Developers

IoT SIM API: quick start in 4 steps with cURL, Python and Node.js

REST and JSON. API keys issued instantly. Activate a SIM, read usage and register a webhook in under 10 minutes. Sandbox with simulated SIMs included.

Get a key with the trial kit Download the Postman collection

API at a glance

Base URL https://api.universalesims.com/v1

Auth Bearer API key per role; ue_test_ and ue_live_ prefixes

Format REST, JSON, OpenAPI 3.1

Rate limit 600 requests per minute per key

Bulk Up to 1,000 ICCIDs per lifecycle call

Webhooks 8 event types, HMAC-SHA256 signed, 5 retries

Sandbox 20 simulated SIMs per account

Tooling Postman collection, Python, Node.js and cURL snippets

The Universal eSIMs IoT SIM API is a REST and JSON interface at api.universalesims.com/v1 with keys issued instantly, 600 requests per minute per key, 12 core endpoints, 8 signed webhook event types and a sandbox with 20 simulated SIMs. Connectivity costs US$1.00 per active SIM per month plus US$0.004 per MB; the API itself is free.

Prices checked on 25 October 2026 · Inactive SIMs are free · No minimum order · Billed monthly in USD or INR

Quick start: key, activate, usage, webhook

Get an API key

Create an account, open Settings, API keys, and create a key scoped to a role. Keys are issued instantly. Use ue_test_ keys against the sandbox and ue_live_ keys against production.

Activate a SIM

POST /v1/sims/{iccid}/activate. The SIM becomes active within 60 seconds. Billing starts on the first data session, not on this call.

Read usage

GET /v1/sims/{iccid}/usage?from=YYYY-MM-DD returns daily MB, sessions, last network and country. GET /v1/usage returns the account pool. Data refreshes every 5 minutes.

Set a webhook

POST /v1/webhooks with a URL and event list. Verify the X-UE-Signature header (HMAC-SHA256 of the raw body with your webhook secret). We retry 5 times over 24 hours on non-2xx responses.

cURL

# 1. Get an API key from the console (issued instantly). 2. Activate a SIM. 3. Read usage. 4. Register a webhook.
curl -X POST https://api.universalesims.com/v1/sims/8991000012345678901/activate \
-H "Authorization: Bearer ue_live_your_key"

curl "https://api.universalesims.com/v1/sims/8991000012345678901/usage?from=2026-11-01" \
-H "Authorization: Bearer ue_live_your_key"

curl -X POST https://api.universalesims.com/v1/webhooks \
-H "Authorization: Bearer ue_live_your_key" -H "Content-Type: application/json" \
-d '{"url":"https://example.com/hooks/ue","events":["sim.usage_threshold","sim.imei_changed"]}'

Python

import requests

API = "https://api.universalesims.com/v1"
H = {"Authorization": "Bearer ue_live_your_key"}
iccid = "8991000012345678901"

requests.post(f"{API}/sims/{iccid}/activate", headers=H).raise_for_status()
usage = requests.get(f"{API}/sims/{iccid}/usage", headers=H, params={"from": "2026-11-01"}).json()
print(usage["total_mb"], usage["last_network"])

requests.post(f"{API}/webhooks", headers=H, json={
"url": "https://example.com/hooks/ue",
"events": ["sim.usage_threshold", "sim.geofence_breach"],
})

Node.js

Webhook payload example

{
"id": "evt_01J9",
"type": "sim.usage_threshold",
"created": "2026-11-03T08:14:22Z",
"data": {
"iccid": "8991000012345678901",
"group": "fleet-north",
"threshold_mb": 50,
"used_mb": 50.4,
"country": "IN",
"network": "Airtel"
}
}

Endpoints

Core API endpoints (v1)

