​

Configure Your Tenant’s Compliance Posture Before the First Send

​

The one thing to know before you start

​

Step 1 — Record the consent baseline

• API: POST /api/v1/compliance/consent — see Consent Management.
• Dashboard: consent records are also writable from the contact profile.
• Default: no consent records exist. Nothing is blocked by this, but nothing has cover either — consent coverage is 30% of the compliance-health score, and a recipient without a consent record won’t pass the quiet-hours carve-out in step 3.

​

Step 2 — Wire the opt-out paths

1. Import your legacy suppression list before the first send if you are migrating from another platform — POST /api/v1/compliance/suppression-list/import accepts a CSV upload. Phone and WhatsApp rows default to scope all, which gates voice and dialer traffic too; email rows default to scope email. Details in Opt-Out & Suppression Lists.
2. Configure a preference center — POST /api/v1/compliance/preference-center, then mint per-contact signed links with POST …/preference-center/link and publish them in your footer or welcome flow. A contact who opts out through the link lands on the same suppression list a STOP keyword or a Consent API opt-out would — structured now instead of as a support ticket later. Details in Send Gates → Preference center.

• Defaults: the suppression list is empty until STOP keywords, opt-outs, or imports populate it — and suppression is the one gate that is fail-closed for entries that exist: a suppressed address is dropped before dispatch regardless of how the entry got there. The preference center has no public page until you create it over the API.
• Leaving it off: your first campaign starts honoring keywords the moment it runs, but it starts with zero entries — every legacy opt-out you failed to import becomes a complaint or a carrier rejection instead of a suppressed send.

​

Step 3 — Set quiet hours per channel

1. The per-channel org gate. Each channel’s quiet-hours toggle ships off — a new tenant’s SMS, WhatsApp, and voice sends are not held by any window until you enable the channel. Enable it per channel by writing the quiet_hours block through PUT /api/v1/settings/general with settings.quiet_hours.<channel>.enabled (the voice channel can additionally be flipped from Settings → Voice in the dashboard). Windows default to 08:00–21:00 recipient-local for SMS/voice and 09:00–21:00 for WhatsApp/Meta channels once enabled; set your own start_hour / end_hour to override.
2. The campaign fallback window. Drip and journey sends that carry no window of their own inherit the platform default 21:00–09:00 until you write PUT /api/v1/campaigns/quiet-hours/settings — or set Settings → Campaign limits → Default quiet hours in the dashboard.

• Leaving them off: sends dispatch at any hour. For US traffic that is a TCPA exposure on every message outside 08:00–21:00 recipient-local — the per-channel gate is the control that holds them, and it is off until you flip it.
• Verify before rollout: GET /api/v1/compliance/quiet-hours/preview answers “would this send, to this recipient, be held right now — and until when?” without sending.

​

Step 4 — Read the country rules before you launch in a market

• GET /api/v1/compliance/country-rules?channel=sms&region=EU — per country and channel: allowed sender types, whether Sender-ID registration is none / recommended / required, STOP-keyword requirements, two-way support, DLR support, and default throughput.

​

Step 5 — Acknowledge and enable the DNC and RND pre-flight checks

• Default: off — the endpoint returns 403 DNC_SYNC_NOT_ENABLED until you opt in.
• Why the acknowledgment exists: until a federal register snapshot is synced to the platform, a number that appears only on the FTC list reads back as on_dnc: false. The toggle confirms you understand the check is your own list plus whatever registries have synced, not a guaranteed national scrub. Read federal_feeds_synced on every response to see which state you’re in.
• Leaving it off: no pre-flight check at all; your send-path suppression from step 2 still drops your own opt-outs, but nothing screens against a registry before you dial.

• Default: off — the endpoint returns 403 RND_SCRUB_NOT_ENABLED.
• Fail-closed enable: turning it on before the FCC feed is connected is refused with 409 RND_FEED_NOT_CONFIGURED — Orbit will not let you flip a switch that screens against nothing. Until the feed is synced every verdict degrades to no_data and no safe harbor applies.

​

Step 6 — Know where the emergency stop is

• POST /api/v1/compliance/emergency-stop/activate with a reason (owner/admin key) halts all outbound SMS, MMS, voice, and dialer traffic in one call.
• GET …/emergency-stop reports the state; POST …/deactivate lifts it.

​

End to end: a US SMS marketer’s first-run posture

BASE="https://api.orbit.devotel.io/api/v1"
AUTH="Authorization: Bearer $ORBIT_API_KEY"

1. Capture consent at opt-in and record it the moment a recipient grants it, before the first campaign:
   curl -X POST $BASE/compliance/consent -H "$AUTH" \
     -H "Content-Type: application/json" \
     -d '{
       "identifier": "+14155550101",
       "channels": ["sms"],
       "opt_in": true,
       "source": "signup_form"
     }'
   
2. Import the legacy opt-out list — one CSV before the first send, so inherited opt-outs are suppressed from day one:
   curl -X POST $BASE/compliance/suppression-list/import \
     -H "$AUTH" -F "file=@legacy-opt-outs.csv"
   
