FCC Robocall Mitigation Database (RMD)

The FCC’s Robocall Mitigation Database (RMD) is the public registry every US voice service provider must file in before it originates calls. Under 47 CFR § 64.6305, your filing declares your STIR/SHAKEN implementation level, and — for any provider that has not fully deployed STIR/SHAKEN — a description of the robocall-mitigation program you run. Terminating carriers are required to refuse traffic from providers that are absent from, or deficient in, the database, so a missing or stale filing is a direct cause of your outbound calls being blocked or labeled downstream. Orbit gives you the record-keeping surface for that obligation: a place to prepare the filing, mark it submitted and published, flag and resolve deficiencies, and watch the recertification clock — plus an opt-in call-time check you can apply to your own outbound origination. Filing with the FCC itself, and every lifecycle decision along the way, stays with you. All endpoints below are rooted at https://api.orbit.devotel.io/api/v1/compliance. The same surface is available in the dashboard under Settings → Compliance → RMD, which drives the identical API.

This page describes Orbit’s tracking surface. It is not legal advice. Whether you must file, what your filing must contain, and how current it must stay depends on your network and traffic — confirm with qualified counsel.

Lifecycle states

An RMD registration moves through five states. withdrawn is not terminal — a withdrawn filing can be re-opened to draft when you re-file.

From \ To	`submitted`	`active`	`remediation_required`	`withdrawn`	`draft`
`draft`	Yes	—	—	Yes	—
`submitted`	—	Yes	—	Yes	Yes
`active`	—	—	Yes	Yes	—
`remediation_required`	—	Yes	—	Yes	—
`withdrawn`	—	—	—	—	Yes

draft — the filing is being prepared; nothing has been submitted.
submitted — filed with the FCC RMD portal, awaiting publication.
active — published in the RMD; the recertification clock is running.
remediation_required — a terminating carrier or the FCC flagged a deficiency you must correct.
withdrawn — filing withdrawn or superseded.

An invalid request (for example, certifying from draft, or editing an active filing in place) returns 409 with RMD_INVALID_TRANSITION. A request against a registration that does not exist yet returns 404 with RMD_NOT_FOUND.

The recertification clock

Once a filing reaches active, a review deadline is computed from certified_at plus your recert_interval_days (default 365; settable up to 3650). Every GET /compliance/rmd annotates the registration with a live verdict:

`recertification.status`	Meaning
`current`	Active and comfortably before the review date.
`due_soon`	Active, within 30 days of the review date.
`overdue`	Active, review date passed (`overdue: true`).
`not_certified`	Not yet active, so no clock is running.
`withdrawn`	Filing withdrawn; no clock is running.

Plan around two distinct cadences: the FCC expects you to update a filing within 10 business days of any change (returned as update_window_business_days on the read response), and most operators re-attest annually — the 365-day default above tracks the annual cadence.

Endpoints

All writes require the owner or admin role; the read is open to any authenticated member.

Method + path	What it does
`GET /compliance/rmd`	Fetch the registration (null when none exists), the live recertification verdict, and the current enforcement mode.
`POST /compliance/rmd`	Create or update the draft registration (upsert). Allowed only while the filing is `draft` or `withdrawn`; a filed registration is mutated through the lifecycle endpoints below.
`POST /compliance/rmd/submit`	`draft` → `submitted`. Records the FCC filing reference.
`POST /compliance/rmd/certify`	`submitted` → `active`. Records publication and starts the recertification clock.
`POST /compliance/rmd/remediation`	`active` → `remediation_required`. Records the flagged deficiency.
`POST /compliance/rmd/resolve`	`remediation_required` → `active`. Clears the deficiency and restarts the clock.
`POST /compliance/rmd/withdraw`	any non-terminal state → `withdrawn`.
`PUT /compliance/rmd/enforcement`	Set the call-time origination enforcement mode: `off` (default), `warn`, or `enforce`.

Working the lifecycle, step by step

1. Create or update the draft

Build the draft before you file. The STIR/SHAKEN level you declare decides whether a robocall-mitigation plan is mandatory: with partial or none you must supply mitigation_plan; with complete it is optional.

curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/rmd" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "company_name": "Acme Communications LLC",
    "ocn": "1234",
    "business_address": "100 Market Street, San Francisco, CA 94105",
    "stir_shaken_status": "complete",
    "contact_name": "Jordan Lee",
    "contact_email": "compliance@acme.example",
    "contact_phone": "+14155550101",
    "recert_interval_days": 365
  }'

Re-POST the same shape to edit the draft. Once the filing is submitted, in-place edits are refused (409 RMD_LOCKED) and you move it through the lifecycle endpoints instead.

2. Submit the filing

After you file with the FCC RMD portal, record the submission — optionally with the FCC confirmation reference:

curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/rmd/submit" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"filing_reference": "RMD-2026-004123"}'

Submission is refused with 409 RMD_INCOMPLETE when the draft is missing a required piece — most commonly the mitigation plan, which is mandatory unless stir_shaken_status is complete. The details array names each blocker.