Endpoint Purpose Notes GET /v1/sims List SIMs with status, group, last network and IMEI Paginated, 100 per page GET /v1/sims/{iccid} One SIM with diagnostics Includes last 10 sessions POST /v1/sims/{iccid}/activate Activate a SIM Billing starts on the first data session, not on activation POST /v1/sims/{iccid}/suspend Suspend data and SMS Suspended SIMs are inactive and free POST /v1/sims/{iccid}/resume Resume a suspended SIM Applies within 60 seconds POST /v1/sims/{iccid}/terminate Permanently retire a SIM Cannot be undone GET /v1/sims/{iccid}/usage Usage by day or by session Filter by date range and country GET /v1/usage Account usage and pool balance Updated every 5 minutes PUT /v1/sims/{iccid}/imei-lock Set or clear an IMEI lock Fires sim.imei_changed on mismatch POST /v1/sims/{iccid}/sms Send an A2P SMS to the device US$0.03 per message POST /v1/webhooks Register a webhook endpoint HMAC-SHA256 signed, retried 5 times over 24 hours GET /v1/coverage Networks by country and technology Public without a key

Webhook events: sim.attached, sim.detached, sim.usage_threshold, sim.geofence_breach, sim.imei_changed, sim.status_changed, account.pool_low, invoice.created.

Rate limits, sandbox and environments

Environments and limits

Item Production Sandbox Base URL https://api.universalesims.com/v1 https://sandbox.api.universalesims.com/v1 Key prefix ue_live_ ue_test_ Rate limit 600 requests per minute per key 120 requests per minute per key Bulk lifecycle 1,000 ICCIDs per call 100 ICCIDs per call SIMs Your ordered SIMs 20 simulated SIMs with scheduled events Billing Real None Webhook retries 5 over 24 hours 5 over 1 hour

Tooling

Postman collection

Every endpoint with sandbox and production environments. Download link published at launch.

OpenAPI 3.1

Generate clients in any language. Spec link published at launch.

SDK snippets

Python, Node.js and cURL on GitHub under MIT. Repository link published at launch.

What the API costs

Nothing. You pay for active SIMs and data. See the pricing page.

IoT SIM pricing by volume tier

Tier Active SIMs Per active SIM Per MB, pooled Inactive SIMs Contract Includes Next step IoT Go 1 to 999 active SIMs ₹89 ($1) per month US$0.004 Free None, cancel any time Global multi-IMSI SIM, platform, API, webhooks, email support Order online IoT Scale 1,000 to 10,000 active SIMs $0.60 per month US$0.0025 Free 12 months optional for a further 10% off Everything in Go plus pooled bundles, private APN, static IP, priority support Talk to us IoT Enterprise 10,000+ active SIMs Custom Custom Free Negotiated Everything in Scale plus eUICC profiles, SLA, dedicated manager, custom integrations Request a quote

Universal eSIMs vs Onomondo vs Pelion vs 1GLOBAL

What each provider publishes on its own website, observed October 2026. We publish every price, accept orders from 1 SIM and ship a 100MB trial against the 50MB that is standard elsewhere.

IoT connectivity providers compared, observed October 2026

Provider Prices on website Per SIM Per MB Minimums and tiers Trial API Partner programme Universal eSIMs Published US$1.00 (IoT Go), US$0.60 (IoT Scale) US$0.004 (Go), US$0.0025 (Scale) None, order 1 SIM online 5 SIMs, 100MB each, 30 days Public docs, sandbox, Postman Published reseller and API terms Onomondo Partly Not published €0.0025 to €0.003 pay-as-you-go Tiers quote-only Free sandbox Public API docs Three-tier programme, no numbers Pelion Not published Not published Not published Essentials, Professional, Enterprise by quote 5 eUICC SIMs, 50MB each, 30 days Portal and APIs, docs on request None found 1GLOBAL Not published Not published Not published Four models: World Plans, Pay-as-you-grow, Shared Bundle, Shared Flex Enterprise sales process API on request Enquiry only

Competitor details are as displayed on their public pages in October 2026 and change without notice. Where a provider publishes no price we say so rather than guess.

