> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Assembling a STIR/SHAKEN Outbound Posture End to End

> The sequenced guide across your attestation controls: number ownership, delegate certificates, the per-DID inbound floor, branded calling, CNAM fallback, downgrade troubleshooting, and the reporting policy that measures all of it.

# Assembling a STIR/SHAKEN Outbound Posture End to End

The voice-channel page documents the whole STIR/SHAKEN model on
[STIR/SHAKEN attestation](/channels/voice/stir-shaken), but the operational
setup is spread across five surfaces: the delegate-certificate registry in
[Attestation posture](/compliance/attestation), the concept anchor in
[The attestation model](/concepts/stir-shaken-attestation-model), the
branded-calling controls in
[Branded calling (RCD)](/compliance/branded-calling), and two troubleshooting
pages. This guide is the order a tenant actually assembles an outbound
attestation posture in — ownership first, delegated coverage second,
inbound floor and brand presentation third, reporting and remediation last.

<Warning>
  Attestation posture is a **tenant-owned control surface**. Orbit records
  and enforces the posture you set; it does not mandate one, and regulatory
  compliance for your traffic stays with you and your counsel. This page is
  not legal advice.
</Warning>

## The tenant-owned framing

Read this before any control below:

* **Ownership fixes are the only real lever.** Owning the number through
  Orbit is the only path to full (A) attestation. Delegate certificates
  raise numbers you control elsewhere from C to **B, never A** — a
  deliberately hard ceiling, because a self-registered artifact must never
  be able to spoof full attestation.
* **The policy fields are reporting, not a gate.** Your target level,
  downgrade handling, and inbound floor classify what your posture snapshot
  reports; they never raise what gets signed, reroute a call, or block one
  at dial time.
* **Orbit computes and signals; Devotel's wholesale softswitch signs.**
  The platform resolves your caller ID against ownership, leases, and
  registered delegate certificates and stamps the level on the outbound
  INVITE. Devotel's carrier-of-record softswitch holds the STIR/SHAKEN
  signing certificate and signs the PASSporT — never higher than the level
  the platform attests.

## Section 1 — The STIR/SHAKEN surface map

One row per control you own, mapped to the endpoint that holds it and the
deep page that documents it. The sections the rest of this guide sequences
are the second column in the order below.

| Control                                                              | Endpoint / surface                                                                            | Deep page                                                                                                                       |
| -------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| **Resolve ownership per outbound campaign** (owned → A, leased → B)  | Numbers inventory; ownership resolution at dial time                                          | [STIR/SHAKEN attestation](/channels/voice/stir-shaken) — level resolution                                                       |
| **Register delegate certificates for BYON/external numbers** (C → B) | `POST /api/v1/compliance/attestation/delegate-certs`                                          | [Attestation posture](/compliance/attestation) — BYON upgrade                                                                   |
| **Set the per-DID or per-route inbound attestation floor**           | Inbound route / DNIS rule; calls below the floor get SIP 603 Decline                          | [Inbound voice routing](/concepts/inbound-voice-routing) — caller screening                                                     |
| **Wire branded calling for A-eligible traffic**                      | `PUT /api/v1/settings/branded-calling`                                                        | [Branded calling (RCD)](/compliance/branded-calling)                                                                            |
| **Register CNAM as the fallback name**                               | Numbers → CNAM per DID                                                                        | [CNAM & Caller ID](/numbers/cnam)                                                                                               |
| **Tune the reporting policy and read the snapshot**                  | `GET/PUT /api/v1/compliance/attestation/policy`; `GET /api/v1/compliance/attestation/posture` | [Attestation posture](/compliance/attestation), [Downgrade troubleshooting](/troubleshooting/stir-shaken-attestation-downgrade) |

The sequence is deliberate: every step down the list is a fallback, not a
substitute. Close the gap at ownership first; if ownership can't close it,
cover with a certificate; branded calling and CNAM paint over whatever a
certificate still leaves exposed.

