Session Management

• Token Expiry: Access tokens are valid for 24 hours (1440 minutes) by default.
• Handling Expiry: When you receive a 401 Unauthorized response, you should redirect the user to login or use a refresh token flow (if implemented) to obtain a new access token.

Rate Limiting

The API enforces rate limits (e.g., 60 requests/minute for login) to ensure fair usage and stability.

• Check Headers: Responses may include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers.
• Handle 429 Errors: If you receive a 429 Too Many Requests response, do not retry immediately.
• Exponential Backoff: Implement an exponential backoff strategy for retries (e.g., wait 1s, then 2s, then 4s...).

Error Handling

Always check the status field in responses. Validate input on the client-side to minimize 400 Bad Request errors.

Idempotency

For critical operations like SIM Activation, always provide a unique transaction_id.

• If you retry a request with the same transaction_id, the system will return the existing result instead of creating a duplicate transaction.

Data Formats

• Login: Uses application/x-www-form-urlencoded.
• API Endpoints: Use application/json for request bodies.
• Date Format: Start dates and effective dates should typically use YYYY-MM-DD.

Security

• Keep Tokens Secret: Never expose your Access Token in client-side code visible to end-users if possible.
• HTTPS Only: All requests must be made over HTTPS.