Ready-to-use Postman collections for channel partners who want to test TMF onboarding and the SEP
(CAMARA) APIs without writing any integration code first. Download the collection for the flow you need,
import it into Postman, fill in your own credentials, and run the requests.
The SEP CAMARA API collections below are pre-configured for Germany staging
(https://stg.api.telekom.com) as the entered environment.
If you want to test against production or a different country,
you only need to change the single base_url collection variable — see
Endpoints for the full list of staging/production
base URLs per country. Every other request in the collection is built from that one variable, so
there is nothing else to update. The TMF Onboarding collections work the same way.
Private Key JWT (private_key_jwt) is recommended and will become mandatory in
the future. Both authentication methods are available where the grant protocol supports them. JWT Bearer
requires private-key signing, so it only appears under Private Key JWT. Choose the matching
expandable area for your authentication method. Private Key JWT collections require:
client_id — your application's client ID
private_key — your own PKCS8 PEM RSA private key (replace the placeholder text)
kid — optional, only needed if your JWKS contains more than one key
Client Secret collections require client_id and client_secret; CIBA uses them
as HTTP Basic authentication at /bc-authorize and /token. Signing happens entirely
inside the applicable Private Key JWT collection's Postman scripts using pure JavaScript — no external tools
or plugins required. See Auth and Consent
for background on private key JWT and grant types, and Endpoints
for the underlying base URLs, token endpoint, and test phone numbers these collections use as sample data.
For Authorization Code collections, one step must happen outside Postman: opening the
authorize URL in a browser, completing consent, and pasting the returned code into the
collection's auth_code variable. This is called out in that request's description.
CIBA collections poll automatically once you run the backchannel authorize request.
Each card below shows which countries currently allow that API/grant-type combination per the product
catalog — a collection is still provided even where no country currently allows it, for testing against
your own OAuth deployment. The TMF Onboarding collections create a real Application
Owner, Application and Product Order against the TMF platform — there is no sandbox/dry-run mode, so
only run them with values and a product_offering_id you're actually ready to use.
One Application can only ever be ordered for one version of a given API. Sim Swap v1
and Sim Swap v2 (or KYC Match v0.2, v0.3 and v0.4) cannot both be ordered onto the same Application — see the
Onboarding Guide. If a client_id/
private_key pair (or the matching client-secret credentials) was provisioned for one version, using it against the other version's
collection will fail with 401 UNAUTHENTICATED (InvalidClaim) even though the credentials
are otherwise valid and correctly entered — that's expected, not a bug in the collection. This also
applies to the All-in-One collection below: its shared client_id/
private_key only work for the API versions your Application actually ordered — skip the
folders for API versions you didn't order, or swap in the matching credentials before running them.
Runs the full TMF931 onboarding flow: create an Application Owner, create an Application, and submit a Product Order. Includes order-status lookup, Get Application by ID with credential capture, and optional updates to the application's JWKS URI and redirect URL. To manage an existing application, set app_id and run the token request followed by the lookup or update request.
Returns the subscriber's identity/address details already known to the operator, to pre-fill a form. The subscriber is identified via the access token, not a request body field.
Private Key JWT (recommended)
JWT Bearer
JWT Bearer
Not currently listed for any country in the product catalog.
All-in-One (every API and grant type in a single collection)
This Private Key JWT collection combines every SEP CAMARA API above into one collection, organized as one folder per API with a
sub-folder for every grant type variant built for that API (JWT Bearer, then CIBA, then Authorization
Code, in that order, whichever exist) — fill in client_id, private_key and
optionally kidonce at the top of the collection's Variables tab, and
every folder and sub-folder reuses those same shared credentials, so there's nothing to re-enter per
API or per grant type. Everything else (scope, phone numbers, and other per-API/per-grant parameters)
is namespaced per sub-folder with working defaults already filled in.
Download the collection file for the API and grant type you want to test.
In Postman: File → Import and select the downloaded .postman_collection.json file.
Open the collection's Variables tab and fill in client_id plus private_key (and kid if your JWKS has more than one key), or client_id plus client_secret for a Client Secret collection. Private Key JWT is recommended.
Leave base_url as Germany staging, or change it to production/another country per the Endpoints page.
Run the requests in order, top to bottom. Token requests automatically capture the access token into a collection variable for the requests that follow. For the TMF Onboarding collections, IDs from each step (owner_id, app_id, order_id) are captured automatically too.
For questions contact the MACE team. Client IDs, client secrets, private keys and offer IDs are shared/generated separately during onboarding — never embedded in these collections.