## Section 2 — A worked sequence for one campaign

A concrete run for a tenant moving a campaign onto compliant voice traffic.
Each step leaves a read-back that proves it took.

### 1. Resolve ownership per campaign

Pull the numbers the campaign intends to dial from, and classify each:
`owned` (purchased or ported into Orbit) resolves to A, `leased` (a pool
assignment) resolves to B, anything else needs a certificate to leave C.

**Do:** prefer owned numbers for a campaign that needs A-attested
deliverability. When a campaign must present a number you don't own on the
platform (a client-leased external number, a BYON caller ID), that step's
certification comes from the certificate rung below.

**Evidence:** the per-number list from
`GET /api/v1/compliance/attestation/posture` names which of the campaign's
numbers sit at `owned` (A), `leased` (B), or nothing.

### 2. Register delegate certificates for external numbers

For every caller ID you control elsewhere, obtain the delegated-attestation
certificate chain (PEM) from your service provider per ATIS-1000092, then
register it with the coverage the outbound set actually uses (E.164).

```bash theme={null}
curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/attestation/delegate-certs" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "friendly_name": "Client campaign caller-ID coverage",
    "certificate_pem": "-----BEGIN CERTIFICATE-----\n…\n-----END CERTIFICATE-----",
    "covered_numbers": ["+14155551234", "+14155550987"],
    "covered_ranges": [{ "start": "+14155555000", "end": "+14155555999" }],
    "not_before": "2026-09-01T00:00:00Z",
    "not_after": "2027-09-01T00:00:00Z"
  }'
```

**Do:** every external caller ID you dial (not just this campaign). An
unused registration gives you no coverage. Watch the certificate lifecycle
the registry derives live — `pending` (valid-from still ahead), `expired`
(past valid-until), and `revoked` each mean those numbers have already
fallen back to their ownership-based level (C).

**Evidence:** `GET /api/v1/compliance/attestation/delegate-certs` lists
the active registry; `revoke` removes certificates you no longer own.

### 3. Set the inbound floor per route

Inbound calls arrive with their own attestation from the upstream carrier.
Set the minimum inbound attestation level your DNIS rule or inbound route
treats as acceptable — calls below it get a SIP 603 Decline, not a
silent-accept.

**Do:** wire the inbound floor **after** the outbound half has settled.
A floor you set before your campaign numbers stabilize can refuse calls
that your own callers legitimately offer, so hold the admission rule until
the certificate/ownership work above has closed the traffic half.

**Evidence:** the
[inbound voice routing](/concepts/inbound-voice-routing) caller-screening
rule; a floor you set on a route you never read back gives you no
declined-count readout, so surface the floor in reporting before resetting
it.

### 4. Wire branded calling for the A-eligible numbers

On the numbers that reached A (or would reach A on an owned-ownership fix),
register the verified brand name, logo over `https://`, and
reason-for-call:

```bash theme={null}
curl -X PUT "https://api.orbit.devotel.io/api/v1/settings/branded-calling" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true,
    "display_name": "Acme Support",
    "logo_url": "https://assets.acme.example/sq-logo.png",
    "reason_for_call": "Appointment reminder"
  }'
```

**Do:** the answer-rate holdout experiment. A `holdout_pct` between 0 and
50 withholds the RCD payload on that share of eligible calls, forming the
randomized unbranded control the
`GET /api/v1/numbers/:id/branded-calling-cohort` readout reports as an
honest lift.

**Evidence:** the branded-calling cohort readback reports branded over
unbranded answer-rate uplift; carriers where your brand registration hasn't
completed still drop the payload silently, so read the cohort before
declaring it live.

### 5. Register CNAM as the fallback name

Register the calling name carriers display for callers on carriers without
RCD support — attestation proves the number, CNAM names it.

**Do:** at minimum on the A-eligible numbers where branded calling can't
ride (a B-certificated BYON, or a carrier the brand registration never
completed on). On C-attested numbers CNAM registers too, but the attestation
label still wins the handset's verdict — register it anyway, so the fallback
name follows on the calls that recover from the rest of the run.

