SIP Reference

    SIP Headers Explained

    A focused reference on the SIP headers that determine whether a call is trusted, attested, or blocked at the network edge.

    INVITE

    The SIP request that starts a call. The Request-URI identifies the called party; body contains SDP for media negotiation.

    From

    The logical originator of the call. Trivially spoofable on IP networks — do not use for trust decisions on its own.

    P-Asserted-Identity (PAI)

    The network-asserted identity of the caller, set by a trusted proxy. Widely used inside carrier networks for billing and lawful intercept.

    Identity

    The STIR/SHAKEN signed header. Contains the JWT that cryptographically binds the calling number to the originating carrier's attestation.

    Diversion / History-Info

    Records call forwarding and redirection history. Used by terminating carriers to reconstruct call paths and detect loops or laundering.

    Contact

    The direct SIP URI to reach the endpoint. Fraud tooling inspects this for suspicious IP ranges and unregistered endpoints.

    User-Agent

    Identifies the softswitch or endpoint. Not a security signal, but useful for fingerprinting known-bad autodialers.

    How SipShield Uses These Headers

    SipShield inspects every SIP INVITE in real time — cross-checking From, PAI, and Identity headers against KYC records, STIR/SHAKEN attestation, and behavioral models to decide whether the call is signed, downgraded, or blocked.

    See How It Works