> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Concepts hub > The index over every concept page — the seven pillar groupings with one-line annotations for each flagship model, then a generated browse-the-rest table that quotes each page's description so the hub cannot drift # Concepts hub The Concepts section holds roughly 300 model pages, and until this page existed the only way in was to guess a filename. This hub names the pillar each concept belongs to, annotates the flagship model in that pillar in one line, and then lists every remaining page with the description that page publishes — so the index below always says what the pages say. Use [Concepts overview](/concepts/overview) for the ordered narrative walk through the same material; use this hub when you know the rough pillar and need the page. ## Messaging & delivery * [Delivery lifecycle: queued to delivered, and the states in between](/concepts/delivery-lifecycle) — What each outbound status means and which actor advances it. * [Message status transition rules: the DAG every consumer must agree on](/concepts/message-status-dag) — The allowed status transitions and precedence rules your reconciliation must mirror. * [The single message-status map: four owners, one answer](/concepts/message-status-map) — Which of the lifecycle pages owns meanings, transitions, and vocabulary. * [The DLR model: two planes, one vocabulary](/concepts/dlr-model-two-planes) — How carrier receipts and Orbit's canonical vocabulary split into two planes. * [Send-side DLR model: the canonical vocabulary and absorbed-traffic receipts](/concepts/send-side-dlr-model) — The canonical delivery-state vocabulary your SMPP bind or webhook receives. * [Sender resolution — which sender an outbound message goes out from](/concepts/sender-resolution) — The full chain that picks the sender an outbound message goes out from. * [How routing picks a sender — and where a reply lands](/concepts/sender-and-routing) — Sender resolution outbound plus the tenant MO rules that place inbound messages. * [Sender pool selection — how a pool picks one sender and stays healthy](/concepts/sender-pool-selection-model) — How a pool picks one member and stays healthy under rotation. * [Choosing a sender construct — pools vs services vs inline senders](/concepts/sender-identity-decision-model) — When to send inline from, pool, extension, or messaging service. * [Least-cost routing (LCR) policy](/concepts/least-cost-routing) — How ranked upstream routes are chosen after the sender resolves. * [Message send request lifecycle: one send from POST to provider](/concepts/message-send-request-lifecycle) — The end-to-end arc of one outbound send from POST to provider. * [Pricing and rate resolution: how a per-operator price is attributed](/concepts/pricing-rate-resolution) — How a per-operator price resolves through overrides and markups. * [The usage metering pipeline: from a sent message to the wallet ledger](/concepts/usage-metering-pipeline) — From a sent message to the append-only usage record and rollups. * [SMS segments and encoding: why one character can double the cost](/concepts/sms-segments-and-encoding) — Why encoding and segment splits can multiply what one message costs. ## Billing & numbers * [How billing meters your usage: wallet, rating, and the ledger](/concepts/billing-and-wallet) — The prepaid wallet map: rating, tiers, FX, top-ups, and reconciliation. * [Wallets, credits, and charges: how usage metering works](/concepts/wallets-credits-and-charges) — The append-only metering ledger behind the prepaid wallet. * [Number rental and your wallet: renewal, suspend, and prevent-default posture](/concepts/billing-and-numbers-renewal-model) — What an idle number costs and how renewals fail safely. * [Number status map: from purchase to release](/concepts/number-lifecycle) — The six states a phone number moves through from purchase to release. * [Number portability: one model for port-in and port-out](/concepts/number-portability-model) — Port-in and port-out as one two-direction state machine. * [Port-out lifecycle and the ownership model](/concepts/number-port-out-model) — How a number leaves Orbit with PIN protection and concurrency guards. * [Trial & shared-pool number model](/concepts/number-trial-pool-model) — How trial numbers are claimed, capped, and released. * [The outbound billing gate chain: what every send walks, in order](/concepts/billing-gate-chain-model) — The ordered bill gate every outbound send walks before funds move. ## Tenancy, orgs & isolation * [Tenant isolation](/concepts/tenant-isolation) — The per-tenant schema boundary every other model inherits. * [The subaccount organization model](/concepts/subaccount-organization-model) — How parent organizations, subaccounts, and resources compose. * [Org and subaccount model: one vocabulary](/concepts/org-and-subaccount-model) — The organizing hierarchy: API key to organization to tenant schema. * [Tenant posture audit map — planes, ownership, and where the evidence lands](/concepts/tenancy-posture-audit-map) — The three planes a quarterly compliance review samples. * [Team seat quota and invite enforcement](/concepts/team-seat-quota-model) — How seats are counted, enforced, and raised. * [Roles, teams, and permissions](/concepts/roles-teams-permissions) — The ten seat roles, custom roles, and deny-by-default grants. ## Channels & fallback * [Cross-channel fallback: the ordered chain that retries a failed send on the next channel](/concepts/cross-channel-fallback) — Retry a failed send on the next channel in your configured chain. * [The five fallback planes: one map and how to pick one](/concepts/fallback-and-cascade-planes) — A decision map over the five fallback planes and their precedence. * [RCS capability check and SMS fallback: deciding whether a recipient gets rich content](/concepts/rcs-fallback-and-capability) — When RCS delivers richly and when it falls back to SMS. * [Omnichannel fallback compliance matrix — TCPA vs DNC vs registration per channel](/concepts/omnichannel-compliance-matrix) — Weigh dialing windows, registration, and opt-in per channel. * [Channel capability coverage matrix: which channels do what, and which slot into your fallback chain](/concepts/channel-capability-coverage-matrix) — One row per channel: what it does and where it fits your fallback chain. ## AI, agents & knowledge * [AI agent architecture: flows, retrieval, tools, and the run lifecycle end to end](/concepts/ai-agent-architecture) — Flows, retrieval, tools, and presence — the agent stack end to end. * [Agent run lifecycle: queued to completed, and the states in between](/concepts/agent-run-lifecycle) — One agent run from queued to completed, failed, or cancelled. * [The knowledge-base ingestion pipeline: from upload to retrieval-ready](/concepts/knowledge-pipeline) — From upload to embedded, retrieval-ready chunks. * [The no-match miner → KB auto-draft loop: unanswered questions become reviewable articles](/concepts/kb-auto-draft-loop) — Unanswered contact reasons become reviewable knowledge drafts. ## Platform runtime & transport * [Transport architecture](/concepts/transport-architecture) — How real-time audio and video move: SFU plus the softswitch edge. * [Platform runtime map](/concepts/platform-runtime-map) — The deployable services of Orbit and what each one owns. * [How Orbit processes work asynchronously](/concepts/async-processing-model) — The queue and worker backbone behind durable work. * [Scheduler fleet model](/concepts/scheduler-fleet-model) — How background schedulers fan out across tenants safely. * [API request guard pipeline: the ordered guard chain every request walks](/concepts/api-request-guard-pipeline) — The ordered guard chain every API request traverses. * [Request Logs model: Cloud Logging under a deadline-backed read](/concepts/request-logs-model) — Why Request Logs read Cloud Logging instead of Postgres. ## Browse the rest Every concept page not listed above, grouped by the docs navigation subgroup, with the description each page publishes in its own frontmatter. The [full page index](/concepts/overview#full-page-index) on the overview page regenerates this same set, so a page that lands in Concepts lands in this table. ### Concepts overview | Page | What it covers | | --------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Concepts overview](/concepts/overview) | One ordered entry point into the Concepts section — a read-first decision band, the ten subgroup map with scope notes, a 'which message-status page to open' table, a role-to-subgroup index, and a generated page index over every concept page | | [Data model: envelope, identifiers, idempotency, pagination](/concepts/data-model) | The conventions every Orbit endpoint follows: the envelope shape (data, meta.requestid, meta.timestamp), prefixed identifier conventions, the 24-hour idempotency replay window, cursor pagination, ISO-8601 time fields, and webhook event shapes. | | [Live tail streaming model: what the live request-log stream guarantees](/concepts/live-tail-streaming-model) | What the tenant-scoped live request-log tail actually streams, its connect-replay-live frame sequence, entry payload, buffering and drop policy under backpressure, per-tenant isolation and connection limits, and when the tail answers a question versus when request logs, the webhook debug log, or the stats surface does. | | [Operator observability: dashboards, logs, and audit — what to look at when](/concepts/operator-observability-map) | Frame your operator surface end-to-end: when a moment-level answer lives in the delivery log or live tail, when trend questions belong to dashboards and Insights, when a durable record means webhooks or exports, and where alerting hooks in. | | [Public feedback and trust surfaces: idea board, community, help center, sub-processor notices](/concepts/public-feedback-and-trust-surfaces) | Frame your organization's unauthenticated feedback and trust surfaces — the hosted idea board, the peer-to-peer community, the public help-center read, and the sub-processor change subscriptions — and the design invariants that keep unauthenticated access bounded. | | [Sandbox model: the boundary, the synthetic providers, and promotion](/concepts/sandbox-model) | Where the sandbox boundary sits on the request path, how each channel's synthetic provider answers, how sandbox data is isolated, and what carries over — and what does not — when you promote to production. | | [Sandbox, test mode, and the provisioning model](/concepts/provisioning-and-test-mode) | How Orbit separates test traffic from production traffic and from an unprovisioned org: the three ways test mode switches on, what a test send does and does not touch, how to keep sandbox out of production metrics and webhooks, and what the TENANTPROVISIONING 503 actually means. | | [Sync: WebSocket claim, spin-down, and the flush window](/concepts/sync-ws-claim-and-flush-window) | How a Devotel Orbit Sync client moves from an intermittent poll to a live WebSocket subscription — the claim lifecycle (connect, subscribe, spin-up), the order of operations that keeps every subscriber seeing each event exactly once, the grace window the server holds open after a spin-down, and the endpoint contract for claim and release on `/api/v1/ws/sync`. | | [Telegram bot dispatch and demo-account model](/concepts/telegram-bot-model) | How Devotel Orbit dispatches Telegram traffic through either your own BotFather bot or the shared demo bot, how inbound updates and delivery receipts resolve back to your organization, how webhook-vs-polling delivery and media URL semantics differ from SMS, how Telegram participates in sender-resolution, unified termination and cross-channel fallback, and why every send writes a \$0 ledger row on the free channel. | | [The channel test-account model: shared test to BYO](/concepts/channel-test-account-model) | How every interactive channel on Devotel Orbit runs the same tester-to-producer ladder — a shared test account bound to one verified recipient, then your own channel asset — and the two gate classes that decide what a test-account organization can and cannot do. | | [The org-scoped status model: one incident feed, three waypoints](/concepts/org-scoped-status-model) | Frame your organization's status model — one public incident feed with three views over it: the org-scoped incident history in Settings → Platform status, the white-label status URL you hand to customers, and the per-channel SLA report