Account takeover protection documentation

Account Takeover Protection (ATP) / SIM Swap

KPN currently supports Account Takeover Protection following the SIM Swap Specification V0.

API specification

Test the API on SwaggerHub

Sim swap API

The sim swap API enables a service to be initiated even when the user is not interacting with a Service Provider. Access Tokens are requested using Client Id and Client Secret. The Access Token is valid for a limited time period and is not tied to a specific user. So, one Access Token can be used for several resource requests, as long as the validity period of the Access Token has not expired. The Resource Request specifies for which user (MSISDN or phone number) the ATP data should be retrieved.

Flow Diagram

Getting started

Make sure you've read What's in it for you for more info on how to register and start testing APIs.

Authentication

The API follows the KPN Store API Authentication Standard to secure the API. It includes the use of OAuth 2.0 client_id and client_secret to receive an access token.

Go to the Authentication tab on top of this page to find out how to:

• Authenticate to an API using cURL.
• Authenticate to an API on Swaggerhub.
• Import Open API Specifications (OAS), also called Swagger files into Postman.

Resource Request

In below examples the Access Token obtained is used as bearer token for request authorization. For Sim Swap the POST method should be used,with the phone number in the body of the request.

The Resource Request has the following URL

POST https://api-prd.kpn.com/kpn/sim-swap

Request Header

      Authorization	ON format
      
        Code copied
        
            
      

{
  "phoneNumber": "+346661113334"
}

The response body for ATP contains a time stamp when the last sim change occurred.

      Response
      
        Code copied
        
            
      

{
  "latestSimChange": "2023-10-29T17:38:22.306Z"
}

In case there is an error; you will see for example the following information in the response body:

      Response
      
        Code copied
        
            
      

{
  "status": 400,
  "code": "INVALID_ARGUMENT",
  "message": "Client specified an invalid argument, request body or query param"
}

Error codes

Below are the most common error codes that you may encounter using the service.