3. Certify publication

When the filing is published in the database, mark it active. This sets certified_at and starts the review clock:

curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/rmd/certify" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"filing_reference": "RMD-2026-004123"}'

4. Flag and resolve a deficiency

If a terminating carrier or the FCC flags a problem with your filing, record the deficiency (the reason is required) and, once corrected, resolve it. Resolving returns the filing to active and restarts the clock from the resolve date.

curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/rmd/remediation" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason": "Terminating carrier reports the contact email on file bounces."}'

curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/rmd/resolve" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"notes": "Contact email corrected and re-filed with the FCC."}'

5. Withdraw

Mark a filing withdrawn when it is superseded or no longer applies:

curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/rmd/withdraw" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"notes": "Superseded by the restructured entity filing."}'

Withdrawal is reversible: POST /compliance/rmd on a withdrawn filing re-opens it to draft (keeping the original id and creation time), and you walk the lifecycle again.

6. Read back the current state in one call

curl "https://api.orbit.devotel.io/api/v1/compliance/rmd" \
  -H "Authorization: Bearer $ORBIT_API_KEY"

The response carries the registration, the live recertification verdict with due_at and days_remaining, the effective enforcement mode, and update_window_business_days for the FCC’s after-a-change update window.

Call-time origination enforcement

Tracking the filing answers “what is our RMD state?” A second, opt-in layer answers “should we originate right now, given that state?” The voice pre-origination guard checks the filing of the originating organization — not the recipient — before an outbound call is placed, and applies the mode you set:

Mode	Behaviour at origination
`off`	Guard inert — the default. Nothing is flagged or blocked.
`warn`	A not-current filing is logged and flagged in your trace, but the call proceeds. Use this as a dry run before committing to `enforce`.
`enforce`	A not-current filing blocks origination with a `403 RMD_NOT_CURRENT` error that names the reason.

Set the mode once; it applies to every outbound voice origination from your organization until you change it:

curl -X PUT "https://api.orbit.devotel.io/api/v1/compliance/rmd/enforcement" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"mode": "enforce"}'

A filing is not current — flagged under warn, blocked under enforce — in four situations:

`RMD_NOT_CURRENT` detail code	Cause
`RMD_NOT_REGISTERED`	No filing has been started.
`RMD_NOT_ACTIVE`	The filing is draft, submitted, or withdrawn — not published in the RMD.
`RMD_REMEDIATION_REQUIRED`	An open deficiency is flagged on the filing.
`RMD_RECERT_OVERDUE`	The filing is active but past its recertification review date.

Two deliberate behaviors of the guard:

It fails open. If the read of your organization’s settings errors at call time, the call proceeds — a lookup blip must never break dialing. The recipient-facing gates (DNC scrub, quiet hours) are the fail-closed regulatory backstop; this guard is about your own filing.
Preview paths never throw. Dry-run origination paths evaluate the same verdict but surface it as a flag, so tooling can preview “would this call be held under enforce?” without blocking.

Tenant-owned by design

The RMD surface follows Orbit’s compliance posture rule: filing is your decision, never a platform-mandated gate. Nothing files with the FCC for you, nothing blocks your traffic unless you set enforce, and the default mode is off. Orbit records the filing state, computes the deadlines, and applies the posture you choose — the obligation, and every lifecycle call above, stays with your organization. The one platform-level exception is the campaign/dialer TCPA 8 AM–9 PM recipient-local window, documented in What is not tenant-toggleable — the RMD enforcement mode is not part of it.

Send Gates — the full outbound gate stack the origination guard reads alongside.
STIR/SHAKEN attestation — caller-identity posture; the level you assert in the RMD filing.
ITG Traceback — the companion robocall obligation: responding to Industry Traceback Group requests.
Your Tenant Compliance Posture — where this surface sits on the toggle map.

Getting Started

Channels

AI Agents

Flows

Numbers & Verify

Concepts

Features

Billing

Webhooks

Security & SSO

Compliance

Legal

Changelog

FCC Robocall Mitigation Database (RMD): Filing Lifecycle

FCC Robocall Mitigation Database (RMD)

Lifecycle states

The recertification clock

Endpoints

Working the lifecycle, step by step

1. Create or update the draft

2. Submit the filing

3. Certify publication

4. Flag and resolve a deficiency

5. Withdraw

6. Read back the current state in one call

Call-time origination enforcement

Tenant-owned by design

​FCC Robocall Mitigation Database (RMD)

​Lifecycle states

​The recertification clock

​Endpoints

​Working the lifecycle, step by step

​1. Create or update the draft

​2. Submit the filing

​3. Certify publication

​4. Flag and resolve a deficiency

​5. Withdraw

​6. Read back the current state in one call

​Call-time origination enforcement

​Tenant-owned by design

​Related references

FCC Robocall Mitigation Database (RMD)

Lifecycle states

The recertification clock

Endpoints

Working the lifecycle, step by step

1. Create or update the draft

2. Submit the filing

3. Certify publication

4. Flag and resolve a deficiency

5. Withdraw

6. Read back the current state in one call

Call-time origination enforcement

Tenant-owned by design

Related references