Knowledge Center

No. Every API page and its documentation is open to everyone, and you can download each OpenAPI specification without signing in. You need an account only to create an app, get credentials and call the APIs.

1. Select Register at the top right of any page.
2. Fill in the form. Use the same email address throughout the whole process.
3. Choose your user type: I'm an independent if you build on your own, I work for a company if you build for your employer, or Partner of Ooredoo if your company has a partnership with Ooredoo. Partners also select the APIs they plan to use.
4. Enter the public IP addresses your servers will call the APIs from: up to 10, separated by commas.
5. Submit. You'll receive a confirmation email, and a second email once an administrator approves your account.

The partner onboarding guide walks through each step.

Your API keys belong to an app. Once your account is approved, sign in, open Apps, create an app and add the APIs you want to use. The app's client ID and client secret are your keys. You use them to request an access token for each API call.

Every new account is reviewed by an administrator, and you'll get an email as soon as yours is activated. If it's taking longer than you expected, use the Contact us form at the foot of any page. Choose the subject Registration Issue and give the email address you registered with.

Use Reset your password on the sign-in page, and a reset link is sent to your registered email address. If it doesn't arrive, check your spam folder, then use the Contact us form with the subject Login Issue.

Use the Contact us form at the foot of any page. Choose the subject Two Factor Authentication Issue and write from the email address you registered with, so the team can verify your identity.

An app holds your credentials and the API products it's allowed to call. You can have several, for example one per environment or per product line. To create one, sign in, open Apps, add a new app, give it a name, select its API products and save.

1. Sign in and open Apps.
2. Select your app and open its Credentials tab.
3. Select Show to reveal the client ID and client secret.

Treat the secret like a password. Never put it in browser code, mobile apps or public repositories.

The product most likely has an active rate plan, and you need to subscribe to it before it becomes selectable.

1. Sign in.
2. Open the subscription plans page and subscribe to the plan for that API.
3. Return to your app. The product is now available to add.

Only the addresses whitelisted for your account. You give up to 10 public IP addresses when you register, our support team whitelists them, and they then appear in your profile. To add or change one, use the Contact us form with the subject Application Access Issue.

The API catalogue lists them all:

• SIM Swap, Number Verification and OTP (CAMARA)
• DCB One-Time and DCB Recurring (direct carrier billing)
• Prepay Balance Management, Communication Management and Customer Details Management

Each API page shows what you can do with the API, where it's available and how to authenticate, followed by the full interactive reference.

Two industry standards, so an integration you've built for another operator carries over with little rework.

• CAMARA, the open API project of the Linux Foundation and GSMA Open Gateway: SIM Swap, Number Verification and OTP.
• TM Forum Open APIs, the telecom industry's REST standard: Prepay Balance Management (TMF654), direct carrier billing, Communication Management and Customer Details Management.

Each API page shows its standard. See our CAMARA certification and TM Forum certification pages for what's certified where.

No. Availability differs by API and by Ooredoo market. Each API page lists the countries where it's live. For example, Direct Carrier Billing is available in Algeria, Iraq, Kuwait, the Maldives, Oman, Palestine, Qatar and Tunisia. The certification pages show which markets have certified each API.

With OAuth 2.0 client credentials.

1. Call the token endpoint with your app's client ID and client secret and grant_type=client_credentials. The endpoint and exact request are in each API's reference.
2. The response contains access_token, token_type and expires_in (seconds).
3. Send Authorization: Bearer <access_token> on every call to api.ooredoo.com.

Reuse the token until shortly before it expires rather than requesting one per call. If a call returns HTTP 401, request a new token.

Every API page has a Download the OpenAPI spec link in its quick start panel. You don't need to sign in. Import the file into Postman or your code generator, or read it alongside the interactive reference on the same page.

A sandbox is a test environment. It behaves like the live API but uses test data, so you can build and debug without real transactions or real subscribers. Production is the live API. It works with real subscribers and real charges, and every call has a real effect.

Two calls. send-code sends a one-time password by SMS to the user's phone number and returns an authenticationId. When the user types the code, validate-code checks it against that authenticationId. See the OTP API page for the full request and response.

Two answers, from two calls. check tells you whether the SIM behind a phone number was swapped within the last N hours (maxAge). retrieve-date returns when it was last swapped. Use it as a fraud check before a sensitive action such as a payment or a password reset. See the SIM Swap API page.

JSON, over HTTPS. Each API reference shows sample requests and responses, including the error format.

A rate limit caps how many requests your app can make in a given period. It prevents abuse, keeps usage fair and protects the platform from overload. Your limits depend on the plan attached to your app. If you exceed them, calls are rejected (typically with HTTP 429), so slow down and retry with back-off rather than immediately.

All traffic is encrypted with HTTPS. Every call needs an OAuth 2.0 access token issued to an approved app. Calls are accepted only from whitelisted IP addresses, and the platform goes through regular security audits.

We tell developers well in advance and give guidance on migrating to a newer version or an alternative API.

Sign in, then open Report from your profile menu for usage by app and API, and Wallet History from your account menu for charges and balance.

• Contact us with the form at the foot of any page. Pick the subject that matches: API Product, Registration Issue, Login Issue, Two Factor Authentication Issue, API Purchase Issue, APP Related Issue, Application Access Issue, or Feedback.
• Browse these FAQs by category.

Report it straight away through the Contact us form. Include the API, the time and any transaction ID you have. Our team will investigate and work to restore service.