those views reconcile against. | | [The SLA attestation and report backfill model](/concepts/sla-attestation-model) | How monthly SLA truth is derived once and attested — the single read-model rule that keeps the attestation, the Reliability report, and service-credit assessment in agreement, the attestation-only support SLA signal, the YYYY-MM window rules, and how legacy scheduled reports backfill into the canonical store. | | [The stats surface map: dashboard workbench vs the analytics pipeline](/concepts/observability-stats-surface) | Where each dashboard number comes from: the /stats workbench (raw-event, per-widget reads), the /stats/analytics advanced block, and the pre-aggregated /api/v1/analytics pipeline — and which route family answers which question. | | [The Sync real-time shared-state model](/concepts/sync-realtime-state-model) | How Devotel Orbit Sync converges shared state across clients — the four object kinds, the REST-write to WebSocket-broadcast convergence loop, tenant scoping, TTL semantics, and the read/write permission split. | | [UCaaS, CCaaS, and CPaaS](/concepts/ucaas-ccaas-cpaas) | How the three cloud-communication categories differ — the phone system for employees, the contact-center suite, and the programmable API layer — and how Orbit maps to each | ### Messaging & Routing | Page | What it covers | | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Batch-send model — persist-then-attempt per-recipient pipeline](/concepts/batch-send-model) | How POST /messages/batch persists every recipient as a pending row before the send pipeline runs, which limits gate the batch, and what each recipient row can land as — so operator totals reconcile. | | [BYO SMPP carrier lifecycle](/concepts/byo-carrier-lifecycle) | The full lifecycle of a tenant-attached upstream SMS carrier — attach, probe and health, how carrier health feeds LCR scoring and circuit breakers, and what detach means for traffic and your saved candidate order. | | [Canned responses and macros — the reply library model](/concepts/canned-responses-macros-model) | What a canned response is vs a macro, how personal and team scoping decides who can see and run each, how placeholders resolve at send time, and where the reply library sits next to the template lifecycle. | | [Cascade failover policy and one logical message ID across legs](/concepts/message-cascade-groups) | How an org-level default cascade policy arms every send's fallback chain, how a per-send cascade field overrides it, and how messagegroupid binds every hop of a cascade into one readable logical group. | | [DLR and MO gateway pipeline](/concepts/dlr-and-mo-pipeline) | How a carrier delivery receipt (DLR) and an inbound mobile-originated (MO) SMS cross from the SMPP gateway into Orbit: the reconciliation loop that keeps the gateway consistent with your SMPP configuration, and the two observable surfaces — delivery webhooks on one side, bind health in the dashboard on the other. | | [Fallback configuration worked samples: notify waterfall and cascade policy](/concepts/fallback-endpoint-worked-samples) | Copy-pasteable request and response samples for every fallback primitive — the POST /notify waterfall with per-hop and cumulative cost ceilings, the org default cascade policy, the per-send cascade field, and the two read-back endpoints — plus the consent and quiet-hours guardrails every hop re-runs. | | [Fallback on terminal DLR: per-request auto-escalation after delivery fails](/concepts/multi-channel-dlr-fallback) | How a terminal-undelivered delivery receipt on a message that declares `fallbackchannels` triggers a new send on the next channel — opt-in shapes, the idempotency lock, chaining metadata, per-hop billing, and how this layer sits beside the org-level chain. | | [Fax: delivery & inbound-routing model](/concepts/fax-delivery-model) | The fax channel's termination-policy exception, document model, on-success-charge semantics, inbound routing split between config endpoints and delivery, and the delivery-receipt vocabulary — the lifecycle model that ties the Fax channel page and the inbound-fax workflow guide together. | | [Group messaging versus labeling — group flow, thread, claim, and label disambiguated](/concepts/group-messaging-model) | The POST /messages/group envelope end to end — 1–20 recipients, one payload, persist-then-attempt fan-out with per-recipient receipts — and the rules that keep the group flow distinct from the rich-channel thread, the routing claim, and the label. | | [Inbound AI enrichment: detect language + auto-translate](/concepts/inbound-ai-enrichment) | The channel-agnostic enrichment pass that runs on inbound messages — detect the source language, auto-translate to English, and persist detectedlanguage, detectedlocale, and translationen onto message metadata — and the tenant-level gate that controls it. | | [Inbound attachment threat scan](/concepts/inbound-attachment-threat-scan) | How Devotel Orbit byte-scans every inbound email attachment for threat signals before it is archived — the clean/suspicious/malicious verdict bands, the allow/quarantine action each maps to, and how a quarantined part is recorded on the message metadata without ever serving its bytes. | | [Inbound media threat scan and quarantine model](/concepts/inbound-media-threat-scan-model) | How Orbit scans inbound MMS and email attachment BYTES for malware before they reach an agent or the message store — the clean/suspicious/malicious bands, the allow/review/quarantine recommendations, and what a quarantined attachment means for your inbox. | | [Inbound message resolution](/concepts/inbound-message-resolution) | How every inbound SMS (MO) or delivery receipt (DLR) resolves to its owning tenant: the number index, the routed number states, the hourly self-healing reconcile, the per-DID route override, and subaccount sharing. | | [Inbound message routing](/concepts/inbound-message-routing) | How tenant-level inbound (MO) SMS routing rules decide where a received message goes: priority-ordered match on number, sender, keyword, or regex, with webhook, inbox, queue, team, and SMS-menu targets — and what happens when no rule matches. | | [Keyword auto-reply and opt-out: the matching model](/concepts/keyword-rules-model) | How keyword rules dispatch an inbound message: a per-tenant rule set evaluated against every non-consent message body, with four match types, creation-order precedence, and actions that reply, change consent, hand off to an agent, or run a flow. | | [Line type and reachability classification model](/concepts/line-type-and-reachability) | The three classification surfaces Orbit exposes — the free public checker, the billed per-lookup endpoint, and the sender-identity-type resolver — how to read a line-type verdict per channel, what a 'depends' answer means under a BYO-carrier model, and how to wire classification into quiet-hours, RND, and opt-out posture. | | [Message envelope model: the channel\_chain declaration and cost-aware re-sequencing](/concepts/message-envelope-model) | How Devotel Orbit's message envelope declares one recipient, one content bag, and an ordered channelchain on a single send — how the router walks that chain, how costAware re-sequences the declared channels cheapest-first, the per-hop price-resolution contract each hop shares, and how this routing-by-choice differs from the escalation-by-failure cascade surfaces. | | [Message priority and traffic lanes: keep OTP traffic ahead of campaign bursts](/concepts/message-priority-traffic-lanes) | How Orbit splits each account's per-second send budget into a reserved transactional lane and a shed-first marketing lane, how the per-message priority field steers a send into the right lane, and what happens to the reservation during a Redis outage. | | [Messaging data residency](/concepts/messaging-data-residency) | How the messaging-layer residency read surfaces where your SMS, MMS, and chat data is stored and processed, and how it differs from the org-level residency pin and tenant-schema isolation. | | [Messaging services — one named bundle of sending defaults](/concepts/messaging-services-model) | What a messaging service is and when to create one: it binds a default sender pool, per-country pool overrides, a status callback, a default validity period, an inbound webhook, and a per-second throughput cap under one id — and a send that names it inherits those defaults only for fields the request left blank. | | [Messaging windows and off-window sends: Meta DM, WhatsApp, and the no-window channels](/concepts/messaging-window-model) | The one model that decides whether an off-window send is allowed: Meta DM's 24-hour window with RESPONSE/UPDATE/MESSAGETAG types and OTN tokens, WhatsApp's free-form session vs template rule, and why SMS and email have no window at all. | | [MMS composition model](/concepts/mms-composition-model) | What an MMS message is composed of — body plus attachments — how every attachment moves through a three-step media pipeline (SSRF/HTTPS preflight, carrier-compatibility policy, optional re-encode) before dispatch, how the NANP and media-type rejection taxonomy is structured, and where MMS sits in the shared delivery lifecycle as an SMPP-backed channel. | | [Notify cascade cost model: per-hop price bounds and the cumulative waterfall cap](/concepts/notify-cascade-cost-model) | The two independent cost bounds a notify waterfall honors: a per-step maxprice that rejects a pricey hop before billing, and a cumulative maxtotalprice that trims the whole escalation tail against a declared budget. | | [Number Lookup model — which data package answers which question](/concepts/number-lookup-model) | The read-only number-intelligence operation: the five dip classes (HLR, ported network, SIM swap, reassigned number, CNAM) and the derived risk packages, what each field in the response means, how the 10-minute result cache trades freshness against cost, and how per-dip charges and the daily cap envelope carry into your wallet. | | [Outbound route quality and circuit breakers](/concepts/outbound-route-quality-and-circuit-breakers) | How per-operator route health is measured for SMS/MMS delivery — the signals behind the health score, the thresholds and loopback probes you configure, and the circuit-breaker control loop that auto-suspends a degrading carrier route and fails traffic over to an alternate channel. | | [Per-contact channel optimization: engagement-ranked dispatch](/concepts/channel-optimization-model) | How a campaign can shift each recipient onto their best-engagement channel at dispatch time — the candidate-set rules, the opt-in contract on campaign variables, credit-cap interaction, and the safe-channel envelope that bounds what dispatch may switch to. | | [Proxy session (number masking) model](/concepts/proxy-session-model) | How a masked proxy session works: two participants and one shared pool number, a TTL-bounded lifecycle with an explicit close, the forwarding resolution that keeps both real numbers private, and how sessions differ from short-links and inbound routing rules. | | [Push delivery versus inbox pull: choosing a delivery surface](/concepts/push-delivery-vs-inbox-pull) | The receiver-side choice every inbound message forces — when to claim a live push slot on the Sync WebSocket and flush the envelope now, when to leave the envelope in the inbox for pull, and when to push to a webhook instead, with the claim lease, flush window, and queue-waterline semantics that govern each choice. | | [Route preview — the pre-send what-if estimator](/concepts/route-preview-model) | The model behind POST /messages/route-preview: a read-only, no-side-effects estimator that answers 'what would a smart send do with these inputs' — which channel, why, what falls back, and what it costs — before a single message exists. How it differs from least-cost routing and the Deliverability Lab. | | [Sender identity classification model](/concepts/sender-identity-classification-model) | How Orbit classifies each sender identity you use — long code, toll-free, short code, or alphanumeric sender ID — what the classification changes on the compliance-evaluated send path (quiet hours, RND, opt-out posture), and how to read the type from the Messaging Compliance Health panel. | | [SMPP edge model](/concepts/smpp-edge-model) | How Orbit's SMPP edge works underneath your bind: the Jasmin relay it fronts, the per-credential Jasmin user model, and the 30-second reconciliation loop that keeps the relay