Intel · 2026-04-16
Carrier Monetization of Identity Signals: GSMA Open Gateway and CAMARA
By J. W. Bouckaert
Carriers are selling identity signals as APIs
For years, carriers earned money from identity mainly by delivering one-time passcodes over SMS. They now also sell the identity data their networks hold, such as whether a SIM was recently changed or whether a device is using the number it claims, as standardized APIs.
The GSMA reported in March 2026 that 86 operator groups, representing more than 300 networks and 80% of mobile connections worldwide, had joined its Open Gateway initiative, and that more than 300 instances of 20 different CAMARA APIs had launched commercially in 65 markets. This article covers how that happened, the revenue forecasts, the main carrier programs, and what it means for companies that buy or resell these signals.
Open Gateway and CAMARA
The GSMA launched Open Gateway at MWC 2023 with eight network APIs. The API definitions come from CAMARA, an open-source project under the Linux Foundation. Before CAMARA, each carrier exposed its data through its own API with its own format and authentication, so a developer who integrated one carrier's SIM swap check had to start again for the next. With CAMARA, the same API definition applies across carriers that implement it.
Open Gateway also gave carriers distribution. The GSMA counts more than 60 channel partners, including cloud providers and communications platforms, that resell the APIs to developers.
Identity-related CAMARA APIs
| API | What it answers |
|---|---|
| Number Verification | Whether the device making the request is using the phone number it claims, without sending an SMS |
| SIM Swap | Whether, or when, the SIM for a number last changed |
| Device Swap | Whether the number recently moved to a different device |
| KYC Match | Whether customer details match what the carrier holds for the number |
| Number Recycling | Whether a number has been reassigned to a new subscriber since a given date |
Availability of each API varies by carrier and country.
Revenue forecasts
Juniper Research has published two forecasts that measure different things:
- In August 2025, it forecast operator revenue from network APIs of $284 million in 2025, rising to more than $8 billion in 2030, and named KYC as the next major opportunity.
- In March 2025, it forecast revenue from mobile identity APIs of $2.4 billion in 2025, rising to $22 billion in 2029, more than half of all mobile identity revenue by then.
The first counts what operators earn from network APIs. The second covers the wider mobile identity API market. Neither is a measure of revenue already reported by carriers.
Carrier programs
Telefónica
Telefónica's Open Gateway portal offers SIM Swap and Number Verification, with a sandbox for testing. At MWC 2026 it announced further Open Gateway agreements with technology companies.
Deutsche Telekom
At MWC 2026, Deutsche Telekom's T-Wholesale and Google presented phone number verification that works over Wi-Fi and in airplane mode. Earlier network-based number verification needed the device to be on the cellular network.
AT&T, T-Mobile and Verizon
On 27 February 2025, AT&T, T-Mobile and Verizon announced that they would offer network APIs together through Aduna, a company formed by Ericsson and a group of operators, starting with Number Verification and SIM Swap.
Orange
Orange offers identity and fraud prevention APIs through its developer portal.
AI agents as API callers
The GSMA reported that Telefónica and Nokia have piloted agent-to-agent interactions using the Model Context Protocol (MCP), in which an AI agent discovers and calls network APIs. Juniper Research forecast in April 2026 that agentic commerce will reach $1.5 trillion by 2030. Agents that act on accounts tied to phone numbers are likely to need the same SIM-swap and number checks that human sign-ins use.
Effects on buyers and resellers
Companies that only resell carrier APIs
When carriers sell the same standardized APIs through cloud providers and their own portals, a company whose product is access to those APIs competes on price with the carriers' own channels.
Companies that add something on top
A carrier API answers one question about one number. Buyers get more from a provider that combines that answer with other signals, records it in an audit log, and lets them act on it, for example by revoking an AI agent's delegation when a SIM swap is reported.
Risks to plan for
- Personal data. The carrier still processes the phone number to answer, so each call is personal data processing, and possibly a cross-border transfer.
- Availability. Carrier APIs have outages and maintenance windows, so a check needs a defined behavior when the API does not answer. See circuit breakers for identity pipelines.
- Coverage and consistency. Not every carrier offers every API, and implementations differ in how current their data is and how they report errors.
PasskeyBridge's role
PasskeyBridge sells identity signals as a service. Its carrier lookups ask one provider per request: Vonage or Twilio on PasskeyBridge's accounts as a hosted add-on, or Vonage Identity Insights or Sinch Number Lookup under the tenant's own account. The result enters the same signal pipeline as passkey and verifiable credential signals, and is recorded in a hash-chained audit log. A reported SIM swap revokes the affected AI agent delegations. Phone numbers are stored only as keyed HMAC-SHA-256 digests.
---
See the API documentation.