**Evidence:** the
[CNAM & Caller ID](/numbers/cnam) register; the attestation label decides
the handset treatment, and the registered CNAM name fills in for the
fallback label.

### 6. Tune the reporting policy and read the snapshot

Set your org's target and inbound floor, then read the snapshot:

```bash theme={null}
curl -X PUT "https://api.orbit.devotel.io/api/v1/compliance/attestation/policy" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target_attestation": "A",
    "downgrade_handling": "alert",
    "inbound_min_verification": "B",
    "flag_unverified_inbound": true
  }'

curl "https://api.orbit.devotel.io/api/v1/compliance/attestation/posture" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

**Do:** a declarative readback, not a rollout knob. Policy writes don't
move what the softswitch signs — they move what reporting calls below
target. Watch the `below_target` split as the campaign shifts onto owned
DIDs; it closes as ownership lands, and when it doesn't, the fix lives in
the map above, worked top-down, not in the policy form.

**Evidence:** a `PUT` patch write is partial (`422 VALIDATION_ERROR` on bad
values), the snapshot returns per-number classification plus the 30-day
inbound floor split, and every successful write lands in your audit log.

If any of these steps flags a number `meets_target: false`, run the
[attestation-downgrade troubleshooting
page](/troubleshooting/stir-shaken-attestation-downgrade) in the order the
page lists the root causes — ownership ceiling first, certificate
lifecycle second, registration reject third, per-number branded-calling
override fourth, carrier coverage fifth.

## Section 3 — What Orbit does NOT do

Boundary conditions, stated once and plainly:

* **Orbit never signs a PASSporT.** The platform computes and signals the
  level; Devotel's wholesale softswitch (the carrier of record) signs — at
  exactly the level the platform attests, never higher. Holding a stolen
  platform credential can't raise what signs through it.
* **Delegate certificates cap at B.** A self-registered
  ATIS-1000092 chain never reaches full (A) attestation; ownership is the
  only path to A, and it is deliberate.
* **Nothing on this page gates an outbound call.** The policy,
  certificates, and brand surface live in reporting, and a downgrade never
  blocks a call the way a blocked call never reports a downgrade. The only
  refusal here is inbound — the SIP 603 Decline a floor you explicitly set
  returns to calls that arrive below it.
* **The per-number override ceiling is opt-out, not opt-in.** A per-DID
  inbound floor or a per-DID branded-calling override you never set is not
  applied — the org default carries on every call the profile doesn't
  explicitly claim.
* **Branded calling pays only on A-attested numbers.** Brand configuration
  on a B-certificated or leased traffic never rides the call — the payload
  drops and the handset falls back to plain attestation plus CNAM. Fix the
  level first; wire the brand second.

***

## Related references

* [STIR/SHAKEN attestation](/channels/voice/stir-shaken) — the model
  behind A/B/C levels, signing vs. signalling, and the inbound parsed result.
* [Attestation posture](/compliance/attestation) — the policy surface,
  delegate-certificate registry, and the posture snapshot.
* [The attestation model](/concepts/stir-shaken-attestation-model) — the
  concept anchor behind the whole model.
* [Inbound voice routing](/concepts/inbound-voice-routing) — the
  per-route caller-screening rule the inbound floor lives under.
* [Branded calling (RCD)](/compliance/branded-calling) — the brand
  presentation surfaces and cohort readout steps 4–5 above run against.
* [CNAM & Caller ID](/numbers/cnam) — the fallback name surface.
* [Attestation downgrade troubleshooting](/troubleshooting/stir-shaken-attestation-downgrade) —
  the fix runs when a level reports below your target, ordered the way the
  root causes fire.
* [Error codes](/reference/error-codes) —
  `INVALID_CERTIFICATE`, `INVALID_COVERAGE_RANGE`, `DELEGATE_CERT_LIMIT`,
  `DELEGATE_CERT_DUPLICATE` live here when they appear on the two
  write endpoints.