consistent with your configuration — including DLR delivery modes and bring-your-own carrier routing. | | [The in-app channel model: pull delivery, two render classes, segment targeting, and engagement receipts](/concepts/in-app-channel-model) | How Orbit's owned, zero-carrier-cost in-app channel works — why delivery is a pull rendered by your web or React Native SDK rather than a push through a gateway, the persistent content card vs transient in-app message render classes, segment-scoped eligibility, and why engagement events replace carrier receipts. | | [The MT termination model: how outbound calls and messages leave Orbit](/concepts/mt-termination-model) | The one anchor for outbound termination on Orbit — the two travel modes (real-time session vs scheduled one-way dispatch), the ordered pre-dispatch gate chain, the queue-to-worker dispatch mechanics, the Devotel-softswitch and BYO-carrier exit planes, the status-feedback loop back to your webhooks, and the cost surfaces — closed with a worked SMS send and a worked voice call. | | [The per-message route-trace timeline](/concepts/message-route-trace) | How a route trace assembles one ordered timeline per message — accepted through routing, provider submission, the terminal receipt, and every webhook fan-out hop — from rows the platform already persists, and how to read one for the delivered-but-never-received symptom. | | [The push channel model: device registry, fan-out, delivery, and VoIP call push](/concepts/push-channel-model) | How a push notification travels from your API call to a device — the device-token registry across APNs, FCM, Huawei Push Kit and Web Push, the targeting and capability flags on each send, per-device delivery results, scheduled sends, token hygiene, and the separate VoIP registry that rings agents on inbound calls. | | [The routing-claim election lifecycle — destination side of a routed conversation](/concepts/routing-claim-election-model) | How a routed conversation is claimed once and owned once: the four-agent cast (presence, eligibility, capacity ledger, election primitive), the three claim families, ring strategies compared, why a label is never routing truth, and where group fan-out sits on the destination side. | | [The three success statuses: delivered vs submitted\_no\_receipt vs sent](/concepts/submitted-vs-delivered-three-successes) | How to read the three outbound statuses that can all mean 'the send succeeded so far': terminal delivered (carrier/read confirmed), the wire-intermediate submittednoreceipt sentinel (promoted by the no-DLR scheduler past the per-channel grace window), and sent (wire-acknowledged, in flight). Includes the promotion rules, the nodlrchannel marker, and the failure modes you must not confuse. | | [Toll-Free Verification and RespOrg lifecycle](/concepts/toll-free-verification-resporg) | How Orbit runs US toll-free numbers end-to-end — the Toll-Free Verification (TFV) lifecycle from use-case declaration to carrier decision, the staged 'pending platform submission' state, the RespOrg change flow for toll-free voice numbers, and how TFV state plugs into the daily-cap and warming kernels. | | [Unified termination routing](/concepts/unified-termination-routing) | One billed egress for every inbound submit: how termination rules decide between a deliver hop and absorbing a message onto another channel, the shadow-to-enforce lifecycle, and where LCR and fallback planes slot in. | | [What omnichannel means on Orbit](/concepts/what-is-omnichannel) | The definitional concept page: one account, one sender identity, one timeline across SMS, voice, email, WhatsApp, RCS, wallet, and USSD — how it differs from multichannel, and where the unified routing, compliance, and read models live. | ### Voice & Telephony | Page | What it covers | | --------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Agent distress alert model: the panic button, its fail-open sequence, and the audit chain](/concepts/agent-distress-alert-model) | What the one-tap softphone panic button does — persist a supervisor alert first, force-call recording regardless of queue policy, then page the supervisor over SSE — and why the order matters for compliance. | | [ANS Trust Card and trust registry](/concepts/ans-trust-card-registry) | How verifiable caller and agent identity anchors work: what the Agent Name Service (ANS) Trust Card publishes, where Orbit's own card lives, how the public tenant trust registry lookup answers 'is this caller really who it presents as', and how to raise your organization's attestation posture. | | [Avatar bot dispatch queue](/concepts/avatar-bot-dispatch-queue) | How persona-to-room dispatches actually run — a dedicated job queue with deterministic job ids, one token-mint seam for humans and bots, roster verification, and deliberate-refusal handling | | [Bulk Reserve model: the reservation state machine](/concepts/number-bulk-reservation-model) | How a bulk reservation thinks — the draft → held → finalized/cancelled state machine, the 15-minute no-charge hold, both-feeds cheapest-pick scan semantics, the US area-code tile map input, and exactly when the wallet preflight fires. | | [Call park and the lobby: the slot aliasing model](/concepts/voice-call-park-lobby) | What parked, held, and transferred calls mean on the floor, how the nine-slot aliasing model names every parked call, which consoles surface the lobby, how park composes with conferences and hand-offs, and the failure modes — recall, expiry, and supervised takeover. | | [Call recording pipeline: from call end to a playable recording](/concepts/call-recording-pipeline) | How a SIPREC capture becomes a playable artifact on the call record — the recorder-to-upload-to-callback lifecycle, the pending/failed states you may observe, how uploads are authenticated, and where the playback URL and exports pick the recording up. | | [Connectivity SIM model: the eSIM / IoT data-line state machine](/concepts/connectivity-sim-model) | The four states a programmable-wireless (eSIM / IoT M2M) SIM moves through — ordered, active, suspended, terminated — who advances each transition, which are reversible, how fleets and quotas behave, and how complementary line types (private gateway, prefix announcement) fit. | | [Dialer pacing: claim modes, enrollment ordering, best-time-to-dial, and the abandon ceiling](/concepts/dialer-pacing-model) | How the outbound dialer sequences a contact list — the four claim modes, the nextattemptat ordering that both claim paths share, best-time-to-dial enrollment, the FCC abandon-rate ceiling control, and how dispositions write back into the pacing engine. | | [Extension identity: one user endpoint spanning voice, SMS, and appearance](/concepts/extension-identity-model) | What one extension object actually spans — a SIP identity bound to a DID, registered by many devices, named by fromextension on outbound sends, owning a per-extension SMS thread, mirrored onto shared lines, and checked against agent presence. | | [Hosted messaging: SMS enablement without porting](/concepts/hosted-messaging-model) | Hosted messaging (text-enable) is the fourth attachment model — it makes an existing landline, toll-free, or mobile number SMS-capable while its voice service and carrier-of-record stay unchanged. Covers the order lifecycle, inbound and outbound SMS behavior, when to choose it over a full port, and the failure modes. | | [Inbound voice routing](/concepts/inbound-voice-routing) | How an inbound PSTN call resolves from the dialed number to its owning organization and onward to a destination — per-number routes, DNIS pattern rules, the org default, queue delivery, ring groups, and the fail-safe edges. | | [Inbound voice routing: why the tables are shared](/concepts/inbound-voice-routing-shared-catalog) | The shared-catalog design decision behind inbound voice routing — why `dnisroutes` and `inboundroutes` live outside tenant schemas, and the row-level organization discipline that enforces tenant safety anyway. | | [Jambonz softswitch model](/concepts/jambonz-softswitch) | How Orbit's voice softswitch surface (Jambonz) routes a call — SIP trunks, softphone registration, feature codes, inbound and outbound path selection, and the tenant-owned safety controls | | [Media planes](/concepts/media-planes) | When a call or video room rides the Orbit Media SFU versus the Jambonz SBC + RTPengine carrier plane — and when one call spans both | | [Multi-region media routing](/concepts/media-region-routing) | How Orbit's media fabric is split across EU and US regions — the per-region SFU, TURN fleet, and room-state store; how a region is picked at room creation; and why cross-region failover is opt-in by design | | [Number reuse, aging, and post-release posture](/concepts/number-reuse-and-aging) | What happens to a number after you release it — the parking grace window, the region-aware aging table, the durable number-release retry queue, what resets and what persists across reassignment, and the tenant-visible guarantees that keep a released scam number from landing on an innocent tenant. | | [Port-out PIN protection lifecycle](/concepts/port-out-pin-protection-model) | The tenant-owned port-out PIN: how to set, rotate, and remove it per number, why verification is opt-in, how it interacts with pending port orders, and what a mismatch does. | | [Recording lifecycle: capture to retention purge, and the states in between](/concepts/recording-lifecycle) | How a recording moves from capture start through finalization to availability, which plane captured it (SIPREC on the carrier plane vs SFU egress on Orbit Media), why QC verdicts are a parallel pipeline rather than a recording state, and why the retention pre-delete event exists — before you build a recording archive or QC triage integration. | | [SIP credential lifecycle](/concepts/sip-credential-lifecycle) | How a SIP credential is created, registered, capped, rotated, and revoked — the digest-verification handshake at the Jambonz softswitch edge, the per-credential registration and concurrency caps, and what revocation does to a live device. | | [SIP digest verification model](/concepts/sip-digest-verification-model) | Three roles of SIP authentication — HA1 verification at the Jambonz edge, an optional local re-check for cap counting, and the softswitch as the authority on registration — and why the local check deliberately fails open on digests it cannot recompute. | | [The ACD queue model: presence, skills, dispatch, and overflow](/concepts/acd-queue-model) | How an inbound call or digital conversation moves through an ACD queue — what a queue entry is, the five-state agent presence machine, step-by-step FIFO dispatch, SLA timers and overflow actions, and the monitoring surfaces to read queue state. | | [The PASSporT token model](/concepts/passport-token-model) | What a PASSporT is, what the signed token actually carries, how the attestation level inside it is resolved, and how BYON delegate certificates raise the claim from C to B — the transport-object companion to the STIR/SHAKEN attestation model. | | [The queue callback model: virtual hold, dispatch, and outcomes](/concepts/queue-callbacks-model) | How a queue callback works in Orbit — the caller opts out of holding and keeps a virtual place, the queue returns a callback when the position matures, and every outcome code lands in one auditable list tied to the queue's SLA reporting. | | [The STIR/SHAKEN attestation model](/concepts/stir-shaken-attestation-model) | The end-to-end model behind caller-ID trust: what attestation levels A/B/C assert, why a BYON caller might get a lower level, how PASSporT signing actually travels, where Orbit surfaces the levels, and what to do when a downgrade is flagged. | | [The video room model](/concepts/video-room-model) | How Orbit structures video rooms — scheduled versus ad-hoc creation, the created-to-closed lifecycle, join-token semantics, recording and broadcast egress, the analytics split, live interpretation and captions, and QA scoring | | [The voice supervisor plane: monitor, whisper, takeover, and announce](/concepts/voice-supervisor-plane-model) | The four live-call intervention verbs a supervisor can run — silent monitor, agent-only whisper, full takeover, and queue-wide announce — plus the omnichannel queue view, auto-escalation rules, the whisper-text backchannel, the supervisor transcript stream, and the role/queue-scope permissions that gate each surface. | | [The voice-broadcast model — one-to-many voice calls