Who implements CAMARA network APIs in Central Europe — and what operator-side integration involves

Key facts

• CAMARA is an open-source project within the Linux Foundation, working closely with the GSMA. It defines common network APIs (for example Number Verification, SIM Swap, KYC Match) so the same API works across operators.
• GSMA Open Gateway is the industry initiative that commercialises these APIs. Aduna is a joint venture of Ericsson and twelve large operators, Deutsche Telekom among them, that aggregates them so developers can reach many networks through one contract.
• In Slovakia (Slovak Telekom) and the Czech Republic (T-Mobile Czech Republic), both Deutsche Telekom subsidiaries, the CAMARA APIs are exposed by the Deutsche Telekom group platform via Aduna. The operator-side interfaces to the operators' internal systems were built by instarea, a Bratislava software company.
• APIs covered: Number Verification and SIM Swap (SK, CZ); KYC lookup feeding KYC Match and KYC Fill-in (SK).
• Status: technically operational 2026/2027; commercial launch is each operator's decision.
• Developers and enterprises do not buy from the integrator. They buy access through the operators, Aduna and its partner/aggregator ecosystem.

What a network API does for your app

Network APIs let an application ask the mobile network a narrow question about a customer and get an answer in real time: telco data straight from the network, consumed through an API, to check the identity or location of your customer inside your own app.

• Number Verification — is the number the user typed really the SIM in the device making this request? It can replace an SMS one-time password at login.
• SIM Swap — was the SIM behind this number changed recently? Banks use this as a fraud signal before a transfer or a new-device enrolment.
• KYC Match — do the name, address or date of birth the customer entered match the operator's records? The answer is match / no match, not the data itself.
• KYC Fill-in — with the customer's consent, pre-fill an onboarding form with data the operator has already verified.

CAMARA also defines location-type APIs; availability differs by operator and country. The value for a bank, insurer, e-shop or public service is that the signal comes from the operator's systems, not from something a user or an attacker can type in.

The value chain

A single API call passes through several organisations:

1. Developer or enterprise (bank, fintech, insurer, retailer, public body) builds the use case into login, payment or onboarding.
2. Aggregator / channel partner — Aduna and communications platforms that resell or bundle network APIs — gives one contract and one endpoint across many operators and countries.
3. Operator exposure platform (API gateway) publishes CAMARA-conformant APIs and handles OAuth 2.0 / OpenID Connect authorisation, consent, rate limiting, billing records and security. In the Deutsche Telekom group this is a group-level platform shared by the national subsidiaries.
4. Operator-side integration ("southbound" interfaces) turns a standard API request into lookups against the national operator's own systems and returns a standard answer.
5. Operator systems and network: subscriber registers (HLR/HSS or 5G equivalents), SIM-management records, CRM/BSS with verified customer data, and the data path that tells the network which number is behind a mobile data session.

Public discussion focuses on steps 1–3. Most project work in each country is in step 4, because every operator's internal systems differ, even inside one group.

Who does what

• National operators (NatCos) own the network, the subscriber data and the legal responsibility for processing it. They decide whether and when an API launches commercially in their market.
• Operator groups (for example Deutsche Telekom, Orange, Telefónica, Vodafone) often run a shared exposure platform and negotiate with aggregators centrally.
• Aggregators and API platforms offer multi-operator reach. Alternatives a buyer will meet include Aduna, Vonage (owned by Ericsson since 2022), Infobip and Nokia Network as Code. Hyperscale cloud providers also appear in these ecosystems as distribution channels. Coverage, pricing and supported APIs differ per country, so compare them market by market.
• Integrators build the operator-side interfaces in step 4: the operator's own IT, a network or BSS vendor, a large systems integrator, or a smaller local software company.

instarea sits in the last category. For Slovak Telekom and T-Mobile Czech Republic, it built the operator-side interfaces to internal operator systems that feed Deutsche Telekom's CAMARA / Open Gateway APIs exposed via Aduna. It is not a NatCo or an aggregator and does not sell API access.

Slovakia and the Czech Republic

The programme is coordinated at Deutsche Telekom group level, with group teams running the exposure platform and Aduna onboarding; instarea's delivery was local, for the Slovak and Czech operator teams and legal entities. Other operator groups in the region run their own Open Gateway programmes, and API availability changes often, so check the operator's or aggregator's current catalogue.

What operator-side integration involves

1. Initiation with the group programme — scope, APIs, legal entity.
2. Analysis and detailed design aligned with the group's exposure architecture: which internal system answers which API field, and what happens when data is missing.
3. Onboarding to the exposure platform — certificates, OAuth 2.0 configuration, endpoints.
4. Building the interfaces (resolvers) to operator systems, with standard errors (RFC 7807), correlation IDs, structured logging and tests.
5. Registration, CI/CD and rate limits on the group platform.
6. Testing — end-to-end, security (mutual TLS) and billing verification.
7. Pilot with a first service provider, performance baseline, technical go-live and an operations runbook.

Timeline. Duration depends mostly on access to internal systems and on internal approvals (security, data protection, legal), not on the API code. Plan in months, not weeks, per operator.

Privacy, consent and legal basis

• Data minimisation. KYC Match returns only match results, never the stored personal data. SIM Swap answers about a recent change, not the subscriber's history.
• Consent where needed. KYC Fill-in returns verified attributes only with the customer's consent; CAMARA's OAuth 2.0 / OpenID Connect flows allow consent to be captured where the law requires it.
• Legal basis per API and use case. In the EU: the GDPR and the ePrivacy rules on traffic and location data. The operator's data-protection team typically completes a DPIA per API; the integrator supplies technical input.
• Security between platforms. Mutual TLS, scoped OAuth 2.0 tokens, rate limiting and full request traceability.

FAQ

Sources

• CAMARA project on GitHub — https://github.com/camaraproject (API repositories e.g. NumberVerification, SimSwap, KnowYourCustomer)
• CAMARA project website — https://camaraproject.org
• GSMA Open Gateway — https://www.gsma.com/solutions-and-impact/gsma-open-gateway/
• Aduna — https://adunaglobal.com
• Ericsson: completion of the Vonage acquisition (2022) — https://www.ericsson.com/en/press-releases/2022/7/ericsson-completes-acquisition-of-vonage
• Nokia Network as Code — https://www.nokia.com/programmable-networks/network-as-code/
• Directive 2002/58/EC (ePrivacy), Articles 6 and 9 — https://eur-lex.europa.eu/eli/dir/2002/58/oj

More on the operator-side interfaces built for Slovak Telekom and T-Mobile CZ: https://instarea.com/products/camara-network-api