Skip to main content

​
Send Gates

Beyond consent and suppression, several regulatory checks run at send time. Orbit groups them as send gates: each one can hold or drop a message or call before it dispatches. This page covers the gates you configure or query directly. All endpoints below are rooted at https://api.orbit.devotel.io/api/v1/compliance.
DNC and RND scrub against national registers — the FTC federal and state Do-Not-Call registers and the TCR Universal Opt-Out for DNC, and the FCC Reassigned Numbers Database for RND. These are not feeds you wire up or integrate per tenant: when a register snapshot is in place, the platform maintains it centrally rather than reading from your own integration. But the scrub is off by default — each gate reports federal_feeds_synced / feed_synced as false until a snapshot is actually synced for it, and stays behind a per- organization opt-in toggle. Until both are true these endpoints return a disabled response and a number only on a federal register reads back clear (see each gate below for its exact behaviour). This page is not legal advice — confirm your TCPA/FCC obligations with counsel.

​
Quiet hours

Quiet-hours rules block messages and calls that would land outside a recipient’s permitted local hours (e.g. the TCPA 8 am–9 pm window). Orbit resolves the recipient’s local time from their phone number’s region. GET /quiet-hours/preview tells you whether a send is allowed right now, and when the next allowed time is — use it to schedule around the window.
Quiet-hours gating is opt-in per channel and organization — every channel ships with the toggle off, so a new tenant’s SMS, WhatsApp, and other sends are not held by quiet hours until you enable the gate for that channel. Turn it on per channel from your organization’s quiet-hours settings in the Orbit dashboard; the listed windows then apply automatically. Once enabled, the windows are 08:00–21:00 (recipient-local) for SMS/voice and 09:00–21:00 for WhatsApp/Meta channels unless you set your own start_hour/end_hour. Email, fax, and push are not quiet-hours gated.
US voice TCPA window: advisory for ad-hoc dials, a hard block for campaigns. For outbound voice calls to US (+1) recipients, Orbit evaluates the federal TCPA 8 am–9 pm recipient-local dialing window on every call — but how it enforces the result depends on the call path:
  • Ad-hoc 1:1 dialing from the dashboard is advisory by default. A call outside the window records a structured advisory log but still dispatches. To hold these calls instead, enable the voice quiet-hours toggle for your organization; enabling it applies the 8 am–9 pm window as a hard hold.
  • Campaign and dialer voice traffic is always hard-blocked outside the window, regardless of your tenant settings. A campaign or dialer call placed outside 8 am–9 pm recipient-local is rejected with 422 TCPA_FEDERAL_DIALING_WINDOW_BLOCKED — there is no per-organization opt-out for automated or bulk voice, and the voice quiet-hours toggle does not relax it. If the recipient’s timezone cannot be resolved, the call fails closed and is also blocked.
Schedule campaign and dialer calls inside the recipient-local 8 am–9 pm window — use GET /quiet-hours/preview to find the next allowed time.

​
DNC — Do Not Call

GET /dnc/check reports whether a number is on a Do-Not-Call list before you dial or text it.
When enabled it returns:
The source indicates which layer flagged the number (your contact DNC flag, the DNC list, the suppression list, or a consent opt-out).
The gate applies only while no Do-Not-Call feed is synced. In that state the endpoint is held behind the org setting dnc_sync_enabled (default off) and returns 403 DNC_SYNC_NOT_ENABLED until you opt in — acknowledging that Orbit isn’t yet scrubbing against a federal register for you, so a number only on the FTC list reads back as on_dnc: false.Once Orbit has a federal, state, or TCR snapshot synced, the dnc_sync_enabled gate is bypassed: the endpoint serves directly and federal_feeds_synced returns true. Read that field on every response to confirm whether a federal scrub is actually backing the result.