over the campaigns backbone](/concepts/voice-broadcast-model) | Where broadcast sits next to dialer and multi-step campaigns — the wizard creates a standard voice-channel campaign, the three audio sources it can carry, the TCPA / quiet-hours / approvals gating chain, and how settled cost and ROAS attribution land afterward. | | [Transcript-verified video-only gate](/concepts/video-transcript-verified-gate) | How Orbit gates video publishing in audio-only rooms — the ceiling-widening rule, the transcript-verified predicate, and why a verified gate can restore camera and screen-share but never convert a subscriber into a publisher. | | [Voice call lifecycle: initiated to completed, and the states in between](/concepts/voice-call-lifecycle) | How a call moves from your API request or an inbound ring through ringing, answered, and completed (or a failure outcome), who advances each transition, how the mid-call events fit in, and the status-vs-event distinction you need before you build reporting against call data. | | [Voice gateway: the realtime AI-voice media edge](/concepts/voice-gateway-realtime-edge) | The voice-gateway service behind every AI voice turn — the STT/TTS provider plug model, boot-time failover chains, per-language provider routing, session pre-warm, barge-in semantics, and the outbound-call origination bridge. | ### Delivery & Schedulers | Page | What it covers | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Deliverability Lab: pre-send content-risk lint and per-carrier delivery prediction](/concepts/deliverability-lab-pre-send-scoring) | Where the Deliverability Lab runs in the campaign launch path, the two signals it combines — a channel-aware content filtering-risk lint and a per-carrier delivery projection built from your own DLR history — which warnings block versus advise, and what the lab cannot predict. | | [Email delivery lifecycle: bounces, complaints, and the retry queue](/concepts/email-delivery-lifecycle) | How email moves from provider acceptance to a mailbox outcome — the queued/sent/delivered/bounced/complained status map, the Resend webhook events that drive it, the durable retry queue that recovers terminal send failures, and how to read submittednoreceipt on a channel with no DLR. | | [Email quiet hours vs the marketing/lifecycle classification: where timezone restraint stops and consent starts](/concepts/email-quiet-hours-and-marketing-classification) | Why email has no federally mandated send window — quiet hours are a tenant opt-in here — how a classification of marketing vs lifecycle decides which rules apply to the recipient, and how the preference center versus suppression semantics bind the consent record. | | [Messaging deliverability alerting: thresholds, evaluation, and notification fan-out](/concepts/messaging-deliverability-alerting) | How Orbit pages you when a messaging channel's delivery rate drops or its failure/bounce rate spikes — the metric definitions, the rule model, the evaluation endpoints, and what a breach response carries. | | [Omnichannel capacity and reservation model](/concepts/omnichannel-capacity-reservation) | How agent capacity is measured and enforced across voice, chat, and ticket channels — the read-only blended load gauge behind the supervisor wallboard, and the atomic reserve/release slot hold that prevents an agent from being double-booked by two channels at once. | | [On-call and escalation policy model: rotation, timeline, and incident state](/concepts/oncall-escalation-model) | How rotations resolve who is on call, how a policy flattens into an ordered page timeline, how incidents advance open to resolved, and why every answer is pure compute over state you own. | | [Operational sentinels: the status values that aren't deliveries](/concepts/operational-sentinels) | How Orbit marks simulated sends, blocked recipients, deleted rows, unrecognized provider callbacks, and complaints — the settled-but-non-outcome statuses that sit beside the delivery lifecycle and that analytics must not count as successes or failures. | | [Outbound send gating: the tenant-owned controls that decide whether a message dispatches](/concepts/send-gating-and-quiet-hours) | How the wallet pause, opt-out and suppression lists, quiet hours, duplicate-content suppression, frequency caps, and throughput caps compose into one admission model — in the order a send actually walks them — and what each blocked outcome looks like to your integration. | | [Queued to sent: the outbound status primer](/concepts/queued-to-sent-the-four-owner-map) | The self-contained primer for the outbound-message status arc — the canonical vocabulary stated inline, the four actors that move rows, the wire-vs-terminal distinction with an exit-edge table, the no-DLR channel semantics behind submittednoreceipt, and a worked walk from POST to the sentinel. Read this page and the five thinner pages become optional. | | [Recipient timezone resolution for quiet hours](/concepts/recipient-timezone-resolution) | One map for how Orbit picks the timezone your quiet-hours gate evaluates in — the NANP area-code map, the country-prefix map, your IANA override, the org default timezone, and the unknown-timezone policy that decides whether an unresolved recipient fails open or fails closed. | | [The cross-campaign send allocator: how concurrent campaigns share one budget](/concepts/campaign-allocator-model) | Why concurrent campaigns compete for the same frequency-cap budget, how the water-filling allocator spreads their volume across the eligible slots of a spread window inside a global hourly cap and quiet hours, and how priority and sender-reputation pace decide who defers to whom. | | [The scheduled-send lifecycle: from a future send\_at to dispatch](/concepts/send-at-scheduled-sends) | How a message carrying a future send time parks in the `scheduled` state, which three paths let it leave that state, how the platform drain picks it up at fire time, and how quiet hours and timezones interact with the drain. | | [The scheduled-sending model: how queue-park, quiet-hours gating, and fire-time form one contract](/concepts/scheduled-sending-model) | The one model behind every time-managed outbound send — a future send time parks in the `scheduled` state, dispatch-time gates re-evaluate it at fire time, quiet-hours re-parks rather than quietly sends, and billing and rate limits only ever see the fired send. Read this before any of the four pages that each cover one slice of the contract. | ### Identity, Tenancy & Access | Page | What it covers | | -------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Account security model](/concepts/account-security-model) | The hardening layer behind the dashboard — TOTP 2FA, step-up re-authentication challenges, backup codes, an org-wide per-role 2FA policy, and the password and audit surfaces that complete it. | | [API key lifecycle and rotation: grace versus immediate](/concepts/api-key-rotation-lifecycle) | How an API key moves from active to retired — the two rotation modes, the dual-valid grace window, the oldKeyExpiresAt cutoff rule, and when to rotate versus revoke. | | [Authentication and session model](/concepts/authentication-model) | The three Orbit credential classes — dv-prefixed API keys, dashboard session tokens, and the SCIM provisioning token — and the resolution rule that decides which one a request carries. | | [Contact merge policy: the per-field survivorship decision tree](/concepts/contact-merge-policy) | How contact dedupe picks a survivor, how the per-field survivorship policy settles precedence between externalid, email, phone, and the other scalar fields, and which safety rails (undo window, audit row, webhook) surround every merge. | | [Custom domains and managed SSL](/concepts/custom-domains-and-ssl) | How white-label domains work end to end — CNAME verification, automatic certificate issuance, the status lifecycle, and the organization API fields that report provisioning state. | | [Custom fields: the definition model and the dependency-scan lifecycle](/concepts/custom-fields-model) | What a custom-field definition is, how contact values live in two JSONB columns, who can change the schema, what the pre-delete dependency scan covers, and how a force-delete stays safe. | | [Destructive-operation re-auth challenge](/concepts/re-auth-challenge-model) | How Orbit proves a human is at the keyboard before an irreversible operation — the mint → carry → consume challenge flow, its single-use and expiry semantics, the two step-up namespaces, the binding key that pins a challenge to one target, and which endpoints sit behind it. | | [Encryption at rest: the platform envelope, and how BYOK fits on top](/concepts/encryption-at-rest-model) | How Orbit encrypts tenant data at rest — the platform-managed envelope that is always on, the envelope-encryption design (a data key wrapped by a key-encryption key) that BYOK builds on, the fail-closed seam, and what revoking or rotating a customer key actually guarantees. | | [Identity federation: SAML and SCIM](/concepts/identity-federation-saml-scim) | The conceptual model of Orbit identity federation — what SAML and SCIM each control, the provisioning lifecycle from create to deprovision, attribute and group mapping, the first-login sequence, and the tenant-owned posture both protocols share. | | [Onboarding wizard lifecycle](/concepts/onboarding-wizard-lifecycle) | The getting-started checklist model — nine server-derived steps, per-step probe semantics with partial success, per-operator skip and mark-complete overrides, KYC-gated trial-credit visibility, and how it differs from the go-live verification timeline. | | [Operator plane vs tenant plane — admin APIs and their audit model](/concepts/admin-tenant-plane-model) | The two-plane split between everything your API key can reach (tenant plane) and the platform's operator surfaces (operator plane): what the operator plane ships, how operator authentication is separated from your tenant credentials, what gets audited, and how you verify a platform-side change. | | [Redaction vault: a compliance-safe copy of every call transcript, with an audit of what was removed](/concepts/redaction-vault) | How the write-time redaction vault produces a redacted copy of your finalized call transcript — its artifact shape on the call record's metadata, the audit of removed categories, the webhook that signals it is ready, and how to scope it by category. Read this before you build a PHI/PCI-safe QA export. | | [Signed-token public share plane: sharing with recipients who have no account](/concepts/signed-token-public-share-plane) | How Orbit's public share surfaces — conversation transcripts, recordings, callback status pages, analytics dashboard embeds, and queue-appointment links — carry their own authentication inside an HMAC-signed token with optional password and email-domain gates, why a recipient cannot cross tenants by editing the URL, and what to tell your security team when they ask whether that link is safe. | | [Synthetic-media provenance](/concepts/synthetic-media-provenance) | How Orbit marks AI-generated voice and video output with a tamper-evident content credential: who mints it, what it binds to, where it travels, and how to verify it. | | [Tenant provisioning lifecycle](/concepts/tenant-provisioning-lifecycle) | How an organization comes into being on Orbit: from organization row through a schema-ready tenant, the fast-core-path split that shrinks the 503 window, and the recovery paths a stuck tenant takes. | | [The branding and theming console model](/concepts/branding-and-theming-model) | How white-label branding works in Orbit — the three read planes (dashboard identity, widget and public surfaces, domain-affirmed page identity), the field catalog, org vs subaccount precedence and inheritance, the custom-domain CNAME hookup, safe defaults, and what branding deliberately does not cover. | | [The composite pre-send risk verdict: four detectors, one score](/concepts/risk-verdict-model) | How the SMS-pumping, URL-reputation, Verify Fraud Guard, and Voice Biometrics detectors fold into one 0-100 pre-send verdict — which score wins, how bands map to advisory actions, and why the verdict advises but never enforces. | ### Billing & Wallet | Page | What it covers | | ------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [All-in pricing: the base rate plus the surcharge schedule](/concepts/pricing-all-in-surcharges) | How Devotel Orbit's all-in estimate stacks the