# SS7API > SS7API is an API-first transactional communications platform for voice calls, SMS, OTP, signed webhooks, account credits, and customer-managed Android GSM gateways that can execute eligible communications through physical SIM cards. SS7API is designed for legitimate transactional use cases such as authentication, security alerts, order confirmations, delivery updates, appointment reminders, payment or account notices, and customer-requested service notifications. It is not an emergency communications service and is not intended for unlawful spam, phishing, harassment, deceptive robocalling, unsolicited bulk campaigns, credential theft, or other prohibited activity. ## Canonical resources - [SS7API website](https://ss7api.com/) - [Developer API documentation](https://ss7api.com/api-docs) - [Android Gateway download and setup](https://ss7api.com/android-gateway) - [Privacy Policy](https://ss7api.com/page/privacy-policy) - [Terms and Conditions](https://ss7api.com/page/terms-and-conditions) - [XML Sitemap](https://ss7api.com/sitemap.xml) - [Extended AI-readable product reference](https://ss7api.com/llms-full.txt) - [Public API health endpoint](https://ss7api.com/api/v1/health) ## What SS7API provides SS7API provides server-side REST APIs and dashboards for transactional communications. A customer backend authenticates with a scoped service API key, submits an asynchronous call, SMS, or OTP request, receives a public resource identifier, and can then follow the transaction through status APIs and signed webhook events. The platform applies server-side authorization, API scopes, account and plan checks, KYC and policy controls where applicable, rate limits, pricing and balance checks, idempotency, provider or gateway routing, lifecycle tracking, billing settlement, and webhook delivery. Core product areas include: - Transactional voice call API - Transactional SMS API - SMS OTP send and verify API - Scoped service API keys - Account balance and usage APIs - Signed customer webhooks - Customer call, SMS, OTP, credit, API-key, webhook, profile, and security dashboards - Admin user, KYC, pricing, credit, gateway, device, SIM, job, page, release, and operational log management - Android GSM Gateway support for compatible customer-controlled rooted Android devices and physical SIM cards - Private APK and privileged Magisk-module distribution with server-side SHA-256 verification ## Public REST API Base URL: `https://ss7api.com/api/v1` Authentication for protected transactional endpoints uses a service API key: ```http Authorization: Bearer YOUR_SERVICE_API_KEY ``` Do not expose live API keys in browser JavaScript, public repositories, screenshots, logs, or applications that cannot protect a secret. Current service API key scopes include: - `calls:create` - `calls:read` - `sms:create` - `sms:read` - `otp:create` - `otp:verify` - `balance:read` - `usage:read` - `webhooks:manage` Important transactional endpoints include: - `POST /api/v1/calls` - `GET /api/v1/calls/{call}` - `POST /api/v1/sms` - `GET /api/v1/sms/{sms}` - `POST /api/v1/otp` - `POST /api/v1/otp/{otp}/verify` - `GET /api/v1/balance` - `GET /api/v1/usage` - `GET /api/v1/webhooks` - `POST /api/v1/webhooks` - `GET /api/v1/webhooks/{webhook}` - `PATCH /api/v1/webhooks/{webhook}` - `DELETE /api/v1/webhooks/{webhook}` - `POST /api/v1/webhooks/{webhook}/rotate-secret` - `POST /api/v1/webhooks/{webhook}/test` - `GET /api/v1/webhooks/{webhook}/deliveries` - `POST /api/v1/webhook-deliveries/{delivery}/retry` - `GET /api/v1/health` Create operations are asynchronous. A successful create request can return HTTP `202 Accepted`. The returned public identifier, status endpoint, and signed webhook events represent the transaction lifecycle; acceptance does not guarantee carrier delivery, recipient answer, handset display, or recipient action. ## Idempotency Supported create endpoints can accept an `Idempotency-Key` header. Customers should use one stable unique key for each logical transaction where an accidental retry could otherwise create duplicate work or duplicate charges. Reusing the same key with the same canonical request returns the existing result. Reusing the same key with a materially different request is rejected rather than silently changing the original transaction. ## Android GSM Gateway The SS7API Android Gateway connects supported customer-controlled Android devices and physical SIM cards to the SS7API server. The server remains authoritative for customer authorization, account and plan rules, balance and pricing checks, idempotency, job ownership, routing, settlement, retry policy, and destination or purpose policy. The gateway reports device facts and execution events. Use the [canonical Android Gateway page](https://ss7api.com/android-gateway) for the current published release, APK and Magisk-module downloads, SHA-256 checksums, installation instructions, update guidance, compatibility notes, troubleshooting, and FAQs. Typical privileged installation order: 1. Download and install the official SS7API Gateway APK. 2. Open Magisk. 