Assembling a STIR/SHAKEN Outbound Posture End to End
The voice-channel page documents the whole STIR/SHAKEN model on STIR/SHAKEN attestation, but the operational setup is spread across five surfaces: the delegate-certificate registry in Attestation posture, the concept anchor in The attestation model, the branded-calling controls in Branded calling (RCD), and two troubleshooting pages. This guide is the order a tenant actually assembles an outbound attestation posture in — ownership first, delegated coverage second, inbound floor and brand presentation third, reporting and remediation last.The tenant-owned framing
Read this before any control below:- Ownership fixes are the only real lever. Owning the number through Orbit is the only path to full (A) attestation. Delegate certificates raise numbers you control elsewhere from C to B, never A — a deliberately hard ceiling, because a self-registered artifact must never be able to spoof full attestation.
- The policy fields are reporting, not a gate. Your target level, downgrade handling, and inbound floor classify what your posture snapshot reports; they never raise what gets signed, reroute a call, or block one at dial time.
- Orbit computes and signals; Devotel’s wholesale softswitch signs. The platform resolves your caller ID against ownership, leases, and registered delegate certificates and stamps the level on the outbound INVITE. Devotel’s carrier-of-record softswitch holds the STIR/SHAKEN signing certificate and signs the PASSporT — never higher than the level the platform attests.
Section 1 — The STIR/SHAKEN surface map
One row per control you own, mapped to the endpoint that holds it and the deep page that documents it. The sections the rest of this guide sequences are the second column in the order below.
The sequence is deliberate: every step down the list is a fallback, not a
substitute. Close the gap at ownership first; if ownership can’t close it,
cover with a certificate; branded calling and CNAM paint over whatever a
certificate still leaves exposed.
Section 2 — A worked sequence for one campaign
A concrete run for a tenant moving a campaign onto compliant voice traffic. Each step leaves a read-back that proves it took.1. Resolve ownership per campaign
Pull the numbers the campaign intends to dial from, and classify each:owned (purchased or ported into Orbit) resolves to A, leased (a pool
assignment) resolves to B, anything else needs a certificate to leave C.
Do: prefer owned numbers for a campaign that needs A-attested
deliverability. When a campaign must present a number you don’t own on the
platform (a client-leased external number, a BYON caller ID), that step’s
certification comes from the certificate rung below.
Evidence: the per-number list from
GET /api/v1/compliance/attestation/posture names which of the campaign’s
numbers sit at owned (A), leased (B), or nothing.
2. Register delegate certificates for external numbers
For every caller ID you control elsewhere, obtain the delegated-attestation certificate chain (PEM) from your service provider per ATIS-1000092, then register it with the coverage the outbound set actually uses (E.164).pending (valid-from still ahead), expired
(past valid-until), and revoked each mean those numbers have already
fallen back to their ownership-based level (C).
Evidence: GET /api/v1/compliance/attestation/delegate-certs lists
the active registry; revoke removes certificates you no longer own.
3. Set the inbound floor per route
Inbound calls arrive with their own attestation from the upstream carrier. Set the minimum inbound attestation level your DNIS rule or inbound route treats as acceptable — calls below it get a SIP 603 Decline, not a silent-accept. Do: wire the inbound floor after the outbound half has settled. A floor you set before your campaign numbers stabilize can refuse calls that your own callers legitimately offer, so hold the admission rule until the certificate/ownership work above has closed the traffic half. Evidence: the inbound voice routing caller-screening rule; a floor you set on a route you never read back gives you no declined-count readout, so surface the floor in reporting before resetting it.4. Wire branded calling for the A-eligible numbers
On the numbers that reached A (or would reach A on an owned-ownership fix), register the verified brand name, logo overhttps://, and
reason-for-call:
holdout_pct between 0 and
50 withholds the RCD payload on that share of eligible calls, forming the
randomized unbranded control the
GET /api/v1/numbers/:id/branded-calling-cohort readout reports as an
honest lift.
Evidence: the branded-calling cohort readback reports branded over
unbranded answer-rate uplift; carriers where your brand registration hasn’t
completed still drop the payload silently, so read the cohort before
declaring it live.
5. Register CNAM as the fallback name
Register the calling name carriers display for callers on carriers without RCD support — attestation proves the number, CNAM names it. Do: at minimum on the A-eligible numbers where branded calling can’t ride (a B-certificated BYON, or a carrier the brand registration never completed on). On C-attested numbers CNAM registers too, but the attestation label still wins the handset’s verdict — register it anyway, so the fallback name follows on the calls that recover from the rest of the run. Evidence: the CNAM & Caller ID register; the attestation label decides the handset treatment, and the registered CNAM name fills in for the fallback label.6. Tune the reporting policy and read the snapshot
Set your org’s target and inbound floor, then read the snapshot:below_target split as the campaign shifts onto owned
DIDs; it closes as ownership lands, and when it doesn’t, the fix lives in
the map above, worked top-down, not in the policy form.
Evidence: a PUT patch write is partial (422 VALIDATION_ERROR on bad
values), the snapshot returns per-number classification plus the 30-day
inbound floor split, and every successful write lands in your audit log.
If any of these steps flags a number meets_target: false, run the
attestation-downgrade troubleshooting
page in the order the
page lists the root causes — ownership ceiling first, certificate
lifecycle second, registration reject third, per-number branded-calling
override fourth, carrier coverage fifth.
Section 3 — What Orbit does NOT do
Boundary conditions, stated once and plainly:- Orbit never signs a PASSporT. The platform computes and signals the level; Devotel’s wholesale softswitch (the carrier of record) signs — at exactly the level the platform attests, never higher. Holding a stolen platform credential can’t raise what signs through it.
- Delegate certificates cap at B. A self-registered ATIS-1000092 chain never reaches full (A) attestation; ownership is the only path to A, and it is deliberate.
- Nothing on this page gates an outbound call. The policy, certificates, and brand surface live in reporting, and a downgrade never blocks a call the way a blocked call never reports a downgrade. The only refusal here is inbound — the SIP 603 Decline a floor you explicitly set returns to calls that arrive below it.
- The per-number override ceiling is opt-out, not opt-in. A per-DID inbound floor or a per-DID branded-calling override you never set is not applied — the org default carries on every call the profile doesn’t explicitly claim.
- Branded calling pays only on A-attested numbers. Brand configuration on a B-certificated or leased traffic never rides the call — the payload drops and the handset falls back to plain attestation plus CNAM. Fix the level first; wire the brand second.
Related references
- STIR/SHAKEN attestation — the model behind A/B/C levels, signing vs. signalling, and the inbound parsed result.
- Attestation posture — the policy surface, delegate-certificate registry, and the posture snapshot.
- The attestation model — the concept anchor behind the whole model.
- Inbound voice routing — the per-route caller-screening rule the inbound floor lives under.
- Branded calling (RCD) — the brand presentation surfaces and cohort readout steps 4–5 above run against.
- CNAM & Caller ID — the fallback name surface.
- Attestation downgrade troubleshooting — the fix runs when a level reports below your target, ordered the way the root causes fire.
- Error codes —
INVALID_CERTIFICATE,INVALID_COVERAGE_RANGE,DELEGATE_CERT_LIMIT,DELEGATE_CERT_DUPLICATElive here when they appear on the two write endpoints.