itemized surcharge menu (US A2P 10DLC registration, call recording, transcription, premium support) on top of the resolved base rate — the surcharge codes, the per-channel schedule, the include filter, and how per-message, per-minute, and monthly-flat add-ons relate to the rate-resolution precedence. | | [Anomaly insights: detector shapes, baselines, and the alert handoff](/concepts/anomaly-insights-model) | The Insights → Anomalies ledger over the platform's fraud-review records — the detector families behind each entry (spend velocity, destination, SIM-swap, voice deepfake, API-key geo), baseline and cold-start semantics, the breach-to-alert handoff, and why anomaly insights flag but never gate. | | [Channel cost rollup vs the billing ledger model](/concepts/cost-channel-rollup-model) | Why Insights → Costs by-channel totals and Billing → Usage records / cost-center chargeback can legitimately disagree — the analytics rollup is an aggregate over priced sends, the ledger is the row-level debit stream, and reconciliation is a per-period, per-channel, per-currency join, not a row match. | | [Committed-use drawdown: the enterprise monthly commit meter](/concepts/committed-use-drawdown-model) | What a committed-use contract is, where the ops-side commitment lives, how to read the drawdown meter (GET /billing/commitment), the run-rate projection behind its true-up figures, and why the meter degrades to a hidden panel instead of an error. | | [LLM spend attribution: feature × model × conversation, and the reconciliation behind it](/concepts/llm-spend-cost-attribution-model) | The money-attribution model behind the LLM-spend and conversation P\&L surfaces — the three attribution axes (feature, model, conversation), the public-scope cost ledger the dashboards read, the daily Anthropic reconciliation workers that keep the ledger honest, and how conversation P\&L composes spend, telephony, and revenue into one cost-to-serve view. | | [MCC/MNC override model — how per-operator overrides layer onto rate resolution](/concepts/mccmnc-override-model) | The per-(organization, operator) rate override record — one network bound to one fixed price, applied verbatim ahead of every markup rule — which send paths honor it, how to read override-versus-default pricing for a destination, the guarantees and limits, and when a change takes effect. | | [Reseller margin and the tax pipeline: marking up a rated amount, correctly ordered](/concepts/reseller-margin-and-tax-pipeline) | What a reseller margin is — a per-subaccount percentage applied to the rated amount before tax — how it differs from a rate markup, why it lands on the ledger descriptors rather than the wallet, and how the read-only preview endpoints stay consistent across the rollup, the margin roll-up, and the tax/exemption branch. | | [Spend alerts, burn rate, and the velocity-anomaly model](/concepts/spend-anomaly-and-alert-model) | The three spend-protection instruments side by side — tenant-configured threshold alerts, the burn-rate projection, and automatic velocity-anomaly detection — plus the anomaly ledger, the self-expiring mitigation throttle, and the on-call escalation bridge. | | [The outbound pause gate and the free-channel exemption](/concepts/outbound-pause-and-free-channel-exemption) | Two classes of outbound holds — balance-driven pauses vs account-lifecycle holds — and why a balance-driven pause bypasses \$0-price channels like WhatsApp while an account-lifecycle hold blocks every channel. | | [Usage records: the per-record billing feed](/concepts/usage-records-model) | The row-level usage feed behind the wallet ledger — one record per sent message and per completed call, with the billed units and price each debit was computed from. What the feed is, how it differs from wallet transactions, and how to reconcile it. | | [Volume-tier pricing auto-resolution: graduated rates that apply themselves](/concepts/volume-tier-resolution-model) | How Devotel Orbit's volume tiers turn a monthly usage counter into a lower per-unit price at debit time — the tier ladder, the org-override versus platform-default precedence, the admin endpoint surface, the money-free preview, and the audit trail every tier write leaves. | | [What-if pricing model: rate preview over your real usage lanes](/concepts/whatif-pricing-preview-model) | The mental model behind the what-if pricing simulator — how your recorded usage collapses into billing lanes, how a candidate rate card re-prices them, what the lane cap does with the overflow, and where the preview ends against live rate resolution, the margin/payout previews, and the LCR route quote. | ### CDP & Intelligence | Page | What it covers | | --------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Ads attribution and lead ingestion](/concepts/ads-attribution-lead-ingestion) | How Orbit's Meta Ads surface ties ad clicks and lead forms to contacts, conversations, and revenue: the click-to-WhatsApp attribution funnel, lead-gen ingestion, and where the resulting events surface. | | [Analytics pipeline: from raw events to an aggregate read surface](/concepts/analytics-pipeline) | How Orbit computes the message, voice, and cost aggregates behind the Insights pages and the Analytics API — background roll-ups over per-tenant schemas, executed against the read replica, behind one scope and one rate limit. | | [Ask-your-data copilot: how a question becomes a governed answer](/concepts/ask-your-data-copilot-model) | The model behind the natural-language analytics copilot — the Ask your data panel on Insights → Analytics and POST /copilot/ask — how a plain-English question parses to a metric and window, why every answer resolves to a governed dashboard-widget catalog entry, and why the copilot can never compute numbers that disagree with the KPI cards beside it. | | [Automation opportunities: turning conversation P\&L into agentable work](/concepts/automation-opportunities-model) | How the Automation opportunities surface reads your conversation cost picture and ranks the contact reasons most worth handing to agents — what flips a family into an opportunity, what a recommendation row carries, and how a scaffold click starts agent or flow authoring without anything launching itself. | | [B2B accounts: golden records and hierarchy](/concepts/cdp-accounts) | What a B2B account entity is in Orbit: the explicit groupid key, the golden record built by recency survivorship, member contacts, the parent/child hierarchy, access roles, and how accounts relate to Account Scores and segmentation. | | [CDP clean rooms: shared analytics without data egress](/concepts/cdp-clean-room-model) | How Orbit's partner data clean room measures the shared-audience overlap between your first-party audience and a partner's without either side exposing customer rows — hashing contract, k-anonymity suppression, dashboard walkthrough, and the operator workflow end to end. | | [CDP retention windows: per-data-class TTL governance](/concepts/retention-policy-governance) | Configure how long Orbit retains each CDP data class — raw track events, destination delivery log, and tracking-plan violations — with per-event overrides on the raw stream, guard rails burned into product, and full rollback to platform defaults. | | [Co-browse session model: consent postures and the privacy-masking contract](/concepts/cobrowse-session-model) | How a co-browse session's consent ceiling, capture-time redaction policy, and server-side control guard fit together — and why they share one masking posture with session replay. Read this before you wire the widget, join an agent, or relax masking. | | [Conversation Intelligence](/concepts/conversation-intelligence) | How Orbit scores your conversations: sentiment, topics, quality, and resolution signals computed over agent conversations, plus the tenant-defined operators that extract custom values per thread — what is computed, where the data comes from, how long it is kept, and how to query it. | | [Conversations: the omnichannel thread model](/concepts/conversations) | How Orbit models a conversation: one thread id that spans channels, the conv id surviving channel switches via resume-channel, ownership (assignees/queues/teams) attaching to the conversation, AI-agent session continuity, channel- vs conversation-scoped state, and lifecycle statuses (open/pending/active/snoozed/closed/archived/resolved). | | [CRM integration model: sync directions, object mapping, and verification](/concepts/crm-integration-model) | The architecture behind Orbit's HubSpot and Salesforce integrations — inbound polling plus webhooks, outbound writeback with retry, object and property mapping, per-provider signature verification, and where each failure mode lands. | | [Customer-360 snapshot aggregation model: parallel fan-out, error isolation, and caching](/concepts/customer-360-snapshot-model) | The architecture behind the Customer-360 snapshot — one GET call that replaces a dozen round-trips, every source fetched in parallel with its own 3-second budget, per-source failure isolated to a null or empty sentinel, and a 30-second tenant-scoped cache. | | [Global search fan-out](/concepts/global-search-fan-out) | The server-side fan-out behind the dashboard's Cmd-K global search: one request runs the query against every product pillar's primary find-by-name/phone/email/label index, merges the results under a single ranking model, and degrades gracefully when any one pillar fails. | | [How CDP segments recompute: real-time evaluation, re-enrichment, and staleness](/concepts/cdp-segment-recompute-model) | The segment lifecycle after an event lands: real-time membership re-evaluation on the event stream, scheduled re-enrichment of profile traits, streaming delivery to destinations, and the staleness guarantees each downstream surface actually holds. | | [Identity graph and device graph](/concepts/cdp-identity-graph-and-device-graph) | The two CDP graph views: a by-user identity graph that shows the identifiers stitched into a resolved profile with merge provenance, and a by-anonymous device graph that surfaces shared device/cookie signals across pre-identify sessions. Plus the identity-rules editor both views depend on. | | [Identity resolution and merge semantics](/concepts/cdp-identity-resolution) | How an incoming CDP event resolves to one contact: identity keys and normalization, deterministic rules versus the probabilistic review band, merge survivorship and provenance, downstream effects on segments and predictive routing, and where duplicates surface. | | [Import and migration lifecycle: connect → preview → run → reconcile](/concepts/imports-migration-model) | How the one-click migration importer works end to end: the five-step wizard, the sources and entity kinds it can pull, the import-job state machine, dry-run previews with a conflict-and-ETA model, encrypted-at-rest credentials, idempotent conflict handling, and the cancel and rollback paths. | | [Interactions CSV export: the bulk-pull contract and its RBAC split](/concepts/interactions-export-model) | How the Interactions CSV export works as a synchronous bulk pull: the deliberately harder role gate than the search list, the owner/admin/developer + contacts:read matrix, the 20,000-row cap, the composite (lastactivity, id) cursor the export shares with the list, and the data-handling rules for the file you download. | | [Interactions: the unified cross-channel read model](/concepts/interactions-unified-model) | How Orbit's Interactions surface models one recency-ordered list over every messaging conversation and every voice call: the UNION of two previously separate surfaces, the composite (updatedAt, id) keyset cursor, the asymmetric search-vs-export permission gates, and where this page's model hands off to the guide and the API reference. | | [Next-best-action decisioning](/concepts/decisioning) | How the multi-armed bandit picks the next-best message variant, channel, and send-time for one profile, how to read the scored breakdown in the Decisioning tester, how it works alongside campaigns and A/B testing, and when it is not the right tool. | | [Next-best-product recommendations](/concepts/recommendations) | How affinity ranking scores a candidate catalog against a profile's recent purchase and browse signals, how to read the per-factor breakdown in the Recommendations tester, when to use it, and where it stops. | | [Per-tenant request metrics: how the Developer API analytics feed works](/concepts/request-metrics-and-analytics-pipeline) | How