> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting: STIR/SHAKEN never measured — the get-your-level quick start

> You have never opened the attestation page and callers are reporting 'Spam Likely' or your answer rate is slipping. This page is the one-command first check: read your policy defaults, confirm the inbound reporting fields, and measure your posture — before you dive into downgrade root causes.

# Troubleshooting: STIR/SHAKEN never measured

Most tenants who land on the
[STIR/SHAKEN attestation downgrade](/troubleshooting/stir-shaken-attestation-downgrade)
page have already found the attestation controls. This page is for the earlier
moment: you have never opened **Settings → Compliance → Attestation**, but
customers are answering less, or carriers downstream label your calls "Spam
Likely", and the question is simply **"what is my level, today?"** The answer
is one reporting endpoint away — and the read is safe to run before you touch
anything.

<Warning>
  This page describes your tenant's own attestation controls. It is **not
  legal advice**, and Orbit neither mandates a target level for you nor
  guarantees any particular STIR attestation — the carrier of record signs
  outbound traffic, and it will not sign higher than the platform attests.
  The policy and statuses you set here drive reporting; they never gate or
  reroute a call.
</Warning>

## The first command: read your current policy

`GET /compliance/attestation/policy` returns your org's attestation target,
downgrade handling, inbound verification floor, and spoof-risk flag — and it
returns the safe defaults even if you have never set them, so a first-ever
read is a valid, non-destructive answer:

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/attestation/policy" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

```json theme={null}
{
  "data": {
    "policy": {
      "target_attestation": "A",
      "downgrade_handling": "monitor",
      "inbound_min_verification": "B",
      "flag_unverified_inbound": true,
      "updated_at": "2026-09-01T08:12:44.000Z"
    }
  }
}
```

Read the four fields once:

* **`target_attestation`** — the level you compare outbound numbers against
  (defaults to `A`). A number attesting below this lights up as "below
  target" in reporting — it is a flag, not a gate.
* **`downgrade_handling`** — `monitor` (silently record, the default) or
  `alert`. Observability only; never blocks or reroutes a call.
* **`inbound_min_verification`** — the inbound Identity level you treat as
  verified for fraud posture (defaults to `B`: partial-or-better inbound
  signing counts as verified). Tighten or relax this to match the fraud
  posture you want to report.
* **`flag_unverified_inbound`** — whether unsigned or validation-failed
  inbound calls count as spoof-risk in your posture snapshot (defaults on,
  so the snapshot is meaningful from day one). Reporting only — no inbound
  call is ever blocked.

If this is the first time you read your policy, the response above is the
system's default safe posture — not a signal something is wrong.

## One PUT to confirm the inbound reporting posture

The two inbound fields above default to `B` / `true`, which is the posture
the downgrade page expects you to have. If a prior admin relaxed them — a more
permissive floor like `any`, or the flag off — put them back with one write:

```bash theme={null}
curl -X PUT "https://api.orbit.devotel.io/api/v1/compliance/attestation/policy" \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "inbound_min_verification": "B",
    "flag_unverified_inbound": true
  }'
```

That is the entire configuration step — the two reporting fields the
downgrade page expects, set to their report-useful defaults. Nothing was
blocked, rerouted, or re-signed. Policy writes are admin-gated (owner/admin
role); policy and posture reads are not.

## Then watch the posture snapshot

Read `GET /compliance/attestation/posture` — the same endpoint the
downgrade-root-cause page works from. It lists each originating number with
the level it actually attests at and compares it to your `target_attestation`,
and it adds the inbound summary against your floor:

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/attestation/posture" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

The fields worth watching on your first pass:

* **`originating.summary.below_target`** — numbers attesting below your
  declared target. If this is non-zero, the
  [downgrade page](/troubleshooting/stir-shaken-attestation-downgrade)
  tells you which of its five root causes applies.
* **`inbound.summary.spoof_risk`** — unsigned or validation-failed inbound
  calls in the last 30 days, counted now that the flag is on.
* **`inbound.summary.verified_rate`** — share of inbound calls that satisfied
  the floor you set. `null` (not zero) when the window had no inbound
  traffic.

Numbers you own attest at `A`; active leased pool numbers at `B`; verified
external, hosted, and BYON numbers at `C`. A is ownership-only — no policy
target raises a non-owned number, and delegate certificates cap at B by
design. If a number you dial from attests below your target, work the
downgrade page's root causes rather than raising the policy target — the
target is reporting intent; the softswitch signs exactly the level Orbit
attests and no more.

## Vocabulary: the A/B/C glossary in 30 seconds

* **A (full)** — the carrier of record knows your org and your right to use
  the calling number. Only numbers your org owns in Orbit attest A.
* **B (partial)** — the carrier knows your org but cannot verify every
  number's authorisation. Leased pool numbers and delegate-certificate
  coverage attest B.
* **C (gateway)** — origin unverified. Anything else attests C — verified
  external caller IDs, hosted numbers, BYON numbers you control but have not
  ported.

For the full signing model, see
[STIR/SHAKEN attestation](/channels/voice/stir-shaken); for the policy,
delegate-certificate registry, and posture controls, see
[Attestation posture](/compliance/attestation).

## What not to do

* **Do not PUT a higher target to "improve" the level.** The target is
  reporting intent only; the softswitch signs exactly the level Orbit attests
  and no more. A target above your numbers' real level makes the gap more
  visible, never smaller.
* **Do not look for a blocked call.** Everything on this page is
  reporting-only — the inbound floor and spoof-risk flag classify inbound
  risk for your posture snapshot; no inbound call is ever blocked on them.
* **Do not stop at the policy read.** The policy read is the first check; the
  posture snapshot is the measurement. One answers "what did I set," the
  other answers "what am I getting."

## See also

* [STIR/SHAKEN attestation](/channels/voice/stir-shaken) — what the A/B/C
  levels mean and where signing happens.
* [Attestation posture](/compliance/attestation) — the policy, delegate-cert
  registry, and posture snapshot page.
* [STIR/SHAKEN attestation downgrade](/troubleshooting/stir-shaken-attestation-downgrade)
  — the follow-up run once `below_target` lights up.