TMF931 Onboarding and Ordering
Enables Channel Partners and Marketplace providers to efficiently manage service onboarding and order execution
Introduction
The TMF 931 Onboarding and Ordering API enables Channel Partners and Marketplace providers to efficiently manage service onboarding and order execution through a flexible, operate-first interface.
Subscribe to the API
Due to the nature of the TMF 931 Onboarding and Ordering API, subscription cannot be completed through a self-service process like other APIs available on Orange Developer. Instead, please contact the Orange Developer team by using the "Contact us" button at the top of this page. When reaching out, kindly specify the reason for your request and how you intend to use this API. Our team will then guide you through the necessary steps to gain access.
API Authentication
HTTPS requests to the REST API are protected with 2-Legged OAuth. To learn more about how Orange Developer handles authentication, please refer to our documentation.
In short, you will use your Orange Developer Authorization header as authorization_header for the Basic authentication with Orange Developer.
curl -X POST \
-H "Authorization: {{ authorization_header }}" \
-d "grant_type=client_credentials" \
https://api.orange.com/oauth/v3/token
In response, you will get an access_token.
{
"token_type": "Bearer",
"access_token": "66AeYJF8eJQ...2SjkFg9LB1LePC",
"expires_in": 3600
}
API Description
See the TMF 931 Onboarding and Ordering API documentation
Data Required for TMF931 API Integration
GDPR Note
Some data properties used in Onboarding API operations become mandatory if the provisioned API Products implies end-users of Telecom Services based on the European Union.
Application Owner
Required data
| Description | Field | Comment |
|---|---|---|
| Name of the legal representative for the company | ApplicationOwner.name | Mandatory |
| Name of the company | ApplicationOwner.engagedParty.name | Mandatory |
| Name that the company trades under | ApplicationOwner.engagedParty.tradingName | Mandatory |
| Tax number of the company | ApplicationOwner.engagedParty.taxNumber | Mandatory |
| Type of organization. W3C types of organizations catalogue | ApplicationOwner.engagedParty.organizationType | Mandatory |
| Company legal identifier | ApplicationOwner.engagedParty.organizationIdentification.identificationId | Optional |
| Authority which has issued the identifier | ApplicationOwner.engagedParty.organizationIdentification.issuingAuthority | Optional |
| Type of identification information used to identify the company | ApplicationOwner.engagedParty.organizationIdentification.identificationType | Optional |
| The legal address of the company | ApplicationOwner.engagedParty.registeredGeographicAddress | Mandatory |
| Company contact information | ApplicationOwner.engagedParty.contactMedium | Mandatory |
Additional required data for GDPR
| Description | Field | Comment |
|---|---|---|
| Contact information for the exercise of data protection rights | ApplicationOwner.engagedParty.privacyManager or ApplicationOwner.engagedParty.dataProtectionOfficer | Mandatory - must be in one or another of the 2 fields |
| Contact information for the company DPO/Privacy | ApplicationOwner.engagedParty.privacyManager or ApplicationOwner.engagedParty.dataProtectionOfficer | Mandatory - must be in one or another of the 2 fields |
| Legal representative of the company | ApplicationOwner.engagedParty.legalRepresentative | Mandatory |
| Data of the company’s representative in the UE (if available) | ApplicationOwner.engagedParty.localRepresentative | Optional |
| Company privacy url | ApplicationOwner.engagedParty.privacyPolicyURL | Providing a company privacy url is mandatory but could be passed here or in Application.privacyPolicyURL |
Application
Required data
| Description | Field | Comment |
|---|---|---|
| Application name | Application.name | Mandatory |
| Application commercial name | Application.commercialName | Mandatory |
| Application description | Application description | Mandatory |
| Category of the application (like finance, mapsAndNavigation, productivity, socialNetworkingAndCommunications, etc..) | Application.category | Mandatory |
| Jwks uri if needed | Application.jwksUri | (Technical requirement from CAMARA API) Needed for CIBA flow |
| Redirect uri if needed | Application.redirectUrl | (Technical requirement from CAMARA API) Needed for Authorization Code flow |
Additional required data for GDPR
| Description | Field | Comment |
|---|---|---|
| Link to application privacy Policy | Application.privacyPolicyURL | Providing a privacyPolicyURL is mandatory but could be provided in this attribute or in ApplicationOwner.engagedParty.privacyPolicyURL |
| Request Contact to provide users with the ability to delete or modify their own data. | Application.privacyRightsRequestContact | Mandatory |
ApiProductOrder
Required data
| Description | Field | Comment |
|---|---|---|
| Id of the product to subscribe (provided by Orange) | ApiProductOrderItemAdd.productOffering.id | Mandatory |
Additional required data for GDPR
| Description | Field | Comment |
|---|---|---|
| Explicit Terms and Conditions acceptance for the Product | ApiProductOrderItemAdd.approvedProductOfferingTermOrCondition | Mandatory |
| Explain the reason justifying the purpose | ApiProductOrderItemAdd.approvedProductOfferingTermOrCondition.purposeReason | Mandatory |
| Legal Basis based on W3C Data Privacy Vocabulary v2 (enum) (legitimate interest, explicit consent, etc…) | ApiProductOrderItemAdd.approvedProductOfferingTermOrCondition.applicationLegalBasisForInputData | Mandatory |
| Country or countries to which the data will be stored | ApiProductOrderItemAdd.approvedProductOfferingTermOrCondition.process.dataExportStorageCountry.countryCode | Mandatory |
| Country or countries to which the data will transit | ApiProductOrderItemAdd.approvedProductOfferingTermOrCondition.process.dataExportTransitCountry.countryCode | Mandatory |
| Screenshots of Application UX | ApiProductOrderItemAdd.approvedProductOfferingTermOrCondition.userConsentScreenshot | Mandatory |
| Processing operations of the “Processing” catalog of the DPV WC3 (enum) (ex: store, use, analyse, match, etc…) | ApiProductOrderItemAdd.approvedProductOfferingTermOrCondition.process.processingOperation | Mandatory |
| Processing context derived from the "Context of processing" catalogue of the DPV WC3 v2 standard (enum) (ex: AlgorithmicLogic, DecisionMaking, EvaluationScoring, ConditionalAutomation, etc.) | ApiProductOrderItemAdd.approvedProductOfferingTermOrCondition.process.context.processingContext | Mandatory |
| Duration of treatment derived from the “Duration and frequency” catalogue of the DPV WC3 v2 standard (enum) (Ex: endlessDuration, FixedOccurrencesDuration, TemporalDuration, etc…) | ApiProductOrderItemAdd.approvedProductOfferingTermOrCondition.process.duration | Mandatory |
| Frequency of treatment derived from the “Duration and frequency” catalogue of the DPV WC3 v2 standard (enum) (Ex: ContinuousFrequency, OftenFrequency, SingularFrequency, SporadicFrequency) | ApiProductOrderItemAdd.approvedProductOfferingTermOrCondition.process.frequency | Mandatory |