> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Send Gates: Quiet Hours, DNC, RND, RMD & Emergency Stop

> The compliance gates Orbit applies before a message or call goes out — quiet-hours windows, Do-Not-Call, FCC Reassigned-Numbers and Robocall-Mitigation databases, the org-wide emergency stop, and the public preference center.

# Send Gates

Beyond consent and suppression, several regulatory checks run **at
send time**. Orbit groups them as *send gates*: each one can hold or
drop a message or call before it dispatches. This page covers the
gates you configure or query directly.

All endpoints below are rooted at
`https://api.orbit.devotel.io/api/v1/compliance`.

<Warning>
  DNC and RND scrub against national registers — the FTC federal and
  state Do-Not-Call registers and the TCR Universal Opt-Out for DNC,
  and the FCC Reassigned Numbers Database for RND. These are not feeds
  you wire up or integrate per tenant: when a register snapshot is in
  place, the platform maintains it centrally rather than reading from
  your own integration. But the scrub is **off by default** — each
  gate reports `federal_feeds_synced` / `feed_synced` as `false` until
  a snapshot is actually synced for it, and stays behind a per-
  organization opt-in toggle. Until both are true these endpoints
  return a disabled response and a number only on a federal register
  reads back clear (see each gate below for its exact behaviour). This
  page is not legal advice — confirm your TCPA/FCC obligations with
  counsel.
</Warning>

***

## Quiet hours

Quiet-hours rules block messages and calls that would land outside a
recipient's permitted local hours (e.g. the TCPA 8 am–9 pm window).
Orbit resolves the recipient's local time from their phone number's
region.

`GET /quiet-hours/preview` tells you whether a send is allowed right
now, and when the next allowed time is — use it to schedule around the
window.

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/quiet-hours/preview?phone=%2B14155550101&channel=sms" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

```json theme={null}
{
  "allowed_now": false,
  "local_hour": 22,
  "local_timezone": "America/Los_Angeles",
  "window_start_local": "08:00",
  "window_end_local": "21:00",
  "next_allowed_at": "2026-06-09T15:00:00.000Z",
  "reason": "outside_window",
  "channel": "sms"
}
```

| Query param         | Notes                                                                        |
| ------------------- | ---------------------------------------------------------------------------- |
| `phone`             | E.164 (required).                                                            |
| `channel`           | `sms`, `mms`, `whatsapp`, `rcs`, `viber`, `telegram`, `voice`, `email`, etc. |
| `timezone_override` | Optional IANA timezone if you already know it.                               |

Quiet-hours gating is **opt-in per channel and organization** — every
channel ships with the toggle off, so a new tenant's SMS, WhatsApp, and
other sends are not held by quiet hours until you enable the gate for
that channel. Turn it on per channel from your organization's
quiet-hours settings in the Orbit dashboard; the listed windows then
apply automatically.

Once enabled, the windows are 08:00–21:00 (recipient-local) for
SMS/voice and 09:00–21:00 for WhatsApp/Meta channels unless you set
your own `start_hour`/`end_hour`. Email, fax, and push are not
quiet-hours gated.

<Note>
  **US voice TCPA window: advisory for ad-hoc dials, a hard block for
  campaigns.** For outbound voice calls to US (+1) recipients, Orbit
  evaluates the federal TCPA 8 am–9 pm recipient-local dialing window on
  every call — but how it enforces the result depends on the call path:

  * **Ad-hoc 1:1 dialing from the dashboard is advisory by default.** A
    call outside the window records a structured advisory log but still
    dispatches. To hold these calls instead, enable the voice quiet-hours
    toggle for your organization; enabling it applies the 8 am–9 pm window
    as a hard hold.
  * **Campaign and dialer voice traffic is always hard-blocked outside
    the window, regardless of your tenant settings.** A campaign or dialer
    call placed outside 8 am–9 pm recipient-local is rejected with
    `422 TCPA_FEDERAL_DIALING_WINDOW_BLOCKED` — there is no per-organization
    opt-out for automated or bulk voice, and the voice quiet-hours toggle
    does not relax it. If the recipient's timezone cannot be resolved, the
    call fails closed and is also blocked.

  Schedule campaign and dialer calls inside the recipient-local 8 am–9 pm
  window — use `GET /quiet-hours/preview` to find the next allowed time.
</Note>

***

## DNC — Do Not Call

`GET /dnc/check` reports whether a number is on a Do-Not-Call list
before you dial or text it.