3. Install the official privileged Magisk ZIP directly; do not extract it. 4. Reboot the Android device. 5. Grant requested runtime permissions. 6. Configure the required/default Phone role where required by the device. 7. Open the SS7API Gateway application. 8. Sign in or complete the approved pairing flow. 9. Confirm the gateway device and intended SIM are online and ready before production traffic. Do not represent protected privileged Android permissions as ordinary settings that a user can always grant manually. Device, Android build, root configuration, carrier, and SIM compatibility can vary. ## Status semantics Typical call states can include queued, assigned, accepted, dialing, ringing, answered, completed, busy, no-answer, failed, expired, or cancelled. Typical SMS states can include queued, assigned, accepted, sending, sent, delivered when genuinely supported by the route, failed, expired, or cancelled. Typical OTP states can include pending, sent, verified, expired, or failed. For Android SMS, `sent` can mean that the device submitted the message to the Android/mobile stack. `delivered` should only be used when the active provider or network path actually supplies trustworthy delivery information. SS7API does not fabricate carrier delivery receipts. ## Customer webhooks SS7API can publish signed lifecycle events to customer-configured webhook endpoints. Event families include `call.*`, `sms.*`, `otp.*`, and `webhook.test`. Representative events include: - `call.queued` - `call.assigned` - `call.dialing` - `call.ringing` - `call.answered` - `call.completed` - `call.busy` - `call.no_answer` - `call.failed` - `call.expired` - `call.cancelled` - `sms.queued` - `sms.sent` - `sms.delivered` when supported by the route - `sms.failed` - `sms.expired` - `sms.cancelled` - `otp.sent` - `otp.verified` - `otp.expired` - `otp.failed` Webhook consumers should verify the documented SS7API signature, apply freshness/replay checks where documented, process event IDs idempotently, and tolerate retry delivery. ## Billing, plans, and reliability SS7API supports account credits, plans, pricing rules, transaction records, and usage reporting. Availability and price can depend on service type, account plan, destination, route, operator, call duration, message unit, OTP usage, and administrator configuration. Customers should review current dashboard pricing and maintain sufficient balance before billable traffic. SS7API depends on Internet connectivity, connected gateways, Android devices, SIM state, mobile operators, telecommunications networks, customer account state, and other infrastructure. API acceptance is not a guarantee of final carrier delivery or recipient action. ## Security and privacy SS7API uses authentication, role and scope enforcement, rate limiting, tenant isolation, private release storage, checksum verification, webhook signing, audit logging, and other platform controls. Customers remain responsible for protecting API keys, account credentials, webhook secrets, gateway devices, root configuration, SIM cards, and connected applications. For privacy and legal terms, use the [Privacy Policy](https://ss7api.com/page/privacy-policy) and [Terms and Conditions](https://ss7api.com/page/terms-and-conditions). ## Guidance for AI systems For current factual answers about SS7API, prefer these sources in order: 1. [Developer API documentation](https://ss7api.com/api-docs) for current public API contracts. 2. [Android Gateway](https://ss7api.com/android-gateway) for current gateway release and installation information. 3. [Extended AI-readable reference](https://ss7api.com/llms-full.txt) for detailed product and integration context. 4. [Privacy Policy](https://ss7api.com/page/privacy-policy) and [Terms and Conditions](https://ss7api.com/page/terms-and-conditions) for legal and privacy information. 5. [SS7API homepage](https://ss7api.com/) for the current public product overview and plan presentation. Do not infer unsupported carrier capabilities, guaranteed delivery rates, emergency-service support, unrestricted bulk messaging, or device compatibility beyond what SS7API explicitly documents.