> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # FCC Robocall Mitigation Database (RMD): Filing Lifecycle > Prepare, submit, certify, remediate, and withdraw your FCC Robocall Mitigation Database filing — the lifecycle states, the endpoints, the call-time origination enforcement modes, and the recertification clock. # FCC Robocall Mitigation Database (RMD) The FCC's Robocall Mitigation Database (RMD) is the public registry every US voice service provider must file in before it originates calls. Under 47 CFR § 64.6305, your filing declares your STIR/SHAKEN implementation level, and — for any provider that has not fully deployed STIR/SHAKEN — a description of the robocall-mitigation program you run. Terminating carriers are required to refuse traffic from providers that are absent from, or deficient in, the database, so a missing or stale filing is a direct cause of your outbound calls being blocked or labeled downstream. Orbit gives you the record-keeping surface for that obligation: a place to prepare the filing, mark it submitted and published, flag and resolve deficiencies, and watch the recertification clock — plus an opt-in call-time check you can apply to your own outbound origination. Filing with the FCC itself, and every lifecycle decision along the way, stays with you. All endpoints below are rooted at `https://api.orbit.devotel.io/api/v1/compliance`. The same surface is available in the dashboard under **Settings → Compliance → RMD**, which drives the identical API. This page describes Orbit's tracking surface. It is **not legal advice.** Whether you must file, what your filing must contain, and how current it must stay depends on your network and traffic — confirm with qualified counsel. *** ## Lifecycle states An RMD registration moves through five states. `withdrawn` is not terminal — a withdrawn filing can be re-opened to `draft` when you re-file. | From \ To | `submitted` | `active` | `remediation_required` | `withdrawn` | `draft` | | ---------------------- | ----------- | -------- | ---------------------- | ----------- | ------- | | `draft` | Yes | — | — | Yes | — | | `submitted` | — | Yes | — | Yes | Yes | | `active` | — | — | Yes | Yes | — | | `remediation_required` | — | Yes | — | Yes | — | | `withdrawn` | — | — | — | — | Yes | * `draft` — the filing is being prepared; nothing has been submitted. * `submitted` — filed with the FCC RMD portal, awaiting publication. * `active` — published in the RMD; the recertification clock is running. * `remediation_required` — a terminating carrier or the FCC flagged a deficiency you must correct. * `withdrawn` — filing withdrawn or superseded. An invalid request (for example, certifying from `draft`, or editing an `active` filing in place) returns `409` with `RMD_INVALID_TRANSITION`. A request against a registration that does not exist yet returns `404` with `RMD_NOT_FOUND`. ### The recertification clock Once a filing reaches `active`, a review deadline is computed from `certified_at` plus your `recert_interval_days` (default 365; settable up to 3650\). Every `GET /compliance/rmd` annotates the registration with a live verdict: | `recertification.status` | Meaning | | ------------------------ | ---------------------------------------------- | | `current` | Active and comfortably before the review date. | | `due_soon` | Active, within 30 days of the review date. | | `overdue` | Active, review date passed (`overdue: true`). | | `not_certified` | Not yet active, so no clock is running. | | `withdrawn` | Filing withdrawn; no clock is running. | Plan around two distinct cadences: the FCC expects you to update a filing within **10 business days** of any change (returned as `update_window_business_days` on the read response), and most operators re-attest annually — the 365-day default above tracks the annual cadence. *** ## Endpoints All writes require the **owner or admin** role; the read is open to any authenticated member. | Method + path | What it does | | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `GET /compliance/rmd` | Fetch the registration (null when none exists), the live recertification verdict, and the current enforcement mode. | | `POST /compliance/rmd` | Create or update the **draft** registration (upsert). Allowed only while the filing is `draft` or `withdrawn`; a filed registration is mutated through the lifecycle endpoints below. | | `POST /compliance/rmd/submit` | `draft` → `submitted`. Records the FCC filing reference. | | `POST /compliance/rmd/certify` | `submitted` → `active`. Records publication and starts the recertification clock. | | `POST /compliance/rmd/remediation` | `active` → `remediation_required`. Records the flagged deficiency. | | `POST /compliance/rmd/resolve` | `remediation_required` → `active`. Clears the deficiency and restarts the clock. | | `POST /compliance/rmd/withdraw` | any non-terminal state → `withdrawn`. | | `PUT /compliance/rmd/enforcement` | Set the call-time origination enforcement mode: `off` (default), `warn`, or `enforce`. | *** ## Working the lifecycle, step by step ### 1. Create or update the draft Build the draft before you file. The STIR/SHAKEN level you declare decides whether a robocall-mitigation plan is mandatory: with `partial` or `none` you must supply `mitigation_plan`; with `complete` it is optional. ```bash theme={null} curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/rmd" \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "company_name": "Acme Communications LLC", "ocn": "1234", "business_address": "100 Market Street, San Francisco, CA 94105", "stir_shaken_status": "complete", "contact_name": "Jordan Lee", "contact_email": "compliance@acme.example", "contact_phone": "+14155550101", "recert_interval_days": 365 }' ``` Re-`POST` the same shape to edit the draft. Once the filing is submitted, in-place edits are refused (`409 RMD_LOCKED`) and you move it through the lifecycle endpoints instead. ### 2. Submit the filing After you file with the FCC RMD portal, record the submission — optionally with the FCC confirmation reference: ```bash theme={null} curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/rmd/submit" \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -H "Content-Type: application/json" \ -d '{"filing_reference": "RMD-2026-004123"}' ``` Submission is refused with `409 RMD_INCOMPLETE` when the draft is missing a required piece — most commonly the mitigation plan, which is mandatory unless `stir_shaken_status` is `complete`. The `details` array names each blocker. ### 3. Certify publication When the filing is published in the database, mark it active. This sets `certified_at` and starts the review clock: ```bash theme={null} curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/rmd/certify" \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -H "Content-Type: application/json" \ -d '{"filing_reference": "RMD-2026-004123"}' ``` ### 4. Flag and resolve a deficiency If a terminating carrier or the FCC flags a problem with your filing, record the deficiency (the reason is required) and, once corrected, resolve it. Resolving returns the filing to `active` and restarts the clock from the resolve date. ```bash theme={null} curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/rmd/remediation" \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -H "Content-Type: application/json" \ -d '{"reason": "Terminating carrier reports the contact email on file bounces."}' ``` ```bash theme={null} curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/rmd/resolve" \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -H "Content-Type: application/json" \ -d '{"notes": "Contact email corrected and re-filed with the FCC."}' ``` ### 5. Withdraw Mark a filing withdrawn when it is superseded or no longer applies: ```bash theme={null} curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/rmd/withdraw" \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -H "Content-Type: application/json" \ -d '{"notes": "Superseded by the restructured entity filing."}' ``` Withdrawal is reversible: `POST /compliance/rmd` on a withdrawn filing re-opens it to `draft` (keeping the original id and creation time), and you walk the lifecycle again. ### 6. Read back the current state in one call ```bash theme={null} curl "https://api.orbit.devotel.io/api/v1/compliance/rmd" \ -H "Authorization: Bearer $ORBIT_API_KEY" ``` The response carries the registration, the live `recertification` verdict with `due_at` and `days_remaining`, the effective `enforcement` mode, and `update_window_business_days` for the FCC's after-a-change update window. *** ## Call-time origination enforcement Tracking the filing answers "what is our RMD state?" A second, opt-in layer answers "should we originate right now, given that state?" The voice pre-origination guard checks the filing of the **originating** organization — not the recipient — before an outbound call is placed, and applies the mode you set: | Mode | Behaviour at origination | | --------- | -------------------------------------------------------------------------------------------------------------------------------------- | | `off` | Guard inert — the default. Nothing is flagged or blocked. | | `warn` | A not-current filing is logged and flagged in your trace, but the call proceeds. Use this as a dry run before committing to `enforce`. | | `enforce` | A not-current filing blocks origination with a `403 RMD_NOT_CURRENT` error that names the reason. | Set the mode once; it applies to every outbound voice origination from your organization until you change it: ```bash theme={null} curl -X PUT "https://api.orbit.devotel.io/api/v1/compliance/rmd/enforcement" \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -H "Content-Type: application/json" \ -d '{"mode": "enforce"}' ``` A filing is **not current** — flagged under `warn`, blocked under `enforce` — in four situations: | `RMD_NOT_CURRENT` detail code | Cause | | ----------------------------- | ------------------------------------------------------------------------ | | `RMD_NOT_REGISTERED` | No filing has been started. | | `RMD_NOT_ACTIVE` | The filing is draft, submitted, or withdrawn — not published in the RMD. | | `RMD_REMEDIATION_REQUIRED` | An open deficiency is flagged on the filing. | | `RMD_RECERT_OVERDUE` | The filing is active but past its recertification review date. | Two deliberate behaviors of the guard: * **It fails open.** If the read of your organization's settings errors at call time, the call proceeds — a lookup blip must never break dialing. The recipient-facing gates (DNC scrub, quiet hours) are the fail-closed regulatory backstop; this guard is about your own filing. * **Preview paths never throw.** Dry-run origination paths evaluate the same verdict but surface it as a flag, so tooling can preview "would this call be held under `enforce`?" without blocking. *** ## Tenant-owned by design The RMD surface follows Orbit's compliance posture rule: filing is **your decision**, never a platform-mandated gate. Nothing files with the FCC for you, nothing blocks your traffic unless you set `enforce`, and the default mode is `off`. Orbit records the filing state, computes the deadlines, and applies the posture you choose — the obligation, and every lifecycle call above, stays with your organization. The one platform-level exception is the campaign/dialer TCPA 8 AM–9 PM recipient-local window, documented in [What is not tenant-toggleable](/compliance/posture-overview) — the RMD enforcement mode is not part of it. *** ## Related references * [Send Gates](/compliance/send-gates) — the full outbound gate stack the origination guard reads alongside. * [STIR/SHAKEN attestation](/channels/voice/stir-shaken) — caller-identity posture; the level you assert in the RMD filing. * [ITG Traceback](/compliance/itg-traceback) — the companion robocall obligation: responding to Industry Traceback Group requests. * [Your Tenant Compliance Posture](/compliance/posture-overview) — where this surface sits on the toggle map.