a write-side onResponse hook buffers per-request telemetry rows into Redis, a worker drains them into a partitioned metrics table, and the Developer API analytics console reads back aggregates — and why page-view traffic, self-observation, and known-Plumbing paths are deliberately left out. | | [Predictive activation schedules: cadence-driven audience refresh](/concepts/predictive-activation-schedule) | How a saved per-model schedule re-materializes a predictive model's ranked population into fresh segments on a cadence — cadence semantics, cold-start behavior, quiet-hours interaction, and when scheduled activation is the wrong tool. | | [Request-metrics thin thresholds: windows, gates, and aggregate predicates](/concepts/request-metrics-and-analytics-pipeline-thin-thresholds) | Which bounds and thresholds decide what the API request-metrics pipeline records and what the analytics aggregates actually measure — the window filter chain, the feature-flag gate, the 429/rejection exclusion in latency percentiles, and how an excluded class drifts the results band. | | [Session replay and search analytics](/concepts/session-search-analytics) | Two distinct capabilities with similar names: session replay records inbound visitor sessions (route-to-replay targets) and search analytics records your team's in-app searches per surface, exposing top queries, zero-result trends, and click-through to drive agent and routing tuning. | | [Session replay model: recording lifecycle, two-tier storage, and playback](/concepts/session-replay) | How a session replay recording moves from capture to object storage to playback — the lifecycle state machine, the inline head plus durable chunk storage split, the failure and purge semantics, and the capture-time privacy boundary. Read this before you rely on the API or tune masking. | | [The carbon emissions and ESG footprint model](/concepts/carbon-emissions-model) | How Devotel Orbit turns outbound usage into a per-channel CO2e estimate — the canonical channel factor table with per-factor provenance, the SMS segment-basis decision, the consolidated factor version stamp, and the deterministic CSV envelope. | | [The CDP event model](/concepts/cdp-event-model) | What a CDP event is in Orbit: the append-only event stream per tenant, how events bind to contacts, how tracking plans and event schemas govern the stream, sessionization, and where events land downstream. | | [The contact scoring pipeline: daily cadence, batch execution, and the auditable scorer](/concepts/cdp-scoring-pipeline) | How Orbit scores every contact once a day: what the four predictive sub-scores measure and which signals feed them, why a daily cadence beats real-time-per-event scoring, how serial-per-tenant batching keeps the pass predictable, the auditable scoring algorithm, the on-demand pass for freshly imported contacts, and where scores surface downstream. | | [The event-ledger projection model](/concepts/event-ledger-projection-model) | The shared architecture behind wallet passes, incentives, and loyalty: lifecycle state kept as append-only events in the tenant CDP event store, with the current state folded from that stream on every read — no per-surface tables, nothing to sync. | | [The insights rollup model: read-time derivations over existing events](/concepts/insights-rollup-model) | What the Insights page family actually is — read-time rollup queries over the event, cost, and call stores you already own, with no new tables and no write-path changes; which surfaces read public-scope versus tenant-scope data; and how to reconcile insights numbers against the billing ledger. | | [The media asset store](/concepts/cdn-assets-model) | How Orbit's tenant-scoped file surface works end to end — the upload envelope and size limits, the content-type gates, how assets bind into templates and branding with time-boxed signed URLs, and the audit trail on every write and delete. | | [The personalization slots model: slot scoping, variant resolution, and lift semantics](/concepts/personalization-slots-model) | Why a slot is a scope, how the variant picker resolves a visitor deterministically, what the fixed segment-label enum is and where it comes from, why the holdout sentinel only matches untagged variants, and what the lift report's statistics actually measure. | | [The reverse-ETL destination model](/concepts/reverse-etl-destination-model) | How Orbit's reverse-ETL family classifies each warehouse destination — native profile-trait columns (BigQuery, Snowflake, Redshift, Postgres), organic SQL-resolved traits (Databricks, ClickHouse), or notconfigured — and how per-destination run-status (failing / stale / neverrun) answers 'did my data actually land downstream?' | | [The survey lifecycle: instrument, token, dispatch, scoring, and benchmark](/concepts/survey-lifecycle-model) | How Orbit's survey and Voice-of-Customer subsystem runs end to end: the instrument model and its six dispatch channels, the signed token and short reply tag that gate response submission, the dispatch→open→submit response lifecycle with first-response-wins idempotency, the scoring family (CSAT/NPS/CES, conjoint, MaxDiff), how responses map to CDP traits and events, the VoC analytics rollups, and the frequency caps that keep one survey per respondent window. | | [The team chat model: channels, huddles, presence, reactions, and attachments](/concepts/team-chat-model) | How Orbit models internal team chat — channels and direct-message threads, the ephemeral objects layered on messages (reactions, presence, typing), huddles as per-channel voice rooms, the notification category team chat lands in, attachment handling rules, and when to reach for team chat versus the customer-facing Inbox. | | [Three ways to materialize an audience at send time](/concepts/audience-autosuggest-and-cohort-export) | LLM-suggested segments, click-cohort retargeting, and on-the-fly CSV export are the three paths that turn an audience idea into something a campaign can act on. When to use each, how the click cohort is attributed, and what audit trail covers the CSV egress. | | [What a Customer Data Platform (CDP) is on Orbit](/concepts/what-is-a-customer-data-platform) | The definitional concept page: a CDP collects event streams, resolves identities into golden records, and activates segments and scores. Covers how the native posture differs from an installed CDP, and where the tenant-owned controls live. | | [Widget flow model: runtime, web-call context, WebMCP guardrails, and trust policy](/concepts/widget-flow-model) | How the embedded widget decides what happens next — the conversation directives its flow runtime returns, the bounded screen-pop context a browser voice call carries, the guardrails that gate browser-resident AI agents, and the trust policy that gates their actions. Read this before you wire the widget, bind a voice agent, or relax agent trust. | ### AI & Automation | Page | What it covers | | ---------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [A2A federation model](/concepts/a2a-federation-model) | How Devotel Orbit exposes an agent to external agents over the Agent2Agent protocol — discovery, the two delegation directions, inbound authentication, and what federation deliberately does not do. | | [Action approvals: the human-in-the-loop gate](/concepts/action-approvals-model) | The model behind Orby's approval card — which tool calls propose an action instead of executing it, how a proposal moves from pending to approved, rejected, or expired, who can propose versus who can decide, and the durable event trail each transition writes. | | [Agent playbooks: trigger-driven live guidance](/concepts/voice-playbooks-model) | Deterministic playbook cards — trigger phrases plus recommended actions — fire on a live call's transcript to the agent's panel, and every fire is scored for adherence. | | [Agent presence and aux-code lifecycle: the five states dispatch checks before it rings](/concepts/agent-presence-lifecycle) | How login, aux (pause/away) codes, wrap-up windows, and dispatch move an agent through available, busy, wrapup, paused, and offline — and what ACD eligibility, omnichannel capacity, and supervisor surfaces read from each state. | | [AI-disclosure ledger: concept](/concepts/ai-disclosure-ledger) | What the per-agent AI-disclosure ledger records, why regulators ask for it under the EU AI Act Article 50 and the FCC AI-voice disclosure posture, how the signed export binds conversation→agent→disclosure evidence, and how it differs from the guardrail event stream. | | [Cross-app access: Identity Assertion JWT Authorization Grant (ID-JAG)](/concepts/cross-app-access-id-jag) | Why enterprise agent delegation should not ride on broadly scoped static API keys — the ID-JAG model of IdP-issued assertions redeemed for short-lived tokens bound to both the end user and the calling agent, and how Devotel Orbit's shipped primitives (authorization mandates, just-in-time scoped credentials, RFC 9068 agent bearer tokens) implement that model today. | | [Hosted MCP server](/concepts/mcp-hosted-server) | Devotel Orbit exposed as an MCP server — one JSON-RPC endpoint, a curated tool catalog, and a default-deny scope model where an unscoped API key sees zero tools. | | [How flow executions run: states, branching, async waits, and webhook hand-off](/concepts/flow-execution-model) | The runtime model behind Orbit Flows — what an execution is versus a definition, how nodes advance, how long waits survive restarts, how branching state is held, how failures finalize, and how executions bind to a published version. | | [Inbox conversation push-routing (auto-assignment)](/concepts/inbox-push-routing) | How the optional push-routing scheduler moves pending, unassigned inbox conversations out of the pull queue — the opt-in gate, the 30-second sweep, the skill-and-affinity match with a round-robin fallback, the atomic claim guarantees, and how it compares to the voice ACD queue. | | [Orby operator assistant architecture: sessions, turns, tools, and the approval gate](/concepts/orby-operator-assistant) | How Orby — the operator assistant built into the Orbit dashboard — is put together: the operator-session auth boundary, threads and the FSM snapshot, the tool registry with explicit approval, the streaming turn loop, and the two grounding sources. | | [Outcome-based AI-agent billing: pay per resolved conversation, not per token](/concepts/outcome-pricing-model) | The outcome pricing model for AI agents — a charge fires only when a rubric evaluator marks a conversation PASSED and the tenant has opted in, with versioned rubric keys, micro-cent rates, and the same append-only wallet ledger every other charge lands in. | | [Pick a testing harness: the decision table](/concepts/agent-testing-harness-picker) | Six pre-deploy harnesses test an AI agent — dry-run, batch-simulation, voice-simulation, soak-test, red-team, persona-simulation. Pick the right one for debugging, gating, load, safety, or regression. | | [Practice Studio: stateless simulated-customer roleplay sessions](/concepts/practice-studio-model) | The client-replays-the-transcript model behind Practice Studio roleplay training — how scenario presets vs inline custom scenarios resolve, the turn loop, scoring against the rubric, rate and LLM gating, and how it differs from the AI agent architecture and the QA leaderboard. | | [Predictive routing: the trained agent-match model](/concepts/predictive-routing-model) | How the per-tenant agent-match model predicts which agent pairs best with each caller — hierarchical shrinkage over agent and customer-context features, blended into predictive routing only when you train it and give it weight. | | [QA evaluations and the performance leaderboard](/concepts/qa-leaderboard-and-evaluations) | How weighted QA evaluations work end to end — scorecard forms, the acknowledge/appeal lifecycle, AI auto-scoring with human override, and how graded evaluations feed the ranked performance leaderboard for team quality reviews. | | [The branch-decision contract: from CDP to flows](/concepts/cdp-and-flown-each-other-branch-decision) | One contract for answering the cross-subgroup question — when a CDP segment, score, event sentence, or chart should drive a Flows branch — covering the CDP events / render / engagement side alongside the flows / runs / follow-ups side, both flagship pages, the build-your-first-branch contract, and the return path that keeps an audit row straight. | | [The