CAMARA · GSMA Open Gateway

SIM Swap API

Stop SIM-swap fraud before it happens

The SIM Swap API enables the checking of SIM card swaps for fraud prevention purposes The standardized SIM Swap API streamlines the integration of SIM swap detection and management capabilities into your applications.

  • Account takeover
  • Payment fraud
  • Password reset

What you can do with this API

Ready to test? Jump to the sample call and the API reference, where you can try every endpoint. Start testing
Read the full API overview

SIM Swap API
 

What is SIM Swap API?

The SIM Swap API enables the checking of SIM card swaps for fraud prevention purposes

The standardized SIM Swap API streamlines the integration of SIM swap detection and management capabilities into your applications. By identifying potential fraudulent activity, this API significantly enhances security and provides robust protection against unauthorized access. 

Furthermore, the SIM Swap API's Unified Access feature simplifies integration by consolidating access to the network capabilities of multiple carriers through a single, standardized interface. This streamlined approach improves developer efficiency and accelerates time-to-market for security solutions.

 

Overview of the Ooredoo SIM Swap CAMARA API

High level definition

The SIM Swap CAMARA API is a application interface that enables API Consumers to request the last date of a SIM swap performed on a mobile line or to check whether a SIM swap has been performed during a specified period. This functionality is provided in an easy and secure manner, allowing real-time verification of the activation date of a SIM card on the mobile network.

API Operations

The SIM Swap CAMARA API specifies the following two operations:

  • POST retrieve-date: Answers the question ‘when did the last SIM swap occur?’. This operation requires the phone number to be checked (parameter phoneNumber).
  • POST check: Checks whether a SIM swap occurred during the last N hours. This operation requires the following inputs:
    • phoneNumber: The phone number to be checked.
    • maxAge: The period in hours to be checked for a SIM swap (minimum 1 hour, maximum 2400 hours, default 240 hours).

With the Ooredoo SIM Swap CAMARA API, any digital service provider can integrate the functionality of checking changes in SIM renewals directly into their application.

Aggregators and digital partners can seamlessly integrate this functionality into their applications. By leveraging the SIM Swap API in conjunction with other security checks, such as location verification, phone number verification, contact information matching, external data sources, and AI algorithms, they can develop sophisticated fraud detection models. To achieve this, aggregators can utilize other Open Gateway APIs, including Device Location Verification, Number Verification, and KYC-Match.

The integration of the SIM Swap CAMARA API empowers developers to significantly enhance the security and reliability of their applications, providing a robust defense against the growing threat of SIM swap fraud.

Questions about the SIM Swap API

What can I do with the SIM Swap API?

The SIM Swap API enables the checking of SIM card swaps for fraud prevention purposes The standardized SIM Swap API streamlines the integration of SIM swap detection and management capabilities into your applications.

  • When was the SIM last swapped? (POST /retrieve-date)
  • Was it swapped in the last N hours? (POST /check)
Which inputs does each call to the SIM Swap API need?
  • POST /retrieve-date: accepts phoneNumber (see the reference for which combination to send)
  • POST /check: accepts phoneNumber, maxAge (see the reference for which combination to send)

Every call also needs Authorization: Bearer <access_token>. The API reference on this page shows each field's type and an example request.

What does the SIM Swap API return?
  • POST /retrieve-date returns HTTP 200 with latestSimChange
  • POST /check returns HTTP 200 with swapped

Responses are JSON.

How do I authenticate with the SIM Swap API?
  1. Call POST https://api.ooredoo.com/oauth/v4/token with client_id, client_secret in the headers. Send grant_type, scope in the body. Use the client ID and secret of your app.
  2. The response contains access_token, token_type, expires_in, consented_on, created_At, expired_At.
  3. Send Authorization: Bearer <access_token> on each call until the token expires, then request a new one.
Which errors can the SIM Swap API return?
  • 400: Bad Request
  • 401: Unauthorized
  • 403: Forbidden
  • 404: Not found
  • 422: Unprocessable Content
  • 500: Internal Server Error
  • 503: Service Unavailable
  • 504: Gateway Timeout

On 401, request a new access token and retry.

Where is the SIM Swap API available?

SIM Swap is available in Algeria, Oman, Tunisia, Kuwait, Iraq and Qatar.

Which standard does the SIM Swap API follow?

It follows the CAMARA specification of the GSMA Open Gateway initiative, so an integration built for another operator's CAMARA API needs little change. See our CAMARA certification page.

Related APIs

Sample call

From the published OpenAPI specification. Replace the placeholders with your app's credentials and real values.

1. Get an access token

curl -X POST https://api.ooredoo.com/oauth/v4/token \
  -H "client_id: $CLIENT_ID" \
  -H "client_secret: $CLIENT_SECRET" \
  -d "grant_type=client_credentials" \
  -d "scope=urn:camarasimswap"

2. Call the API

curl -X POST https://api.ooredoo.com/sim-swap/v4/check \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"phoneNumber":"+974XXXXXXXX","maxAge":240}'

API reference

Try any endpoint in the sandbox