> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Vertical bundles console walkthrough

> Run the Settings → Compliance → Vertical bundles page end to end — pick a pack, preview its contents, activate it, read back the activation record, work the go-live checklist, and handle repeats and version bumps.

# Vertical bundles console walkthrough

The [Vertical Compliance Bundles](/compliance/vertical-bundles) page explains
what each pack provisions and the endpoints behind it. This guide is the
operator-side walkthrough of the console UI at
**Settings → Compliance → Vertical bundles** — the same surface a teammate
drives with clicks instead of curl, so you can activate a pack, open its
checklist, and come back to it after a reload without writing a script.

The page is restricted to the owner, admin, and developer roles; viewer roles
see the catalog but cannot activate or toggle checklist steps.

## What a bundle provisions

Each pack is a one-click bundle of draft resources for one regulated traffic
family — healthcare (HIPAA), fintech (KYC), e-commerce, or payments &
collections (PCI). Activation creates a draft compliance profile, a set of
draft campaign templates, a vertical-tuned AI agent, and a seeded double
opt-in confirmation flow, then records a go-live checklist on the profile.
The [Vertical Compliance Bundles](/compliance/vertical-bundles) semantics
page has the full table of what each pack carries; this walkthrough covers
the console flow around it.

<Tip>
  Everything a pack creates is a draft. Nothing is wired to a carrier and
  nothing sends until you review the drafts, submit the profile for
  verification, and attach your senders — activation sets your starting
  defaults; the send decision is always yours.
</Tip>

## Step 1 — open the catalog and pick a pack

**Dashboard path:** **Settings → Compliance → Vertical bundles** — the
catalog grid renders one card per shipped pack.

Each card shows the pack's display name, its vertical badge, the draft
campaign count, the checklist step count, and the pack version. The console
reads this from `GET /api/v1/compliance/vertical-bundles`.

Pick the pack that matches your traffic family — for this walkthrough the
example is `healthcare_hipaa`. If your workspace spans two families (say,
fintech account alerts and e-commerce order messaging), activate one pack
per family; a second call for the same key duplicates the drafts rather
than reconciling them.

## Step 2 — preview what activation creates

**Dashboard path:** on the pack card, click **View pack contents** — a
dialog opens with the full manifest before you commit.

The dialog lists every draft campaign template with its copy, the AI
agent's name, type, model, and system prompt, the double opt-in
confirmation copy, and every checklist step title. The console fetches the
manifest lazily from
`GET /api/v1/compliance/vertical-bundles/:key` only while the dialog is
open, so the page stays cheap until you ask for a preview. A `404` on an
unknown key means the key is not in the shipped catalog.

Read the campaign copy and the agent's system prompt here — this is the
exact text activation provisions, so review it before you click, not after.

## Step 3 — activate the pack

**Dashboard path:** on the pack card, click **Activate pack**, optionally
fill in **Brand name**, **Help contact**, and **Country (ISO-2)**, then
**Confirm activation**.

The console sends
`POST /api/v1/compliance/vertical-bundles/:key/activate`. The three
optional fields brand the seeded copy — `brand_name` and `help_contact`
substitute into the campaign templates and the opt-in confirmation, and
`country_code` (or a `countries` list) scopes the draft profile. Leave them
blank and the pack's generic placeholders carry through.

Activation returns `201` with the full activation state: the provisioned
compliance profile id, the draft campaign ids, the agent id, and the
go-live checklist. The console stores the profile id in the page URL
(`?activation=<profileId>`), so a reload or a re-navigation back to the
page reopens the same checklist instead of stranding you.

## Step 4 — read back the activation record

**Dashboard path:** the checklist panel that opens below the catalog after
activation reads back the current record.

The same read from the shell returns the record the console renders:

```bash theme={null}
curl https://api.orbit.devotel.io/api/v1/compliance/vertical-bundles/activations/<profileId> \
  -H "X-API-Key: dv_live_sk_your_key_here"
```

```json theme={null}
{
  "data": {
    "bundleKey": "healthcare_hipaa",
    "version": "1.0.0",
    "displayName": "Healthcare (HIPAA-conscious patient messaging)",
    "vertical": "healthcare",
    "complianceProfileId": "cprof_01J9...",
    "agentId": "agt_01J9...",
    "campaigns": [
      { "slug": "appointment_reminder", "id": "cmp_01J9..." },
      { "slug": "prescription_refill",  "id": "cmp_01J9..." }
    ],
    "activatedAt": "2026-10-02T09:14:31Z",
    "activatedByUserId": "usr_01J8...",
    "checklist": [
      { "id": "provision_resources", "status": "done",    "kind": "auto"   },
      { "id": "attach_documents",    "status": "pending", "kind": "manual" },
      { "id": "submit_profile",      "status": "pending", "kind": "manual" }
    ]
  },
  "meta": { "request_id": "…", "timestamp": "…" }
}
```

(The response is abbreviated — the live record carries every campaign and
every checklist step.) The record lives on the compliance profile it
created, which is why the read is keyed on the profile id rather than the
bundle key.