​
RND — Reassigned Numbers Database

US phone numbers get reassigned to new people. The FCC’s Reassigned Numbers Database lets you check whether a number was disconnected after the date you obtained consent — a “safe harbor” against texting or calling the wrong person. GET /rnd/check takes the phone and the consent_date (YYYY-MM-DD):
While feed_synced is false this is the only response the endpoint returns, whatever the phone and consent_date — no disconnect dates are on record yet, so every verdict degrades to no_data. status is one of yes, no, or no_data — the FCC database’s verdict for the (phone, consent_date) pair: safe_harbor is true only when status is no. last_disconnect_date is the most-recent permanent-disconnect date on record (null when none), and feed_synced is false until RND feed ingestion is configured — while it is false every verdict is no_data. Gated behind rnd_scrub_enabled (default off); returns 403 RND_SCRUB_NOT_ENABLED while disabled.

​
Enabling and disabling RND scrubbing

Use PUT /api/v1/compliance/rnd/settings to control the rnd_scrub_enabled flag:
Enabling is blocked with HTTP 409 RND_FEED_NOT_CONFIGURED until the FCC Reassigned Numbers Database feed (SomosGov’s reassigned.us feed) is connected to your deployment. Turning the feature on before the feed is ingested would create a compliance control that performs no actual reassigned-number screening — you’d flip the flag, but every /rnd/check lookup would still return no_data. The 409 block prevents this false sense of protection. Disabling (enabled: false) is always permitted, even if no feed is yet connected.

​
RMD — Robocall Mitigation Database

US voice originators must file a Robocall Mitigation Database registration describing their STIR/SHAKEN status and mitigation plan. Orbit stores and tracks your filing.
  • GET /rmd — read your registration plus a recertification block with renewal_deadline and action_required.
  • POST /rmd — create or update the filing.
  • POST /rmd/submit → status submitted.
  • POST /rmd/certify → status active.
  • POST /rmd/remediation (with a reason) → status remediation_required.
  • POST /rmd/resolve → back to active.
  • POST /rmd/withdraw → status withdrawn.
stir_shaken_status is complete, partial, or none. A mitigation_plan is required unless status is complete. The lifecycle is draft → submitted → active → remediation_required → active | withdrawn.

​
Emergency stop

The emergency stop is an org-wide kill switch that immediately halts all outbound SMS, MMS, voice, and dialer traffic — use it during an incident (a misconfigured campaign, a compromised key, a content mistake).
GET /emergency-stop returns the current active flag plus activated_at, activated_by, and reason. Activation and deactivation require an admin/owner key.
While the emergency stop is active, all outbound SMS, MMS, voice, and dialer campaign traffic for the organization is blocked. Transactional Verify/OTP sends and email are not gated by the emergency stop — they run on separate delivery paths, so a contact can still receive a login code while the switch is active. If you also need to pause those, disable the relevant Verify profile or email sender. Deactivate the stop as soon as the incident is resolved.

​
Preference center

The preference center is a public, token-signed page where a contact manages their own channel opt-ins, message frequency, and (if enabled) requests data deletion — without logging in. Updates flow straight into consent, suppression, and the STOP-fence. Configure it once, then generate a per-contact link:
  • POST /preference-center (admin/owner) — set branding, the channels offered, frequency options, and the GDPR-delete toggle.
  • GET /preference-center — read the current config.
  • POST /preference-center/link with { "contactId": "cnt_…" } — mint a signed link (HMAC-SHA256, 30-day TTL) to email or text to the contact.
The contact then uses the public link (GET/PUT /compliance/preferences/{token}) to view and update their preferences. Opting out here records a consent revocation, adds a suppression entry, and sets the STOP-fence; opting back in reverses it.
Requesting deletion from the preference center records a legacy GDPR deletion request only — it flags the contact for deletion but does not start the tracked DSAR pipeline. It has no SLA clock, no decrypted data export, and no Article-17 erasure certificate. To file a right-to-erasure request that is SLA-tracked, exports the contact’s data, and produces an erasure certificate, use the DSAR endpoint (POST /compliance/dsar, owner/admin only) — see Data Subject Access Requests.

​
Country rules

GET /country-rules is the read-only regulatory reference behind these gates — per country and channel it reports the allowed sender types, whether Sender-ID registration is none / recommended / required, STOP-keyword requirements, two-way support, DLR support, and default throughput.
Use it to understand, before you launch in a market, what each destination requires — see Country Compliance Requirements for a field-by-field guide to reading this reference.