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/dnc/check?phone=%2B14155550101" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

When enabled it returns:

```json theme={null}
{
  "on_dnc": true,
  "source": "suppression_list",
  "jurisdictions": ["US"],
  "federal_feeds_synced": false
}
```

The `source` indicates which layer flagged the number (your contact
DNC flag, the DNC list, the suppression list, or a consent opt-out).

<Note>
  The gate applies **only while no Do-Not-Call feed is synced**. In
  that state the endpoint is held behind the org setting
  `dnc_sync_enabled` (default off) and returns
  `403 DNC_SYNC_NOT_ENABLED` until you opt in — acknowledging that
  Orbit isn't yet scrubbing against a federal register for you, so a
  number only on the FTC list reads back as `on_dnc: false`.

  Once Orbit has a federal, state, or TCR snapshot synced, the
  `dnc_sync_enabled` gate is bypassed: the endpoint serves directly
  and `federal_feeds_synced` returns `true`. Read that field on every
  response to confirm whether a federal scrub is actually backing the
  result.
</Note>

***

## RND — Reassigned Numbers Database

US phone numbers get reassigned to new people. The FCC's **Reassigned
Numbers Database** lets you check whether a number was disconnected
*after* the date you obtained consent — a "safe harbor" against
texting or calling the wrong person.

`GET /rnd/check` takes the `phone` and the `consent_date`
(`YYYY-MM-DD`):

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/rnd/check?phone=%2B14155550101&consent_date=2025-01-15" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

```json theme={null}
{
  "status": "no_data",
  "safe_harbor": false,
  "last_disconnect_date": null,
  "consent_date": "2025-01-15",
  "feed_synced": false,
  "reason": "FCC Reassigned Numbers Database has no permanent-disconnect record for this number; no safe harbor — contact at your own risk."
}
```

While `feed_synced` is `false` this is the only response the endpoint
returns, whatever the `phone` and `consent_date` — no disconnect dates are
on record yet, so every verdict degrades to `no_data`.

`status` is one of `yes`, `no`, or `no_data` — the FCC database's verdict
for the `(phone, consent_date)` pair:

| `status`  | `safe_harbor` | Meaning                                                                                                                                    |
| --------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| `yes`     | `false`       | The number was permanently disconnected **after** `consent_date` and may have been reassigned. No safe harbor — do not contact.            |
| `no`      | `true`        | No permanent disconnect after `consent_date`. The FCC reassigned-number safe harbor applies — safe to contact.                             |
| `no_data` | `false`       | The database has no permanent-disconnect record for this number, or the feed is not yet synced. No safe harbor — proceed at your own risk. |

`safe_harbor` is `true` only when `status` is `no`. `last_disconnect_date`
is the most-recent permanent-disconnect date on record (`null` when none),
and `feed_synced` is `false` until RND feed ingestion is configured — while
it is `false` every verdict is `no_data`.

Gated behind `rnd_scrub_enabled` (default off); returns
`403 RND_SCRUB_NOT_ENABLED` while disabled.

### Enabling and disabling RND scrubbing

Use `PUT /api/v1/compliance/rnd/settings` to control the `rnd_scrub_enabled` flag:

```bash theme={null}
curl -X PUT "https://api.orbit.devotel.io/api/v1/compliance/rnd/settings" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"enabled": true}'
```

**Enabling is blocked with HTTP 409 `RND_FEED_NOT_CONFIGURED`** until the FCC Reassigned Numbers Database feed (SomosGov's reassigned.us feed) is connected to your deployment. Turning the feature on before the feed is ingested would create a compliance control that performs no actual reassigned-number screening — you'd flip the flag, but every `/rnd/check` lookup would still return `no_data`. The 409 block prevents this false sense of protection.

Disabling (`enabled: false`) is always permitted, even if no feed is yet connected.

***

## RMD — Robocall Mitigation Database

US voice originators must file a **Robocall Mitigation Database**
registration describing their STIR/SHAKEN status and mitigation plan.
Orbit stores and tracks your filing.

