Onboarding Guide for Channel Partners
This guide is for channel partners who are completely new to Telekom SEP, TMF and CAMARA. Read it top to bottom and you'll know everything you need to onboard via TMF and start calling the SEP CAMARA service APIs. It links out to the dedicated Endpoints, Authentication and Postman Collections pages for the technical details, so this page stays short.
1. What is TMF?
TMF (TM Forum) is the onboarding and ordering API used to register your organization and request access to specific SEP CAMARA APIs before you can call them. It has four layers, from top to bottom:
Channel Partner — your organization, identified by the TMF client ID/credentials you're issued.
Application Owner — the legal entity/team that owns an application (a party role under your Channel Partner).
Application — the technical integration itself (holds your JWKS URI and redirect URL, and gets its own client ID/secret for calling service APIs).
Product Order — a request to grant one specific SEP CAMARA API ("product") to one Application.
Official reference: TMF931 — Open Gateway Onboarding and Ordering Component Suite (TM Forum).
2. What is CAMARA?
CAMARA is the open-source project that defines the actual service APIs you'll call once onboarded — KYC Match, Sim Swap, Number Verification, and others used in this platform. Official reference: camaraproject.org.
3. Onboarding Process
Step 1 — Send us your JWKS URI
To get started as a Channel Partner, send your JWKS URI to the email address provided by your account manager (internally referred to as "MBAPI Onboarding FMB"). This is required before we can issue your credentials.
Step 2 — You receive staging access
We provide you with a TMF staging client ID and the product offering ID(s) for the SEP CAMARA API(s) you want to test.
Step 3 — Build and test in staging
Create your Application Owner — auto-approved, usable immediately.
Create your Application — also auto-approved. You must provide the JWKS URI to be used by this application's service API calls. Only one version of a given API can be ordered per Application (e.g. you can't order both KYC Match v0.2 and v0.3 on the same Application).
Submit the Product Order for the offering ID you were given — this needs manual approval. Send an email to the account-manager-provided address ("MBAPI Onboarding FMB") whenever you create an order so we can check and approve it.
Once approved, test the service API. Staging and production use different endpoints, and TMF uses a different realm per country — see Endpoints. For how to authenticate (client secret vs private key JWT, grant types), see Authentication & Authorization.
Step 4 — You receive production access
After successful staging testing, we issue you a TMF production client ID.
Step 5 — Production Applications
You may create exactly one testing Application in production — its name must clearly declare that it is a testing application. Send a list of phone numbers to whitelist to the account-manager-provided address ("MBAPI Onboarding FMB"). For this one testing Application, we assume you already have consent to test with the numbers you provide.
For every other production Application, all legal/organization information must be filled out via TMF and approved through the standard process.
As in staging, email the account-manager-provided address ("MBAPI Onboarding FMB") whenever you create a Product Order so it can be checked and approved.
4. Quick Technical Pointers
Staging and production use different base URLs, and TMF uses a different realm per country — full reference on the Endpoints page.
Client authentication (client secret vs private key JWT) and all OAuth grant types (JWT Bearer, CIBA, Authorization Code, Client Credentials) are explained on the Authentication & Authorization page.
Ready-to-run Postman collections for TMF onboarding and every service API/grant type are on the Postman Collections page.