Disable incoming calls that lack SHAKEN/STIR attestation?

jabowery

twilio's SHAKEN/STIR articles refer only to outgoing calls.

What about incoming calls? I don't want my IVR system to so much as answer a call without a SHAKEN/STIR attestation. API documentation search on "SHAKEN" comes up with nothing. twilio fora also comes up with nothing.

bdelvalle

Hi @jabowery , Twilio Developer Educator here.

I think maybe checking for the presence and value of the StirVerstat (or X-Twilio-VerStat if you're using Elastic SIP Trunking) parameter on your incoming call webhooks may help you.

The StirVerstat parameter should only be present in the incoming webhook's request body if the incoming call had a SHAKEN PASSporT identity header. If the StirVerstat parameter is present, you could also check the value of the parameter to filter out calls without the proper attestation level.

This page has some more information on the different attestation levels/possible values of the StirVerstat parameter:

https://www.twilio.com/docs/voice/trusted-calling-with-shakenstir#changes-for-twilio-customers

Hopefully that helps!

jabowery

@bdelvalle Thanks but I'm not sure how to get access to that header from Python. What I instead found after some searching was a page on how to use Twilio Studio with JavaScript to do SHAKEN/STIR with a CAPTCHA fallback.

It does what I need, sans the interface to the rest of my Python code for the body of my WSGI app.

PS: A minor problem with that page is the comment string in the JavaScript code:

"This Twilio Function returns a random length digit sequence for use as an IVR challenge."

I believe that should read instead:

"This Twilio Function returns a random digit sequence, of a given length, for use as an IVR challenge."