CAMARA is the Telco Global API Alliance, an open-source project hosted by the Linux Foundation that defines the mobile network's capabilities as OpenAPI specifications. It turns things only a carrier can know — whether a SIM was recently swapped, whether a phone number really belongs to the device calling you, where a device is, what quality of service it can be granted — into standard, documented HTTP contracts. It is the most significant industry-built API standard of the last decade, and it exists without any regulatory mandate behind it.
CAMARA
CAMARA is what the mobile industry built after admitting its previous attempts had failed. The GSMA’s own Head of Future Networks has described OneAPI, the earlier effort, as a spectacular failure, and named the change that mattered: the industry stopped writing specifications as documentation and started writing them as code, in public, on GitHub, under neutral governance.
- Specifications as code - Every CAMARA API is an OpenAPI document in a public repository, versioned, reviewable and forkable, rather than a PDF behind a membership wall.
- Linux Foundation governance - Neutral hosting deliberately separates the specification work from any single operator or vendor’s commercial interest.
- A distributed division of labour - CAMARA holds the API specifications, TM Forum holds the operational and fulfilment layer, and the GSMA holds interoperability and commercial evangelism through Open Gateway.
- Identity and network halves - The catalog splits between identity and anti-fraud verbs (Number Verification, SIM Swap, KYC Match, Device Swap, Scam Signal) and genuine network verbs (Quality on Demand, Carrier Billing, Device Location, Simple Edge Discovery).
- Consent designed in - The consent model records consent when it happens so it can be interrogated afterward, which is a deliberate answer to regulators the industry knows are watching.
- CIBA for authorization - Network-based authorization is specified through Client-Initiated Backchannel Authentication rather than a browser redirect, because the party being asked is a subscriber, not a session.
The gap between the specification and the endpoint is the thing to understand. Scoring the sector for The State of
Telecom APIs found the standard genuinely, freely downloadable — and every server declaration in it a template
variable, {apiRoot}, with an example.com placeholder for OpenID discovery. You can read the whole standard and
call none of it. Of thirty-six operators studied, twenty-six showed evidence of Open Gateway membership and exactly
one published a CAMARA contract a developer could download, price and call self-serve.
Referenced in API Evangelist papers
This standard shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this standard in the context of a real sector.
The State of Telecom APIs
Twenty-six of thirty-six operators show Open Gateway membership and exactly one publishes a CAMARA contract a developer can download, price and call self-serve — every other server declaration in the standard is the template variable {apiRoot}.