call-quality evaluation lifecycle](/concepts/quality-evaluation-lifecycle) | How a call becomes a scored evaluation routed to a human reviewer — assignment quotas and due dates, blind calibration sessions that keep reviewers honest, coaching cards, autoscore coverage and auto-QA readiness, and the supervisor-level rollups and trends that fold scorecards into one QM picture. | | [The skill catalog: the canonical list of skills routing accepts](/concepts/skill-catalog) | How the tenant-owned skill catalog governs skill-based ACD routing — the CRUD endpoints, the validation boundary on queue and agent writes, enforceable certifications, and the proficiency decay policy. | | [What a flow template is, and how cloning detaches it](/concepts/flow-templates-model) | The flow-template artifact — a frozen, read-only starter graph versus a saved flow — the categories the catalog uses, what cloning copies into a draft, trigger-type semantics in a template, platform versioning versus clone drift, and where templates sit in the flow execution model. | ### Compliance, Send Controls & Rates | Page | What it covers | | ------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [10DLC error taxonomy: registry rejections vs. delivery errors](/concepts/tcr-vs-carrier-error-taxonomy) | Tell a TCR registry rejection (30883, 40016, EIN-MISMATCH) from a runtime delivery error (30001, 30007) on a failed message, and route each to the right decoder — the re-submission fix-card endpoint for registry codes, the carrier-error dictionary for delivery codes. | | [10DLC: the US A2P sender-registration model](/concepts/10dlc-concept) | What 10DLC is, how the brand-and-campaign pair sits inside Orbit's sender-identity model, why carriers read your campaign declarations at send time, and which of the four guides owns each piece of the work. | | [Brand identity and trust score: the cross-channel verification rollup](/concepts/brand-identity-trust-score) | How Brand Identity rolls the per-channel compliance posture of 10DLC, toll-free, WhatsApp, RCS, branded calling, and number KYC into one trust score and a prioritized next-action list, and how to run it in your ops workflow. | | [Consent, opt-out, and suppression: the recipient-state model](/concepts/consent-and-suppression-model) | How a contact's consent records, channel preferences, and suppression entries form one recipient state, which entry points write it, and how the send chain evaluates it before every dispatch. | | [Country rules enumeration model: one row per country per channel](/concepts/country-rules-enumeration-model) | How the country-rules register is enumerated — a separate row per (country, channel) over sms, whatsapp, rcs, voice, email, and viber — what each field's enum actually ranges over, and why the per-channel split is what makes the send-time gate honest about genuinely transactional traffic. | | [CTIA Messaging Principles as an ordered schema](/concepts/ctia-messaging-principles) | One concept page that ties the five CTIA Messaging Principles pillars — A2P/P2P lanes, SHAFT content categories, opt-in consent, opt-out keyword handling, and message content requirements — into a single readable schema, with the exact Orbit surfaces each pillar maps to. | | [Data placement and residency](/concepts/data-placement-and-residency) | One answer to 'where does my data live': tenant isolation is the WHERE boundary, the residency pin is the WHERE-GEOGRAPHICALLY choice, and region-of-compute covers API ingress and voice media — and how to read all three before you certify a posture. | | [Fraud reputation: the shared cross-tenant network feed](/concepts/network-signals-fraud-reputation) | How the anonymized cross-tenant fraud-reputation feed works — what it records about a destination corridor, why it requires at least three distinct tenants before any reputation accrues, and where it feeds the SMS-pumping risk score. | | [Frequency-cap model: slot claims, counters, and gate order](/concepts/frequency-caps-model) | How a frequency cap denies an over-message: per-cap Redis sorted-set counters keyed by cap and recipient, an atomic check-and-claim slot negotiation, category scoping, and where the cap gate sits in the send-admission chain. | | [Identity risk gate: fused signals — port-event recency, SIM swap, and Silent Auth](/concepts/identity-risk-gate-signals) | The signal model behind POST /numbers/network-apis/identity:gate — which operator-asserted and caller-held signals the fusion kernel scores, how the additive weights land a verdict in allow / review / deny, and the per-request tuning knobs your own funnel posture is built from. | | [Message suppression model: the duplicate-content guard, and the two mechanisms it is not](/concepts/message-suppression-model) | Message suppression is a content-hash duplicate guard that skips identical bodies before the frequency cap — distinct from consent suppression (the opt-out gate) and the suppression list (the imported block list). This page tells the three apart. | | [Network APIs and the CIBA silent-auth flow](/concepts/network-apis-ciba) | What Orbit's Network APIs expose (GSMA Open Gateway / CAMARA identity, QoD, roaming, slicing, and prefix hooks), how the CIBA data-bearer Silent Network Auth flow proves number possession without an SMS OTP, and how to choose between silent-auth and a classic OTP. | | [Outbound country allowlist — a tenant-owned opt-in gate](/concepts/country-allowlist-gate-model) | The model behind /settings/compliance/country-allowlist: why Orbit imposes no platform-global country block, how the allowedcountries list and allowallcountries override resolve on every send, and how the gate composes with the fraud stack. | | [Outbound URL reputation and the smishing scan](/concepts/url-reputation-smishing-scan) | How the two-lane URL reputation scorer works — an always-on heuristic engine plus optional external safe-browsing verdicts — what the clean/suspicious/malicious bands mean, and why the score is advisory-by-design. | | [Rate-limit and cooldown collector: how the API request boundary maps every bucket](/concepts/rate-limit-cooldown-collector) | The single model for Orbit's request-level limiters — per-route buckets (public, authenticated read/write, money-moving, webhook inbound, agent invoke) and their cooldown mechanics — what fired, what an exceeding request sees, and how retry-idempotency keeps a 429 from costing you. | | [Rate-limit and cooldown taxonomy: which limiter fired when a send returns 429](/concepts/rate-limit-and-cooldown-taxonomy) | The complete map of Orbit's limiter families — per-API-key request caps, tenant throughput ceilings, frequency caps, per-recipient cooldowns and anti-pumping gates, and per-channel provider caps — what each one protects, the error code it raises, and how to honor retryafter. | | [Retention windows and deletion: the stores map](/concepts/retention-windows-and-deletion) | How long each data class lives by default, which windows you can configure and which are platform-fixed, and how WORM archival export, legal holds, and GDPR erasure interact with the retention sweeps across every store. | | [Sender warming and reputation: how the ramp and trust kernels work](/concepts/sender-warming-and-reputation) | How Orbit's graduated sender-warming ramp, the four warming phases, and the DLR-driven reputation and trust scores fit together across 10DLC numbers and alphanumeric sender IDs. | | [SMS complaint feedback loop: ingest, rollup, and auto-suppression](/concepts/sms-complaint-feedback-loop) | How Orbit ingests carrier and CTIA SMS spam-complaint reports per DID, computes a complaint rate against your sent volume, classifies the resulting level, and trips an operator-visible auto-suppression hold at the critical threshold — the SMS parallel of the email complaint loop. | | [Spam-likelihood prediction: the score, its factors, and the remediation playbook](/concepts/spam-likelihood-prediction) | How Orbit's predictive 0–100 spam-likelihood score is composed from DLR-derived rates and health-trend direction, what the four label bands mean, and when to run the ordered remediation playbook before a carrier spam label lands. | | [TCPA federal voice guard: the one 422 you can't unset](/concepts/tcpa-federal-voice-guard) | The 8 AM–9 PM recipient-local federal dialing window for US voice, why it is the only compliance control the platform owns outright, how its fail-closed posture differs from every other gate, and how to resolve a 422 TCPAFEDERALDIALINGWINDOWBLOCKED when it stops your campaign. | | [TCPA quiet hours: federal, state, and tenant gates as one stack](/concepts/federal-vs-state-vs-tenant-voice-gates) | The three-layer dialing-window model — the platform-owned federal TCPA window, the seven-state mini-TCPA overlay, and your opt-in per-channel quiet-hours gate — how precedence resolves between them, why SMS has no federal window, and which deep page owns each layer. | | [Template lifecycle and approval semantics](/concepts/template-lifecycle) | What a template is in Devotel Orbit, why writes are carrier-approval-gated, how the draft → pending → approved/rejected → archived lifecycle works, which channels require approval, and how templates relate to bodies, flows, and campaigns. | | [Tenant compliance defaults — the opt-in envelope](/concepts/tenant-compliance-defaults-model) | How Orbit gates per-tenant defaults for GDPR erasure cooling-off and campaign quiet hours: a master toggle plus one sub-toggle per feature, both boolean true, with platform constants otherwise. Fail-safe resolution, clamped values, and a 60-second cache. | | [The audit ledger model](/concepts/audit-ledger-model) | How Devotel Orbit's audit trail proves completeness: a per-organization hash chain over canonicalized events, daily Merkle roots anchored to external storage, and the three planes — write, stream, and export/verify — that move the ledger without weakening it. | | [The policy-scan pipeline model](/concepts/policy-scan-pipeline-model) | How the pre-send content scanner attaches to the send path as a pre-handler, what the pass/warn/block verdict means, how the strict-warn-off mode matrix maps to the transport, and why the X-Policy-Violations header contract carries a size guard. | | [The Reassigned Numbers Database (RND): how the safe-harbor scrub works end to end](/concepts/reassigned-numbers-database) | What the FCC Reassigned Numbers Database is, how Orbit's date-comparison verdict (most-recent disconnect date vs. your consent date) is produced, where the dialer and API both consume it, and what evidence the scrub leaves for compliance reviews. | | [The Verify fraud gate: score, verdict, and the fallback-constrained channel chain](/concepts/verify-fraud-gate-timeline-model) | The composite model behind the Verify console fraud gate — what the pre-send fraud score is made of, how allow / stepup / block verdicts interact with a session's ordered channel chain, and how the attempts log codes each delivery hop. | | [Verification session lifecycle: sent, checked, approved or failed](/concepts/verification-lifecycle) | How a Verify session (vrf id) moves from code dispatch through check attempts to an approved or failed terminal outcome — including the async fallback chain and the events each transition emits. | | [Voice pre-send gate chain: the order outbound calls are evaluated](/concepts/voice-pre-send-gate-chain) | The fixed order of pre-send checks on the outbound voice dial path — emergency short-code, TCPA federal window, FCC AI-voice consent, fraud and DNO guards, per-country rate window, and STIR/SHAKEN attestation — with a precedence table, tenant-override answers, and how to read which gate fired. | | [WhatsApp Business Calling media relay](/concepts/whatsapp-business-calling-media-relay) | Where a WhatsApp Business Calling conversation's audio actually flows — the seven components, the signalling/media split, the rtpengine NG-control relay, what 'signalling-only' means when the relay is unbound, failure semantics per layer, and how the model differs from PSTN voice. | | [WhatsApp Business Calling model](/concepts/whatsapp-business-calling-model) | How WhatsApp voice calls work as a first-party capability — Meta's country availability blocklist, the call-permission state machine, per-second metering with a one-minute floor, the RTP media relay, and lifecycle webhooks. | | [WhatsApp Flows and form submissions](/concepts/whatsapp-flows-and-forms) | The concept model behind WhatsApp Flows: a Meta-hosted