canonical: https://jentic.com/apis/developer.vodafone.com/vodafone

# Vodafone SIM Swap (CAMARA)

Jentic publishes the only available OpenAPI specification for SIM Swap (CAMARA), keeping it validated and agent-ready. Vodafone's SIM Swap API implements the GSMA CAMARA standard for verifying that a subscriber's SIM card has not been recently swapped, a key signal in fraud detection for SMS one-time-password and account-recovery flows. The spec covers JWT and CIBA OAuth flows, a check endpoint that returns whether a SIM has been swapped within a window, a retrieve-date endpoint, and a health ping for sandbox monitoring.

## For AI agents

Verify whether a mobile number's SIM was recently swapped to harden SMS-OTP, login, and high-value transaction flows against SIM-swap fraud.

## Scope

Does not handle sending SMS, identity document verification, or call routing - use for SIM-swap fraud detection only.

## Capabilities

- Check whether a SIM was swapped within a configurable lookback window through POST `/sim-swap/v1/check`
- Retrieve the exact date of the last SIM swap for a phone number via POST `/sim-swap/v1/retrieve-date`
- Obtain access tokens through the JWT bearer grant on `/oauth2/v2/token` for backend-to-backend calls
- Run the OpenID Connect CIBA flow with bc-authorize and token endpoints for user-consented checks
- Monitor sandbox availability with the `/sim-swap/v1/ping` health probe
- Plug into CAMARA-aligned anti-fraud workflows alongside other operator-exposed network APIs

## Use cases

### OTP fraud prevention before account takeover

Banks, fintechs, and payment platforms can call SIM Swap before delivering an SMS one-time password to confirm the SIM has not been swapped within a recent window. If the SIM was swapped recently the application can downgrade the channel to in-app push or step up to identity verification. The check returns a boolean within milliseconds and consumes one request per verification.

Example prompt: Call POST `/sim-swap/v1/check` with the phone number +447700900000 and a 240-hour window, then return whether the SIM was swapped.

### Forensic timeline reconstruction

Fraud and investigations teams can call retrieve-date to get the exact timestamp of the last SIM swap for a phone number under investigation. Combined with internal session logs and KYC records this lets analysts confirm whether account takeover lined up with the SIM swap event. The API returns ISO-8601 timestamps and is intended for back-office investigations rather than real-time gating.

Example prompt: Call POST `/sim-swap/v1/retrieve-date` for phone number +447700900000 and return the latest swap timestamp for the investigations dashboard.

### CIBA-consented verification for regulated workflows

For workflows that require explicit subscriber consent - such as PSD2 strong customer authentication or carrier-billing top-ups - the API exposes the OpenID Connect CIBA backchannel flow. The application calls bc-authorize, the subscriber consents on their device, then the application redeems the auth_req_id at the token endpoint to call the SIM swap check.

Example prompt: Run POST `/openIDConnectCIBA/v1/bc-authorize` for the subscriber, poll POST `/openIDConnectCIBA/v1/token` until the auth completes, then call `/sim-swap/v1/check` with the resulting access token.

### Agent-driven anti-fraud checks via Jentic

AI agents handling login risk scoring or payment authorisation can call Vodafone SIM Swap through Jentic without juggling JWT signing or CIBA polling. Jentic stores the OAuth client secret in your Jentic One instance and abstracts the token exchange, so the agent only sees the simple intent of checking whether a SIM was swapped.

Example prompt: Search Jentic for 'check if a SIM was recently swapped', load the schema for `/sim-swap/v1/check`, and execute against +447700900000 with a 24-hour window.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/sim-swap/v1/check` | Check if SIM was swapped within window |
| POST | `/sim-swap/v1/retrieve-date` | Get latest SIM swap date |
| POST | `/oauth2/v2/token` | Get access token using JWT bearer |
| POST | `/openIDConnectCIBA/v1/bc-authorize` | Initiate CIBA flow |
| POST | `/openIDConnectCIBA/v1/token` | Exchange CIBA auth_req_id for token |
| GET | `/sim-swap/v1/ping` | Sandbox health check |

## Key resources

- **SIM swap check** — Boolean check of whether a SIM was swapped within a window
- **SIM swap retrieve-date** — Timestamp of the most recent SIM swap for a phone number
- **JWT auth** — OAuth token endpoint accepting JWT bearer client assertions
- **CIBA auth** — OpenID Connect CIBA backchannel authorize and token endpoints
- **Monitoring** — Sandbox liveness ping endpoint

## AI readiness

This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.

