Skip to main content

​
Troubleshooting: STIR/SHAKEN never measured

Most tenants who land on the STIR/SHAKEN attestation downgrade page have already found the attestation controls. This page is for the earlier moment: you have never opened Settings → Compliance → Attestation, but customers are answering less, or carriers downstream label your calls “Spam Likely”, and the question is simply “what is my level, today?” The answer is one reporting endpoint away — and the read is safe to run before you touch anything.
This page describes your tenant’s own attestation controls. It is not legal advice, and Orbit neither mandates a target level for you nor guarantees any particular STIR attestation — the carrier of record signs outbound traffic, and it will not sign higher than the platform attests. The policy and statuses you set here drive reporting; they never gate or reroute a call.

​
The first command: read your current policy

GET /compliance/attestation/policy returns your org’s attestation target, downgrade handling, inbound verification floor, and spoof-risk flag — and it returns the safe defaults even if you have never set them, so a first-ever read is a valid, non-destructive answer:
Read the four fields once:
  • target_attestation — the level you compare outbound numbers against (defaults to A). A number attesting below this lights up as “below target” in reporting — it is a flag, not a gate.
  • downgrade_handling — monitor (silently record, the default) or alert. Observability only; never blocks or reroutes a call.
  • inbound_min_verification — the inbound Identity level you treat as verified for fraud posture (defaults to B: partial-or-better inbound signing counts as verified). Tighten or relax this to match the fraud posture you want to report.
  • flag_unverified_inbound — whether unsigned or validation-failed inbound calls count as spoof-risk in your posture snapshot (defaults on, so the snapshot is meaningful from day one). Reporting only — no inbound call is ever blocked.
If this is the first time you read your policy, the response above is the system’s default safe posture — not a signal something is wrong.

​
One PUT to confirm the inbound reporting posture

The two inbound fields above default to B / true, which is the posture the downgrade page expects you to have. If a prior admin relaxed them — a more permissive floor like any, or the flag off — put them back with one write:
That is the entire configuration step — the two reporting fields the downgrade page expects, set to their report-useful defaults. Nothing was blocked, rerouted, or re-signed. Policy writes are admin-gated (owner/admin role); policy and posture reads are not.

​
Then watch the posture snapshot

Read GET /compliance/attestation/posture — the same endpoint the downgrade-root-cause page works from. It lists each originating number with the level it actually attests at and compares it to your target_attestation, and it adds the inbound summary against your floor:
The fields worth watching on your first pass:
  • originating.summary.below_target — numbers attesting below your declared target. If this is non-zero, the downgrade page tells you which of its five root causes applies.
  • inbound.summary.spoof_risk — unsigned or validation-failed inbound calls in the last 30 days, counted now that the flag is on.
  • inbound.summary.verified_rate — share of inbound calls that satisfied the floor you set. null (not zero) when the window had no inbound traffic.
Numbers you own attest at A; active leased pool numbers at B; verified external, hosted, and BYON numbers at C. A is ownership-only — no policy target raises a non-owned number, and delegate certificates cap at B by design. If a number you dial from attests below your target, work the downgrade page’s root causes rather than raising the policy target — the target is reporting intent; the softswitch signs exactly the level Orbit attests and no more.

​
Vocabulary: the A/B/C glossary in 30 seconds

  • A (full) — the carrier of record knows your org and your right to use the calling number. Only numbers your org owns in Orbit attest A.
  • B (partial) — the carrier knows your org but cannot verify every number’s authorisation. Leased pool numbers and delegate-certificate coverage attest B.
  • C (gateway) — origin unverified. Anything else attests C — verified external caller IDs, hosted numbers, BYON numbers you control but have not ported.
For the full signing model, see STIR/SHAKEN attestation; for the policy, delegate-certificate registry, and posture controls, see Attestation posture.

​
What not to do

  • Do not PUT a higher target to “improve” the level. The target is reporting intent only; the softswitch signs exactly the level Orbit attests and no more. A target above your numbers’ real level makes the gap more visible, never smaller.
  • Do not look for a blocked call. Everything on this page is reporting-only — the inbound floor and spoof-risk flag classify inbound risk for your posture snapshot; no inbound call is ever blocked on them.
  • Do not stop at the policy read. The policy read is the first check; the posture snapshot is the measurement. One answers “what did I set,” the other answers “what am I getting.”

​
See also