Technical specifics

API technical specifics

Item Detail Versioning Path versioned (/v1). Breaking changes get a new version with 12 months of overlap Idempotency Lifecycle calls are idempotent; Idempotency-Key header supported on POST Pagination Cursor based, 100 per page, cursors valid 24 hours Timestamps ISO 8601 UTC everywhere Errors JSON with type, message, request_id; standard HTTP codes TLS TLS 1.2 minimum, TLS 1.3 preferred IP allow-listing Optional per key Uptime target 99.9% per month, public status page

Security and compliance

These are commitments and a roadmap, stated plainly. We do not list certifications we do not yet hold.

Security and compliance commitments

Area What we do today Roadmap Data protection GDPR-compliant processing of connectivity metadata; data processing agreement available on request Data residency options in India and the EU planned for 2027 Information security Encrypted at rest and in transit; role-based access; audit log of every console and API action ISO 27001 certification is on our roadmap, target audit in 2027 API security Bearer keys scoped per role; HMAC-SHA256 signed webhooks; key rotation without downtime OAuth 2.0 client credentials for enterprise accounts Network security Data-only profiles; IMEI lock; APN restriction; private APN and IPsec on IoT Scale Private LTE breakout points in additional regions Availability Platform availability target 99.9% per month; public status page from launch Written SLA with service credits on IoT Enterprise Payload visibility We see ICCID, IMSI, network, timestamps and byte counts. We never see your device payload Unchanged

Developer questions

How quickly can I get API access?

Immediately. API keys are issued when you create an account. The REST API uses JSON, we publish a Postman collection, and there are snippets in Python, Node.js and cURL. A sandbox with simulated SIMs lets you test activation, usage and webhooks without hardware.

What are the API rate limits?

600 requests per minute per key on production and 120 per minute on the sandbox. Bulk endpoints accept up to 1,000 ICCIDs per call for activate, suspend and resume. Responses include X-RateLimit-Remaining and Retry-After headers. Enterprise accounts can request higher limits.

How does the sandbox work?

A sandbox account with 20 simulated SIMs is created with every account. Simulated SIMs generate usage, attach events and threshold alerts on a schedule so you can test webhooks end to end. Sandbox keys start with ue_test_ and never touch production SIMs or billing.

How are webhooks secured and retried?

Every delivery carries an X-UE-Signature header containing an HMAC-SHA256 of the raw request body using your webhook secret, plus a timestamp to prevent replay. Non-2xx responses are retried 5 times with exponential back-off over 24 hours. Failed deliveries are listed in the console for manual replay.

Is there a Postman collection or OpenAPI spec?

Both. The Postman collection and the OpenAPI 3.1 document are linked from this page at launch (placeholder links below). The collection includes environment files for sandbox and production and example calls for every endpoint.

Which SDKs do you provide?

Snippets and small helper modules in Python, Node.js and cURL, published on GitHub under the MIT licence at launch. The API is plain REST with JSON, so any HTTP client works. Go and Java examples are on the roadmap.

How do I handle pagination?

List endpoints return 100 items per page with a next_cursor field. Pass cursor=next_cursor to get the next page. Cursors are stable for 24 hours. Filter lists by group, status, country and last_seen_before to keep result sets small.

Can I automate activation from my own provisioning flow?

Yes. A common pattern: your factory test rig calls activate during end-of-line test, your warehouse calls suspend before shipping, and your customer onboarding calls resume on first registration. Each call is idempotent and returns the current SIM state.

What does an API error look like?

JSON with a type, a human-readable message and a request_id, using standard HTTP status codes: 400 for validation, 401 for a bad key, 403 for role scope, 404 for an unknown ICCID, 409 for an invalid state transition and 429 for rate limits. Quote the request_id to support.

Related IoT pages

• Free trial kit
· • IoT SIM pricing
· • Connectivity platform
· • Coverage and roaming rules
· • Private APN and VPN
· • Partner API
· • Consumer electronics integration
· • Contact us

Keys in minutes, SIMs in days

Request the trial kit and start in the sandbox today.

Order the free trial kit Ask a technical question

Universal eSIMs IoT Connectivity Platform

Connectivity management platform for IoT SIMs: activate, suspend, pooled data, usage alerts, geo-fencing, diagnostics, IMEI lock, REST API and webhooks.

Price Currency: USD

Operating System: Web, REST API

Application Category: BusinessApplication