- **Score:** 67 / 100
- **Maturity:** AI-Aware
- **Dimensions:**
  - Foundational Compliance: 85 / 100
  - Developer Experience & Jentic Compatibility: 78 / 100
  - AI-Readiness & Agent Experience: 38 / 100
  - Agent Usability: 94 / 100
  - Security: 100 / 100
  - AI Discoverability: 100 / 100
- **View full report:** https://jentic.com/apis/developer.vodafone.com/vodafone/scorecard
- **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/
- **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview

### Score it yourself

Every API in the directory is allowlisted, so you can re-score it with no key required.

- **Score your own API:** https://jentic.com/scorecard.md
- **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md

```sh
npx @jentic/api-scorecard-cli score <openapi-url>
```

## Why Jentic

- **Setup:** Wiring the Vodafone SIM Swap API by hand means running the OAuth2 and CIBA back-channel flows, choosing the sandbox or production host, and minting a fresh access token per call yourself. Through Jentic you install once, import the SIM Swap API from the API Directory, store the client credentials once, and your agent calls it.
- **Permission scoping:** You choose which SIM Swap operations the agent may call, so you can limit it to the ones it needs, such as checking whether a SIM was recently swapped, and leave the swap-date retrieval out unless you add it. The API only reports on SIM-swap events, so the agent cannot send SMS or verify identity documents.
- **Credential handling:** Your Vodafone client secret and signing key are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'check if a SIM was recently swapped', and Jentic returns the matching SIM Swap operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Twilio** — Twilio sends the SMS OTP that SIM Swap helps protect against takeover
- **Auth0** — Auth0 handles login orchestration and risk scoring; SIM Swap is a fraud signal feeding into it
- **Telnyx** — Telnyx exposes Number Lookup with porting and carrier signals as an alternative anti-fraud lens

## FAQ

### Why is there no official OpenAPI spec for SIM Swap (CAMARA)?

Vodafone does not publish an OpenAPI specification for this CAMARA SIM Swap endpoint. Jentic generates and maintains this spec so that AI agents and developers can call SIM Swap (CAMARA) via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Vodafone SIM Swap API use?

The API uses OAuth 2.0 with two flows: a JWT bearer assertion grant on POST `/oauth2/v2/token` for backend-to-backend access, and OpenID Connect CIBA via `/openIDConnectCIBA/v1/bc-authorize` for user-consented checks. Through Jentic, the client secret is held in your Jentic One instance and tokens are minted per call.

### Can I detect SIM-swap fraud with the Vodafone SIM Swap API?

Yes. POST `/sim-swap/v1/check` returns whether the SIM was swapped within the supplied lookback window, and POST `/sim-swap/v1/retrieve-date` returns the latest swap timestamp. Use the boolean check inline in OTP and login flows and the date endpoint for forensic review.

### What are the rate limits for the Vodafone SIM Swap API?

Limits are not declared in the OpenAPI spec and Vodafone applies tenant-specific limits agreed during commercial onboarding. The sandbox is rate-limited more aggressively than production. Test with backoff on 429 responses and confirm production limits with your Vodafone account manager.

### How do I check a SIM swap through Jentic?

Run pip install jentic, then with the async client search for 'check if a SIM was recently swapped', load the schema for POST `/sim-swap/v1/check`, and execute with the phone number and a maxAge window. Jentic returns the boolean swap result.

### Is the Vodafone SIM Swap API a CAMARA-compliant endpoint?

Yes. The endpoint paths and request/response shapes follow the GSMA CAMARA SIM Swap specification, so an integration written against this API can be portable across other CAMARA-aligned operators with minor base URL changes.

### Can I limit what my agent is allowed to do with the Vodafone SIM Swap API?

Yes. Jentic One is self-hosted by you, so your own rules decide which SIM Swap operations and credentials the agent may use. You can allow only POST `/sim-swap/v1/check` so the agent confirms whether a SIM was recently swapped, and leave out POST `/sim-swap/v1/retrieve-date` unless you choose to add it. Because the API only reports SIM-swap events, the agent cannot send SMS or verify identity documents.