI compliance for calendar year 2026."
  }'
```

**3. File** (admin) — once you have filed with the FCC yourself,
record the filing reference:

```bash theme={null}
curl -X PATCH https://api.orbit.devotel.io/api/v1/compliance/cpni/certifications/{id} \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "filed",
    "filing_reference": "ECFS-2026-67877"
  }'
```

Moving straight to `filed` skips a required `certified` state and is
rejected; an empty patch returns `422`.

`GET /compliance/cpni/certifications` lists the certifications with a
`draft` / `certified` / `filed` / overdue summary. `GET
/compliance/cpni/certifications/{id}` fetches one.

***

## Exporting the attestation

`GET /compliance/cpni/certifications/{id}/attestation` produces a
self-contained, signed attestation of the certification and its FCC
filing timeline — the row you export to your compliance binder.

```bash theme={null}
curl https://api.orbit.devotel.io/api/v1/compliance/cpni/certifications/{id}/attestation \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

```json theme={null}
{
  "certification_id": "ccp_…",
  "year": 2026,
  "status": "filed",
  "eb_docket": "EB Docket 06-36",
  "due_at": "2027-03-01T00:00:00.000Z",
  "officer_name": "Maya Chen",
  "officer_title": "Chief Compliance Officer",
  "compliant": true,
  "complaint_summary": {
    "total": 4,
    "improper_access": 1,
    "improper_disclosure": 0,
    "other": 3
  },
  "law_enforcement_notifications": 0,
  "certified_at": "2027-02-10T17:44:00.000Z",
  "filed_at": "2027-02-22T09:15:00.000Z",
  "filing_reference": "ECFS-2026-67877",
  "filed_within_window": true,
  "statement": "The CPNI §64.2009(e) certification for calendar year 2026 was filed with the FCC (EB Docket 06-36) on 2027-02-22T09:15:00.000Z, on or before the March-1 deadline of 2027-03-01T00:00:00.000Z."
}
```

The `filed_within_window` flag tells you whether the filing landed
before the March-1 deadline; an unfiled certification past the deadline
shows in the summary as `overdue`.

***

## Where CPNI fits in the rest of the compliance surface

* [SOC 2 Controls](/compliance/soc2-controls) — the complementary
  control framework pages on this compliance surface.
* [Consent Management](/compliance/consent-management) — per-channel
  messaging consent for contacts (a different register from CPNI's
  customer-marketing decisions).
* [Country Requirements](/compliance/country-requirements) — the
  carrier-registry and sender rules CPNI sits alongside for US traffic.
* [API Reference → Compliance](/api-reference/endpoints/compliance) —
  full request/response schemas (regenerated from the live API).