STIR/SHAKEN attestation levels: A, B and C explained

What do STIR/SHAKEN attestation levels A, B and C mean?

STIR/SHAKEN attestation levels say how far the signing provider can vouch for a call’s caller and calling number. A: it verified both the customer and the number. B: it verified the customer, not the number. C: it has no relationship with the caller. Koda Voice signs calls it originates under its own Service Provider Code, 583H, by those conditions.

ATIS-1000074, the SHAKEN framework standard, defines the three levels from the signing provider’s seat.

In every row, “customer” means the signer’s own authenticated account and “verified” means the signer checked.

Where does the attestation level travel in a call?

The attestation level travels inside the call’s signed token. Under SHAKEN, the originating provider builds a token called a PASSporT naming the calling number, the called number, a timestamp and an attest claim, signs it with the key behind its STI certificate, and attaches it to the call’s SIP signaling. RFC 8588 defines the attest claim’s three values, A, B and C, and maps them to the ATIS-1000074 levels. The terminating provider checks the signature against the signer’s certificate. The Pallone-Thune TRACED Act, 47 U.S.C. 227b, directed the Federal Communications Commission (FCC) to require voice service providers to implement it in their IP networks.

Two consequences follow. The signature identifies whoever holds the certificate, not necessarily the provider you contract with. And because the level sits inside a signed token, no one downstream can change it without invalidating the signature.

Level A (full attestation): what must the signing provider know?

Level A, full attestation, requires the signing provider to satisfy three conditions at once under ATIS-1000074: it is responsible for originating the call onto the IP voice network, it has a direct authenticated relationship with the customer and can identify that customer, and it has established a verified association between the customer and the telephone number used for the call.

The first two come from onboarding: a Know-Your-Customer review ties the account to a legal entity, an address, a responsible person and a use case (what a carrier KYC review asks for). The third comes from number records. A number the carrier provisioned or ported to the account is associated with that customer at provisioning; a number held with another provider needs documented authorization, such as a letter of authorization, first. Level A is the outcome of verification, not a plan tier.

Level B (partial attestation): verified customer, unconfirmed number

Level B, partial attestation, applies when the signing provider originated the call and has a direct authenticated relationship with the customer, but has not established a verified association with the calling number. The B definition differs from A on exactly that one condition. Typical B situations:

• The customer displays a number held with another provider and not yet documented.
• The customer calls on behalf of a client from the client’s number.
• A port is in progress and the number is not yet in the carrier’s records.

Level B is honest signing: the provider knows the customer and cannot yet confirm the number is theirs. A carrier that signs those calls as A is asserting, under its own name, something it has not verified.

Level C (gateway attestation): where the call entered, nothing more

Level C, gateway attestation, applies when the signing provider has no relationship with the originator of the call. ATIS-1000074 gives an international gateway as the example: the provider received the call from another network and can attest only that it entered there. A call that reaches a signing carrier unsigned from another provider is in the same position. A C signature is still valid and still identifies the signer; it says nothing about who placed the call.

Who decides the attestation level on a call?

The provider that signs the call decides the attestation level. ATIS-1000074 frames every condition around what that provider originated, whom it authenticated and which numbers it verified, so the level is that provider’s own assertion under its own certificate. Three consequences follow:

1. The customer cannot choose the level, only supply what the carrier needs to verify it.
2. A downstream provider cannot raise the level; that would assert a relationship it does not have.
3. The level is only as good as the signer’s records. An A from a carrier that ran a real onboarding review and holds the number in its own inventory is a different fact from an A issued on the customer’s say-so.

Not every provider can sign at all. The Secure Telephone Identity Governance Authority (STI-GA) sets the entry rule in its SPC Token Access Policy: a current FCC Form 499-A on file, an assigned Operating Company Number (OCN), and an FCC certification of STIR/SHAKEN implementation or robocall-mitigation compliance with a listing in the Robocall Mitigation Database (RMD), before the STI Policy Administrator (STI-PA), the role iconectiv holds in the United States, clears the provider for STI certificates.

Why can the same customer get different levels from different carriers?

The same customer can get different attestation levels from different carriers because the conditions describe the signer’s relationship with the customer and the number, not the customer’s legitimacy. Change the signer and the facts behind the signature change.

The first three rows are the same business with the same calling number; only the paperwork differs.

Why does traffic through a reseller end up at B or C?

Traffic through a reseller can end up at B or C because the certificate holder’s authenticated customer is the reseller, so the signature identifies the reseller rather than the business placing the calls, and the level depends on what the certificate holder verified for the reseller’s account. A reseller that holds its own certificate and runs its own onboarding review is the signing provider itself.

Does A attestation stop a call from being labeled Spam Likely?

A attestation does not stop a call from being labeled Spam Likely; attestation and labeling are separate systems. The signature answers which provider vouches for this calling number and how strongly; the label answers how the number has behaved. Labels come from call-analytics engines run for terminating carriers, which score each calling number on call patterns, volume, duration and complaints.

A verified A signature is one input to that score; a B or C signature does not by itself make a call spam. What moves a label is the traffic behind the number: consent, a stable set of numbers used consistently, a checkable business identity, and staying inside the 8 a.m. to 9 p.m. called-party window that 47 CFR 64.1200(c)(1) sets for telephone solicitations. Do not buy attestation as a label fix, and do not read a B as the reason your calls are flagged; check the number’s history first, as described in why calls get flagged Spam Likely.

How do you ask your carrier which attestation level you get?

Asking your carrier is the only reliable way to learn your attestation level, because the carrier sets it. Six questions cover it:

1. Do you sign under your own Service Provider Code and STI certificate, or under an upstream carrier’s? Check whether the carrier’s legal name appears on the STI-PA’s Authorized Service Providers list; the list shows names, not codes, so it confirms authorization, not which code a given call was signed under.
2. Which level do numbers you provisioned to my account receive, and which level do numbers I bring from elsewhere receive?
3. What documentation moves a number I hold elsewhere from B to A?
4. Where can I see the level on my own calls: call records, a portal, or a signed test call to a number I control?
5. If I resell your service or call on behalf of clients, whose identity does the signature carry?
6. Are you listed in the FCC Robocall Mitigation Database, and under which legal name? What the RMD is and how to look a carrier up covers the search.

A carrier that answers all six without hedging is describing verification it performs. The other checks are in how to verify a VoIP carrier.

How this applies to Koda Voice

Koda Voice LLC is an authorized STIR/SHAKEN service provider with the STI Policy Administrator under Service Provider Code 583H, its NECA-assigned Operating Company Number, and holds an STI certificate issued by an approved STI Certification Authority. Calls originated on Koda’s network are signed under Koda’s own Service Provider Code, not a reseller’s certificate.

Attestation on Koda’s network follows the framework above: A when Koda has verified the customer and the customer’s authorization to use the number, B when the customer is verified but number authorization cannot be confirmed, and C otherwise. The verification behind an A is Koda’s Know-Your-Customer review at onboarding, which authenticates the customer, plus Koda’s confirmation that the customer is authorized to use the calling number. Koda’s acceptable-use policy and per-customer traffic-quality monitoring apply after onboarding and are described in Koda’s robocall mitigation summary. Koda does not promise a level ahead of verification.

Koda is a new carrier: every registry identifier behind its signature was issued in 2026 in Koda Voice LLC’s own name, and each one is published in the Trust Center with a link to the public registry where it can be checked. What Koda needs from a customer before signing at A is on the STIR/SHAKEN page.