interactive form, the two submission paths (in-conversation reply and Meta endpoint webhook), how a submission resolves to its tenant and a contact, where it lands, and how Flows compose with the template lifecycle — plus the troubleshooting pointers for the dispatch and resolution failure modes. | | [WhatsApp quality and health model](/concepts/whatsapp-quality-and-health) | How Meta's quality signals flow into Devotel Orbit — the WABA health probe, per-recipient quality scoring, template auto-pause, and the billing-block banner — and the operator loop that keeps a WhatsApp Business Account sending. | ### Webhooks & Platform Models | Page | What it covers | | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Campaign lifecycle: draft to completed, blast vs drip vs journey](/concepts/campaign-lifecycle) | The campaign object model and its state machine — the statuses a campaign moves through and who advances each transition, how blast, drip, and journey campaigns differ at runtime, what pauses a campaign, and how terminal outcomes roll into stats, holdout lift, and ROAS. | | [Commerce checkout spine](/concepts/commerce-checkout-spine) | The architecture behind the Devotel Orbit commerce API — how one persistent cart spans WhatsApp, RCS, Apple Messages for Business, and Instagram; how checkout resolves from native in-thread pay to a hosted pay-by-link; how server-side reconciliation matches a captured payment against a re-derived cart total; and how agentic payment mandates plug into the same spine. | | [How voice biometrics verification works](/concepts/voice-biometrics) | Voiceprint enrollment, the challenge phrase, the verify call's double gate, per-tenant thresholds, and how the biometric score feeds the composite risk verdict. | | [Idempotency and safe retries](/concepts/idempotency-and-safe-retries) | How the Idempotency-Key contract works across the Orbit API — the 24-hour replay cache, the 409 body-mismatch guard, which endpoints require a key, the wallet-level re-entry protection behind balance mutations, and how every SDK generates (or overrides) keys for you. | | [Inbound connector webhook authentication model](/concepts/inbound-connector-webhook-auth-model) | How Orbit authenticates inbound events from HubSpot, Salesforce, Shopify, Calendly, Segment, Slack, Intercom, and the Nango umbrella — pre-Clerk receivers where the HMAC signature is the credential, fail-closed secrets, org-resolution recovery, and where verified events land. | | [Inbound webhook debug log](/concepts/inbound-webhook-debug-log) | A persistent, PII-masked record of every inbound webhook — written before signature verification — with a tenant vs. platform visibility split, and the read paths you use to debug signature failures and missing deliveries. | | [Journey enrollment fan-out: three routers, one entry chain](/concepts/journey-enrollment-fan-out) | How contacts enter a running journey — the three enrollment routers (inbound-reply keyword, segment entry/exit, CDP-track events), the shared offboard precheck and re-entry guard they all funnel through, the per-journey entry rate limit, wait-node semantics, and the failure posture that leaves an unmatched contact untouched. | | [KBA caller verification: knowledge-based challenges on a live call](/concepts/caller-verification-kba) | How knowledge-based authentication (KBA) verifies a caller's identity against the on-file contact profile — challenge factors, the bounded attempt budget, verified sessions, and the audit ledger stored on the call record. | | [Marketplace listing lifecycle and trust model](/concepts/marketplace-listing-lifecycle) | What the developer marketplace is, how a listing moves from draft to published through platform review, the four listing types, what installing actually copies, and why the catalog is safe to browse and install from. | | [Operate voice biometrics: thresholds, step-up, and the verification console](/concepts/voice-biometrics-console) | Where enrollment and verification actually live day to day — the dashboard console panels, the two tenant-owned settings, how a weak verdict bridges to OTP, and the operator runbook for low-confidence and flagged-voice events. | | [Public pixels, redirects, and short links](/concepts/public-pixels-redirects) | The root-mounted public endpoints that power email open tracking, goal conversion pixels, referral links, landing pages, and short-link redirects — the contract for what must be anonymous, signed, and always-rendered. | | [QR code generation model](/concepts/qr-code-generation-model) | The three GET endpoints on /api/v1/qr — generate, whatsapp, and sms — the safety model that filters tenant-supplied payloads and double-validates phone numbers before encoding, the encoding rules (size bounds, byte cap, response formats), the error vocabulary, and when an untracked QR render is the right tool versus a trackable short link. | | [Short links, landing pages, and the publish lifecycle](/concepts/short-links) | The two trackable artifact families on the links surface — a short link as one redirect record, a landing page as a renderable block tree — and the draft → publish → archive lifecycle that gates a page's public address, the role model behind both, and how public short links differ from private click-tracking on campaigns. | | [The export families model](/concepts/export-families-model) | Orbit ships four export lanes — ad-hoc audience CSV, signed conversation vCon, reverse-ETL destination pushes, and WORM archival bundles — plus the event-sinks streaming plane beside them. This page frames the egress decision, goes deeper on the reverse-ETL destination model, and closes with a decision table keyed by retention, evidentiary, schedule, and data volume. | | [The notification model: event fan-out, categories, channels, and digests](/concepts/notification-model) | How an event in your workspace becomes a notification — the three destinations it can reach (the in-dashboard bell, an immediate email, a scheduled digest), the category map that ties event kinds to your preferences, the per-user live feed, and the org-level digest scheduler. | | [The WFM model: forecasting, scheduling, adherence, and the labor market](/concepts/wfm-model) | The concept map for workforce management — what planning vs. adherence means, the six domains (forecasts, schedules, assignments, staffing, adherence/timekeeping, labor market + wellness), the request/approval loop, role split, and how scores roll up. | | [USSD session model and the stateless menu engine](/concepts/ussd-session-model) | How a USSD session runs in both directions — handset-initiated dial-in and network-initiated push — the synchronous dial-and-reply protocol, the full-input replay that makes the menu engine a pure function of (menu, input), the menu-tree invariants the validator enforces, and how to treat CON/END dispositions idempotently. | | [Voice Agent Quality Index (VAQI)](/concepts/voice-agent-quality-vaq) | Per-session latency, turn-turning, and barge-in metrics for voice AI agents — what VAQI measures, the session payload it records, the rollup it returns, and the dashboard page that renders it. | | [Web SDK and the public-key identify/track model](/concepts/web-sdk-public-key-model) | Why the web personalization SDK mounts at /sdk/ on the root host under a browser-safe public key (pk), how /sdk/identify stitches an anonymous visitor to a known contact, and how the security envelope differs from both the signed pixels and the authenticated API. | | [Webhook delivery semantics: retries, ordering, and the dead-letter queue](/concepts/webhook-delivery-semantics) | The delivery model behind Orbit webhooks — at-least-once semantics, the exponential retry schedule, proven-dead responses, the dead-letter queue, and endpoint auto-disable — and what each implies for your receiver. | | [Webhook fan-out: one event, many destinations](/concepts/webhook-fan-out-and-event-sinks) | How one platform event becomes many deliveries — the events buffer, per-endpoint webhooks, and event sinks — each with its own filter, retry state, and dead-letter queue. | | [Webhook subscription lifecycle: register through disable and re-enable](/concepts/webhook-subscription-lifecycle) | The operator loop for ONE webhook subscription — registration, signing-secret handling, the retry ladder per delivery, failure classification, what auto-disable means, and the re-enable flow that gets you delivering again. | ### Files & Object Storage | Page | What it covers | | ------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Media file upload and the presign lifecycle](/concepts/file-upload-and-presign-lifecycle) | The platform's object-storage plane end to end: how a file moves from POST multipart through the size, scope, and content gates into the tenant-prefixed GCS bucket, how signed read URLs are minted, time-boxed, and re-minted, how delete and orphan garbage collection work, and which surfaces — MMS, CDN assets, knowledge bases, wallet passes, session replay — consume the same plane. | ### Outbound | Page | What it covers | | --------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Marketing hub model: wallet passes, loyalty, and referrals behind one redirect](/concepts/marketing-hub-model) | How the /marketing surface family hangs together: the bare /marketing path as a redirect-only index, the wallet-passes console (issue, update, void, generation counter, idempotent issuance), the loyalty console (tiers, member ledger, point balance), the referrals console (per-contact codes, reward steps, leaderboard), and the note on when the redirect becomes a tiled hub. | | [Referral program model: program → code → conversion → reward](/concepts/referral-program-model) | The referral model behind the public /r/:code redirect and the /api/v1/referrals controller: tenant-owned programs, idempotent per-contact code minting, refcode attribution, leaderboard and totals aggregation, and the incentives-engine payout path. | ### Features | Page | What it covers | | ------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Incentives: catalog, ledger, and fulfillment](/concepts/incentives) | Issue one-off rewards and support credits through the promotions API: the reward-type catalog and provider picker, the event-sourced incentive ledger, the fulfillment engine behind referrals, surveys, and loyalty redemption, and how issuance connects to Wallet Passes. | | [Loyalty program model: points, tiers, and the CDP ledger](/concepts/loyalty-program-model) | How the points-and-tiers loyalty program works as a CDP-native layer: balances projected over the event stream, event-sourced program revisions, lifetime-points tier ladders, overspend-safe redemption, and the traits segments and journeys branch on. | | [Wallet pass lifecycle: issue, update, void](/concepts/wallet-pass-lifecycle) | What the wallet-pass state machine means: the three pass types and when to choose each, the issue → update → void lifecycle, the generation counter as the holder-refresh signal, the append-only ledger under an idempotency key, and where passes end versus loyalty and incentives. | ### Billing | Page | What it covers | | ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [The invoice, statement, and subscription model](/concepts/billing-documents-model) | What each billing document means in Orbit — invoices from the billing provider, statements from the prepaid wallet ledger, and recurring-agent subscriptions with mandate authorization — plus how statement balances reconcile and why tax on hosted checkouts is handled by the buyer, never estimated. | | [The pricing-preview pipeline: projected margin and payout before close](/concepts/billing-pricing-preview-model) | The five read-only preview endpoints that project what a billing period would look like before it closes — AIaaS usage charges, marketplace rev-share with builder payouts, resolution metering, reseller margin rollup with partner revenue share, and the partner payout ledger — and how they differ from the ledger, the invoices, and the what-if rate simulator. | ### Guides | Page | What it covers | | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Outbound loyalty: points, tiers, and member balances](/concepts/outbound-loyalty) | The accrual, promotion, and redemption model behind the Outbound → Loyalty dashboard — points earned from CDP channel events, one-way tier promotion on lifetime totals, overspend-safe balance redemptions, and membership lifecycle from enrol to close-out. |