Changelog
Every change to the API is listed here, newest first. While the API is in preview, paths and fields can still change.
2 October 2026: v1 preview, update 1
Section titled “2 October 2026: v1 preview, update 1”Changes made after the first round of testing. If you started building against the first preview, read this list.
New
GET /v1/esims/{iccid}/topupslists the top-ups of an eSIM, andGET /v1/topups/{id}fetches one. Sandbox top-ups are stored too.- Every Event has a
sequencenumber. Order events by it. - Every Order has
items, a list of{ package_id, quantity }. - New error codes:
404 topup_not_foundand, in the sandbox,409 invalid_state. - The sandbox
customer_reftriggers now work on top-ups as well. balance.lowis now sent in the sandbox too, against the virtual balance and the threshold from Settings.- Requests refused with
401because the key was revoked or has expired now appear in your request log.
Changed
- Region codes from
GET /v1/countriesare nowregion-and a number. The old codes are still accepted byGET /v1/packages?region=. - On an order that holds several packages, the top-level
package_idandquantityarenull. This can only happen to orders placed in the Business portal. - The first delivery attempt of a webhook is made at once, and an endpoint gets one request at a time, in
sequenceorder. - A top-up with a package that is not one of the eSIM’s top-up packages now answers
404 package_not_foundin both modes. Listing top-up packages for an expired or cancelled eSIM answers409 esim_not_topupablein both modes. - The sandbox balance starts at 1000000.00 INR and refills below 10000.00 INR.
- The sandbox simulate endpoint follows the life of a real eSIM:
activatedfirst, then usage, thenexpired. A repeated event changes nothing and sends no webhook. low_balance_thresholdisnulluntil you set a threshold. There is no built-in default.- After a completed top-up,
esim.usage_80andesim.usage_100can be sent again. created_afternow includes its own instant.created_beforestill does not.- Cursors only work on the list and the kind of key they came from.
- Text with control characters is refused with
400. Lengths are counted in characters. - A body that is not valid JSON, or is larger than 64 KB, is answered with the normal error body.
- Only accepted requests are remembered for an
Idempotency-Key. After an error the same key runs the request again.
Documentation
- The Topup object lists
customer_ref,balance_afterand all three statuses. order.completedis documented as covering partially completed orders.503 supplier_unavailableis documented as a sandbox response.- The webhook verification samples are stricter: they reject a header that is not exactly in the documented form, and an empty secret.
- The Postman collection has its environment file linked, and the walkthrough runs from start to finish.
2 October 2026: v1 preview
Section titled “2 October 2026: v1 preview”The first preview of version 1.
Endpoints
- Catalogue:
GET /v1/countries,GET /v1/packages,GET /v1/packages/{id}. - Balance:
GET /v1/balance. - Orders:
POST /v1/orders,GET /v1/orders/{id},GET /v1/orders. - eSIMs:
GET /v1/esims,GET /v1/esims/{iccid}. - Top-ups:
GET /v1/esims/{iccid}/topup-packages,POST /v1/esims/{iccid}/topups. - Events:
GET /v1/events,GET /v1/events/{id}. - Sandbox:
POST /v1/sandbox/esims/{iccid}/simulate.
Platform
- Test and live API keys, created in the Business portal under Developers. Keys can be rolled with a 24-hour overlap and limited to an IP allowlist.
- A sandbox with a virtual balance,
customer_reftriggers for failures, and simulated eSIM events. - Required
Idempotency-Keyon everyPOST, with theIdempotent-Replayedresponse header. - Rate limits of 120 requests a minute and 30
POSTrequests a minute for each key, withX-RateLimit-*headers. - Webhooks for
order.completed,order.failed,esim.activated,esim.usage_80,esim.usage_100,esim.expired,topup.completedandbalance.low, signed with HMAC-SHA256 in theX-Esimify-Signatureheader. - A delivery log, manual retry and a test
pingevent in the portal.
Changes from the earlier preview docs
- Package ids are now
pkg_and a number, such aspkg_10482. - The webhook signature is now
t=<timestamp>,v1=<signature>, computed over the timestamp, a dot and the raw body. The earlier docs showed a signature over the body alone. - The event body now includes
mode, anddatafor order events is the full Order object. Idempotency-Keyis now required on everyPOST.- Error bodies and identifiers now use the formats in the reference.
Documentation
- A full reference with a page for each resource, an OpenAPI description, a Postman collection and its environment file.