If you activated in an earlier session, the **Resume a previous
activation** card below the catalog lists every pack already provisioned
for the workspace with its done/total checklist progress; click **Resume**
to reopen that checklist.

## Step 5 — work the go-live checklist

**Dashboard path:** inside the checklist panel, tick each manual step as
you complete it; provisioned steps are marked done automatically.

The checklist mixes two step kinds:

* **Provisioned** steps — the resources activation created (the draft
  profile, draft campaigns, draft agent), marked `done` automatically with
  a lock badge.
* **Manual** steps — gates only you can clear: attach required compliance
  documents, complete the US 10DLC brand and campaign registration, review
  the draft agent's prompt, review the opt-in confirmation copy, confirm
  the quiet-hours window, and approve campaign copy. The healthcare pack
  adds signing a Business Associate Agreement; the e-commerce pack adds
  separating marketing from transactional opt-in; the PCI pack adds
  confirming the hosted payment page.

Each toggle sends
`PATCH /api/v1/compliance/vertical-bundles/activations/:profileId/checklist/:stepId`
with `{ "status": "done" }` or `{ "status": "pending" }`. The progress bar
at the top of the panel tracks done/total; the console also links the
draft compliance profile so you can open it and edit the provisioned
campaigns and agent in place.

<Warning>
  The checklist is an in-product tracker, not a send gate — it never
  blocks an API call. Use it to prove the reviews happened; the draft
  state of the provisioned resources is what actually holds your traffic
  until you submit.
</Warning>

## Step 6 — overlap and duplicate safeguards

Click each bundle **once per use case**. The
[activation lifecycle semantics](/compliance/vertical-bundles-activation-semantics)
page covers the exact behavior; the short version for the console:

* **Activation never merges with an existing profile.** Each activate
  call creates a new draft profile, new draft campaigns, and a new draft
  agent — even on a repeat of the same key.
* **Re-activation duplicates on purpose.** There is no dedupe check and
  no `409`; activating `healthcare_hipaa` twice produces two independent
  checklists and two verification journeys. To fix a failed carrier
  review, edit the existing profile and resubmit it — do not re-activate.
* **Reclaim a duplicate** by deleting the surplus drafts (the profile,
  campaigns, and agent) before they enter verification; the API offers no
  auto-cleanup.

The decision table on the semantics page maps each situation — seeded copy
nearly right, material revision shipped, script retry on a network blip,
failed carrier review, genuinely parallel setups — to the correct move.
Read it before you click twice.

## Step 7 — version N → N+1 upgrades

An activation record pins the bundle's version at the moment of the call.
When Orbit ships a bundle revision, the catalog version advances and your
existing activation keeps its snapshot — the version, the checklist shape,
the campaign copy, and the agent prompt are frozen on the record.

To see whether a revision applies to you:

1. Open **View pack contents** on the pack card — the dialog header and
   card footer show the live version.
2. Compare with the version badge on your activation record (the read-back
   step above).

For a material revision — new checklist gates, changed campaign copy, an
updated agent prompt — the upgrade path is to delete the old drafts and
re-activate through the same flow; the audit entry for the new activation
records the new version, so the org audit log shows the upgrade as a
second activation rather than a silent rewrite. Per-tenant notifications
of a revision are not sent; the changelog announces template changes.

## Tenant-owned controls

Vertical bundles are a **tenant-owned activation helper**: the pack ships
the vertical's reviewed starting defaults, and your workspace stays
responsible for the rest — attaching senders, confirming the copy, and
clearing the go-live checklist. Activation is an accelerator for your own
posture, not a decision by the platform that your traffic is compliant.
The pages under
[Your Tenant Compliance Posture](/compliance/posture-overview) describe
the toggle map these defaults hook into.

## Related

* [Vertical Compliance Bundles](/compliance/vertical-bundles) — what each
  pack provisions and the endpoint reference behind this page
* [Activation lifecycle semantics](/compliance/vertical-bundles-activation-semantics) —
  overlap, re-activation, version behavior, and checklist visibility
* [Duplicate activation troubleshooting](/troubleshooting/vertical-bundle-activation-duplicates) —
  clearing surplus drafts left by a repeat click
* [Audit log](/guides/audit-log) — where every activation and checklist
  toggle is recorded


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.