   Then set an ongoing export cadence for your own records: GET /compliance/suppression-list/export?format=csv on whatever schedule your counsel wants — weekly is common (Opt-Out & Suppression Lists).
3. Complete 10DLC brand and campaign registration (10DLC guide) — US long-code traffic without it degrades regardless of the gates above, and country-rules reports registration as required for US/sms (step 4 in reverse: this is what the check tells you to do).
4. Enable the SMS quiet-hours gate — 08:00–21:00 recipient-local is the platform window; keep consent_overrides_quiet_hours true so consented recipients stay reachable:
   curl -X PUT $BASE/settings/general -H "$AUTH" \
     -H "Content-Type: application/json" \
     -d '{
       "settings": {
         "quiet_hours": {
           "sms": { "enabled": true, "start_hour": 8, "end_hour": 21 },
           "consent_overrides_quiet_hours": true
         }
       }
     }'
   
   The quiet_hours key is replaced wholesale on this write — put the full tree in the body, not just the channel you are changing (Quiet hours configuration). Then verify with GET /compliance/quiet-hours/preview before the first campaign.
5. Enable DNC pre-flight and run GET /compliance/dnc/check against campaign lists before each send (once per number; cache the result per campaign batch):
   curl -X PUT $BASE/settings/general -H "$AUTH" \
     -H "Content-Type: application/json" \
     -d '{ "settings": { "dnc_sync_enabled": true } }'
   
   In the dashboard the same change is Settings → Compliance → DNC pre-flight, with the acknowledgment checked.
6. Wire the preference center and publish signed links in your message footer flow, so opt-outs arrive structured — and confirm your owner/admin key can call the emergency stop.

​

The posture checklist

​

Verify the posture you just built

• GET /compliance/health (plus /health/numbers and /health/campaigns) — the 0–100 score per organization, sender, and campaign, with ranked warnings. Consent coverage from step 1 shows up here. Compliance Health Scores.
• GET /compliance/quiet-hours/preview — the dry-run for step 3 and step 4 of the example. If it says a send would be held until a time, schedule to that time instead of retrying into the window.

​

From first-run to production go-live

1. Identity first. Upload KYC documents and build at least one compliance profile before numbers, registrations, or scrub toggles — everything downstream references it. Control: POST /api/v1/compliance/kyc/documents, referenced by document ID. KYC Documents & the Compliance-Profile Lifecycle.
2. Consent at opt-in. Record consent the moment each recipient grants it, per channel — step 1 of the runbook above. Control: POST /api/v1/compliance/consent. Consent Management.
3. Registry pre-flight (voice/dialer). Opt into the DNC check, and add RND for US voice when you need the § 227 safe harbor — steps 5 and 5a. Controls: GET /compliance/dnc/check, PUT /compliance/rnd/settings. DNC Scrubbing.
4. Export your proof. Before the first campaign, set the cadence that downloads consent proof and the suppression ledger — the audit file a TCPA or GDPR inquiry asks for. Controls: GET /compliance/consent/export and GET /compliance/suppression-list/export?format=csv. Export Consent & Suppression Records.
5. Market rules. Read GET /compliance/country-rules per market (step 4), finish every registration it flags as required, then close with the checklist above. Controls: the read-only country-rules endpoint plus POST /compliance/sender-id-registrations. Country Compliance Requirements.

​

Common “gated surface” causes

​

Sample rollout order (US voice + SMS + WhatsApp)

1. KYC documents + compliance profile — the identity surface every later step references. KYC Documents.
2. Consent capture and suppression import — the records everything else reads. Consent Management, Opt-Out & Suppression.
3. DNC (and RND for US voice) pre-flight — opt in before dialing lists exist. DNC Scrubbing.
4. Sender-ID registrations and the registration gates — flip the channels’ quiet-hours and preference-center writes only after traffic can flow. Sender-ID Registration.
5. country-rules per market at expansion time — re-run this before each new country or channel. Country Requirements.
6. Close with the FAQ’s mental model — what defaults open, what fails open versus closed, and where the hard rails you can’t unset live. Compliance Posture FAQ.

​

Where the hard rail ends

​

Related references

• Posture overview — the full toggle map this runbook walks through, including what is not tenant-toggleable.
• Send Gates — per-gate request/response reference for every endpoint above.
• Quiet hours configuration — both quiet-hours knobs, carve-outs, and the voice exception.
• DNC Scrubbing — the scrub chain and the fail-open caveat behind the DNC acknowledgment.
• Export Consent & Suppression Records — the audit-proof downloads for consent and the suppression ledger.
• Country Compliance Requirements — per-country sender rules and required documents.
• Troubleshoot a Pending Number or Sender ID — approval-side gating for numbers and sender IDs.
• Compliance Posture FAQ — the mental model for defaults-open gates and approvals with external lead time.
• Opt-Out & Suppression Lists — scopes, STOP keywords, and CSV import format.
• Assembling a GDPR Posture End to End — the sibling runbook for EU traffic.
• Go-live checklist — the non-compliance pre-launch list this posture slots into.