* `GET /rmd` — read your registration plus a `recertification` block
  with `renewal_deadline` and `action_required`.
* `POST /rmd` — create or update the filing.
* `POST /rmd/submit` → status `submitted`.
* `POST /rmd/certify` → status `active`.
* `POST /rmd/remediation` (with a `reason`) → status
  `remediation_required`.
* `POST /rmd/resolve` → back to `active`.
* `POST /rmd/withdraw` → status `withdrawn`.

```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/rmd \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "company_name": "Acme Communications Inc",
    "business_address": "1 Market St, San Francisco, CA",
    "stir_shaken_status": "partial",
    "mitigation_plan": "Known-customer vetting + traceback cooperation…",
    "contact_name": "Jordan Lee",
    "contact_email": "compliance@acme.example"
  }'
```

`stir_shaken_status` is `complete`, `partial`, or `none`. A
`mitigation_plan` is **required** unless status is `complete`. The
lifecycle is `draft → submitted → active → remediation_required →
active | withdrawn`.

***

## Emergency stop

The emergency stop is an **org-wide kill switch** that immediately
halts all outbound SMS, MMS, voice, and dialer traffic — use it during
an incident (a misconfigured campaign, a compromised key, a content
mistake).

```bash theme={null}
# Activate
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/emergency-stop/activate \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "reason": "Suspected list contamination — pausing all sends" }'

# Check
curl https://api.orbit.devotel.io/api/v1/compliance/emergency-stop \
  -H "Authorization: Bearer $ORBIT_API_KEY"

# Deactivate
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/emergency-stop/deactivate \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

`GET /emergency-stop` returns the current `active` flag plus
`activated_at`, `activated_by`, and `reason`. Activation and
deactivation require an admin/owner key.

<Warning>
  While the emergency stop is active, all outbound SMS, MMS, voice, and
  dialer campaign traffic for the organization is blocked. Transactional
  **Verify/OTP** sends and email are **not** gated by the emergency stop
  — they run on separate delivery paths, so a contact can still receive
  a login code while the switch is active. If you also need to pause those,
  disable the relevant Verify profile or email sender. Deactivate the stop
  as soon as the incident is resolved.
</Warning>

***

## Preference center

The **preference center** is a public, token-signed page where a
contact manages their own channel opt-ins, message frequency, and (if
enabled) requests data deletion — without logging in. Updates flow
straight into consent, suppression, and the STOP-fence.

Configure it once, then generate a per-contact link:

* `POST /preference-center` (admin/owner) — set branding, the
  `channels` offered, frequency options, and the GDPR-delete toggle.
* `GET /preference-center` — read the current config.
* `POST /preference-center/link` with `{ "contactId": "cnt_…" }` —
  mint a signed link (HMAC-SHA256, 30-day TTL) to email or text to the
  contact.

The contact then uses the public link
(`GET`/`PUT /compliance/preferences/{token}`) to view and update their
preferences. Opting out here records a consent revocation, adds a
suppression entry, and sets the STOP-fence; opting back in reverses
it.

<Warning>
  Requesting deletion from the preference center records a legacy GDPR
  deletion request only — it flags the contact for deletion but does
  **not** start the tracked DSAR pipeline. It has no SLA clock, no
  decrypted data export, and no Article-17 erasure certificate. To file
  a right-to-erasure request that is SLA-tracked, exports the contact's
  data, and produces an erasure certificate, use the DSAR endpoint
  (`POST /compliance/dsar`, owner/admin only) — see
  [Data Subject Access Requests](/compliance/dsar).
</Warning>

***

## Country rules

`GET /country-rules` is the read-only regulatory reference behind
these gates — per country and channel it reports the allowed sender
types, whether Sender-ID registration is `none` / `recommended` /
`required`, STOP-keyword requirements, two-way support, DLR support,
and default throughput.

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/country-rules?channel=sms&region=EU" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

Use it to understand, before you launch in a market, what each
destination requires — see
[Country Compliance Requirements](/compliance/country-requirements) for a
field-by-field guide to reading this reference.

***

## Related references

* [Country Compliance Requirements](/compliance/country-requirements) —
  per-country sender types, registration, and documentation.

* [Restricted & Prohibited Industries](/compliance/restricted-industries) —
  which industries and content are restricted or banned.

* [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) —
  the suppression layer DNC and the preference center feed.

* [Consent Management](/compliance/consent-management) — the consent
  records updated by the preference center.

* [Sender-ID Registration](/compliance/sender-id-registration) — the
  registration `country-rules` reports as required.

* [API Reference → Compliance](/api-reference/compliance) — full
  request/response schemas (regenerated from the live API).