What it does?

The Number Verification API allows to check if the provided mobile phone number is the one actually used in the device. The service verifies that the user is using a device with the same mobile phone number as the one which is declared for this user. It also makes it possible for the application consuming this API to get the number itself by returning the phone number associated with the authenticated user’s access token.

As the Number Verification API uses the Orange mobile network, it offers strong authentication with enhanced security with minimum user friction.

What is the difference with Number Verify (MSISDN Match) France?

From a functional scope both APIs offer the same capabilities. These 2 APIs are based on 2 distinct standards (Mobile Id for Number Verify, CAMARA for Number Verification). As explained on the CAMARA page, this initiative aims at defining service APIs by combining network APIs, over an operator domain. It means that the CAMARA API scope will go beyond identity scope, and these APIs could globally be used in another context than Fraud Detection & Prevention.

How it works?

The API is used by an application to get information about a mobile line phone number. It can be easily integrated and used through this secured API and allows Service Providers to get this information easily and securely. The API manages 2 resources answering 2 distinct questions:

Is the user input phone number the actual number associated with the mobile line?
What is the phone number associated with an access token?
The following diagram provides a high-level view of the API architecture:

Verify Operation

Verifies if the provided phone number (plain text or hashed format) matches the one that the user is currently using. The API returns true/false depending on if the input matches the authenticated user’s device phone number associated with the access token.

Request phone number verification

Request
Using plain text phone number:

curl -X POST "https://api.orange.com/camara/ofr/number-verification/v0/verify"
-H "Authorization: Bearer {your access token}"
-H "Cache-Control: no-cache"  
-H 'accept: application/json'
-H 'Content-Type: application/json'
-d  '{
"phoneNumber": "+33612345678"
}

Using hashed phone number:

curl -X POST "https://api.orange.com/camara/ofr/number-verification/v0/verify"
-H "Authorization: Bearer {your access token}"
-H "Cache-Control: no-cache"  
-H 'accept: application/json'
-H 'Content-Type: application/json'
-d  '{
"hashedPhoneNumber": "32f67ab4e4312618b09cd23ed8ce41b13e095fe52b73b2e8da8ef49830e50dba"
}

Fields description

Regular phoneNumber (phoneNumber) must be passed in E.164 format (starting with country code). Prefixed with ‘+’.
Hashed phoneNumber (hashedPhoneNumber) must be a SHA-256 (in hexadecimal representation) of the mobile phone number in E.164 format (starting with country code and prefixed with +)

Response

200 
Content-Type: application/json
{
  "devicePhoneNumberVerified": true
}

Fields description

The response features only one attribute: devicePhoneNumberVerified.

This attribute is boolean indicating if a phone number provided corresponds to the one associated with the access token.

Return phone number Operation

Returns the phone number associated with the access token so the API clients can verify the number themselves.

Request phone number

Request

curl -X GET "https://api.orange.com/camara/ofr/number-verification/v0/device-phone-number"
-H "Authorization: Bearer {your access token}" 
-H 'accept: application/json'
Response
200 
Content-Type: application/json
{
    "devicePhoneNumber": "+33612345678"
}

Fields description

The response features devicePhoneNumber - In order to be globally unique it is formatted in international format, according to E.164 standard, prefixed with ‘+’.