canonical: https://jentic.com/apis/opengateway.telefonica.com/opengateway-telefonica

# Opengateway Telefonica Number Verification API

Telefonica's Open Gateway Number Verification API confirms whether a phone number provided by an end user matches the number actually in use on the device making the request. It does this by checking the IP address allocated by the mobile network operator against the subscriber's registered MSISDN, eliminating the need for SMS-based one-time passwords. The API is part of the GSMA CAMARA Open Gateway initiative and uses OAuth 2.0 with the network-based authentication flow defined in the standard.

## For AI agents

Verify that a phone number belongs to the device making the request, using mobile network signals instead of SMS OTPs. Returns a boolean match result for the supplied number.

## Scope

Does not handle SMS delivery, voice OTPs, or KYC document verification - use for silent network-based phone number verification only.

## Capabilities

- Verify that a user-supplied phone number matches the device's currently registered mobile number
- Retrieve the device phone number directly from the mobile network operator without an SMS round trip
- Replace SMS one-time passwords with silent network-level identity verification for sign-up flows
- Block account takeover attempts where the attacker's device is on a different SIM than the claimed number
- Confirm subscriber number ownership before allowing high-risk transactions such as payment authorisation

## Use cases

### Silent Sign-Up Verification

Replace SMS one-time passwords with a single POST /verify call that confirms the user-entered phone number matches the device's network-registered number. The check happens silently on the mobile data connection so there is no code-entry step. This reduces drop-off in onboarding flows and removes a costly SMS gateway dependency.

Example prompt: Call POST /verify with the user-entered phone number and assert the returned devicePhoneNumberVerified field is true before allowing account creation.

### SIM Swap Risk Mitigation at Login

Before authorising a sensitive action such as a password reset or payment, call GET /device-phone-number to retrieve the current network-registered number and compare it to the number on file. A mismatch is a strong signal of SIM swap or account takeover and should trigger step-up authentication. The API runs on Telefonica's Open Gateway, available across participating mobile networks.

Example prompt: Call GET /device-phone-number on the current session and compare the response to the user's stored phone number; if they differ, return a step-up authentication challenge.

### AI Agent Identity Verification via Jentic

Agents that perform regulated actions such as payments or account changes can call Number Verification through Jentic to confirm the requesting device's number matches the user record. Jentic securely stores the OAuth 2.0 client credentials and returns a structured boolean result, so the agent never handles raw network tokens.

Example prompt: Use Jentic to search for 'verify a phone number against the device', execute POST /verify with the user's claimed number, and return whether the verification succeeded.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/verify` | Verify a phone number matches the device's registered number |
| GET | `/device-phone-number` | Get the device's network-registered phone number |

## Key resources

- **Verification** — Verify a supplied phone number against the device or retrieve the device's registered number.

## Why Jentic

- **Setup:** Wiring the Number Verification API by hand means running Telefonica Open Gateway's OAuth 2.0 client-credentials flow, exchanging the client_secret for a short-lived bearer token, and refreshing it before each silent verification call. Through Jentic you install once, import the Number Verification API from the API Directory, store the client credentials once, and your agent calls it.
- **Permission scoping:** This surface exposes only POST /verify and GET /device-phone-number, so you limit the agent to the operations it needs, such as verifying a phone number against the network device. You choose which of these two operations it may call, and any it is not granted stays out of reach.
- **Credential handling:** Your Telefonica OAuth client credentials are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'verify a phone number against the device' or 'get the device phone number', and Jentic returns the matching Number Verification operation with its request schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Twilio API** — Twilio Verify uses SMS or voice OTPs to confirm a phone number, while Open Gateway Number Verification uses silent network signalling.
- **Sinch Verification API** — Sinch offers SMS, flash-call, and seamless verification; Open Gateway specialises in CAMARA-standard network verification.
- **Auth0 Management API** — Use Auth0 for user lifecycle and Open Gateway Number Verification as the verification step inside an Auth0 flow.
- **Onfido API** — Onfido handles document and biometric KYC; Open Gateway Number Verification adds a network-level phone proof to the same onboarding.

## FAQ

### What authentication does the Number Verification API use?

OAuth 2.0 with the CAMARA network-authenticated authorisation flow. Through Jentic the OAuth client credentials are stored in the vault and the agent receives a scoped token rather than the raw client secret.

### Can I verify a phone number without sending an SMS with the Number Verification API?

Yes. POST /verify checks the user-entered number against the IP-to-MSISDN binding maintained by the mobile network operator, so no SMS or one-time code is sent. The request must originate from the device's mobile data connection rather than Wi-Fi.

### What are the rate limits for the Number Verification API?

Telefonica does not publish a single global rate limit; quotas are issued per OAuth client and depend on the commercial agreement with Telefonica Open Gateway. Apply standard per-user throttling to avoid quota exhaustion in onboarding flows.

### How do I verify a user's phone number with the Number Verification API through Jentic?

Search Jentic for 'verify a phone number against the device', load POST /verify, and execute it with the user-supplied phoneNumber. Jentic injects the OAuth bearer token from the vault before forwarding the call.

### Does the Number Verification API work over Wi-Fi?

No. The verification relies on the IP address allocated by the mobile network operator, so the request must come from the device's mobile data session. If the device is on Wi-Fi, fall back to GET /device-phone-number once mobile data is available, or to a different verification method.

### Which countries does the Number Verification API cover?

The API runs on Telefonica's Open Gateway and is available in markets where Telefonica or a CAMARA federation partner operates the mobile network. Coverage is negotiated per commercial agreement; check with Telefonica before depending on it in a region you have not contracted for.

### Can I limit what my agent is allowed to do with the Number Verification API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use. This API surface exposes only two operations, POST /verify and GET /device-phone-number, so you can grant the agent just the one it needs, such as verifying a supplied number against the device, and keep the other out of reach. Your Telefonica OAuth client credentials stay in your self-hosted instance and are injected at execution time, never entering the agent's prompt or logs.