​

Two-sided marketplace loop: consent gate → masked proxy → two-way SMS → Inbox → close

​

1. Gate consent before any proxy session

• Run a DNC pre-flight scrub on the counterparty numbers when you onboard a batch of them — driver pools, seller lists, courier rosters. POST /compliance/dnc/scrub returns a per-number verdict (up to 500 per request), and both it and the single-number check require your organization’s Do-Not-Call opt-in, enabled in your compliance settings. Pull the flagged numbers from the roster before any of them enter a session.
• Capture consent with the public consent form when contactability is claimed rather than transactional. The hosted page lets recipients opt in or out per channel, and its submissions write to the same consent surfaces the carrier-side STOP/START keywords write to — so an opt-out from either path suppresses the number at the send path, proxy sends included.
• Keep these controls tenant-owned. You decide what to enforce and Orbit executes it; the platform does not impose a global gate on top of your list hygiene. The one exception is the federal TCPA dialing window on US voice calls — a platform-wide guard with no opt-out — which matters here because a marketplace loop that lets carriers call participants is subject to it like any other dial.

​

2. Create the proxy session per transaction

curl -X POST https://api.orbit.devotel.io/api/v1/proxy/sessions \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "participant_a": "+14155550100",
    "participant_b": "+14155550399",
    "ttl_minutes": 45
  }'

{
  "data": {
    "session_id": "proxySession_3f8d2a91c4",
    "proxy_number": "+14155555678",
    "participant_a": "+14155550100",
    "participant_b": "+14155550399",
    "status": "active",
    "ttl_minutes": 45,
    "expires_at": "2026-08-27T12:45:00.000Z",
    "created_at": "2026-08-27T12:00:00.000Z"
  }
}

​

3. Run SMS and voice through the same proxy

• SMS. Either participant texts the proxy number; Orbit matches the sender to the session and forwards to the other participant, sent from the proxy number.
• Voice. Either participant dials the proxy number; the call bridges to the counterparty. Ordering coordination is a voice habit — “meet me at the gate,” “I’m downstairs” — and it shares the same masked pairing. Neither side ever sees the other’s real number on either channel.

​

4. Handle replies in your thread map — and escalate to the Inbox when a human enters

// POST /webhooks/orbit — signature verified, event id deduplicated.
if (event.type === "proxy.message.forwarded") {
  const { session_id, proxy_number, from_participant, to_participant, channel } = event.data;
  await appendToThread(session_id, {
    direction: from_participant === order.riderNumber ? "rider→driver" : "driver→rider",
    proxyNumber: proxy_number,
    channel,
  });
}

• A human must answer inside a live window — a dispute, a safety flag, a failed handoff. Create a ticket into the queue with POST /api/v1/inbox/tickets/internal, carrying the order it belongs to and the session id as the thread reference, so the agent opens a thread the participants already live on. If the agent needs live conversation handling rather than ticket follow-up, the Inbox’s native inbound path opens the conversation on the queue instead — inbound keeps working on the same numbers, no re-wiring.
• The conversation outgrows SMS or your team needs supervision — an agent sees the surfaced thread context, assignment, internal notes, and SLA clocks apply. Set up channels, routing rules, and SLA policies from the Inbox setup guide before the first escalation lands.

​

5. Close the session at completion

curl -X DELETE "https://api.orbit.devotel.io/api/v1/proxy/sessions/proxySession_3f8d2a91c4" \
  -H "X-API-Key: dv_live_sk_..."

• 409 CONFLICT on close means already ended — closed by an earlier handler or expired by the sweeper. Treat it as success and never retry; the desired state already holds.
• The TTL is the fallback, not the plan. If no completion handler runs, the session stops accepting traffic at expires_at and the sweeper releases the number on its next pass. An expired session is a forgotten cleanup, not a leak.
• Reconcile drift with the list call. GET /api/v1/proxy/sessions?status=active tells you which sessions your order states think are finished but the proxy lifecycle thinks are open — close anything on that list.

1. Gate consent; expect flagged numbers to fail at the gate before a session exists.
2. Create the session; expect proxy.session.created.
3. Text the proxy number from participant A; expect proxy.message.forwarded and delivery to B. Repeat from B and from a voice dial.
4. Escalate one thread to the Inbox and answer from the queue, addressed to the proxy number.
5. Delete the session; expect proxy.session.closed, then confirm nothing forwards and neither party can be recontacted.

​

See also

• Choosing a privacy primitive — the decision layer: masking vs OTP vs channel primitives, plus the TTL table and the full error taxonomy this page defers to.
• Number masking: proxy privacy sessions — the proxy sequence in full: create, route, terminate, webhook verification.
• Two-way SMS conversations — the webhook thread map this page upgrades from.
• Inbox setup — channels, routing rules, macros, SLA, AI drafts for the queue escalations land in.
• DNC pre-flight scrub and public consent form — the tenant-owned consent gate from section 1.
• Proxy API reference — the field-level session endpoint surface.