What is Tornet SDP?
Tornet SDP is the platform that sits between your service and the mobile operator. You integrate once, against one API, and the platform handles subscriber billing, message delivery, anti-fraud and the operator's own interfaces on your behalf.
If you run a content or value-added service on a Korek short code, this is the API you build against.
What you never have to do
The point of the platform is the work it absorbs. You do not:
- Talk to the operator directly. No SMPP, no operator gateways, no per-operator quirks.
- Hold anti-fraud credentials. The platform fetches the anti-fraud script for you with its own account. You never register with the anti-fraud provider and never see its keys.
- Track charging yourself. Subscriptions renew, retries happen, and the platform is the record of what was charged and when.
- Build a delivery-receipt pipeline. You receive events; the plumbing is ours.
What you can build
Three flows. Which one you use depends on how the subscriber proves they want the service, and that difference is the whole distinction: everything else is shared.
| Flow | The subscriber proves intent by | Use it when |
|---|---|---|
| Subscription (Landing Page) | receiving a PIN by SMS and typing it back | the general case: works on any connection, including Wi-Fi |
| Header Enrichment | one tap, with the operator identifying the number | the subscriber is on mobile data and you want the shortest possible journey |
| One-Time Purchase | receiving a one-time code and typing it back | a single charge rather than a recurring subscription |
Subscription and Header Enrichment both create a recurring subscription. One-Time Purchase charges once and creates nothing ongoing.
Six things to understand before you write any code
These cut across every endpoint, and most integration problems are one of these six rather than a problem with the endpoint you were calling.
1. Every response has the same shape. A requestId, a code, and either data or a message.
Codes are stable strings, not HTTP statuses alone, and every code says whether retrying could help.
→ The envelope
2. You supply an idempotency key on every state-changing call. spTransactionId is yours to
generate and must be unique per attempt. Send the same one twice and you get the same answer twice,
never two charges. This is the single most important field in the API. → Idempotency
3. Your servers must be allowlisted by IP. Requests from an unlisted address are refused before anything else is considered. Allowlisting is per short code and is arranged with the operator team. → IP whitelisting
4. Anti-fraud is not optional and it starts on your page. Your backend fetches a script, your page loads it, and the identifiers it produces travel with the subscription call. A flow whose page never loaded the script is refused at verification, and that refusal looks like a decline, so it is worth getting right first. → Anti-fraud
5. Events reach you asynchronously through DataSync. The synchronous response tells you what happened on that call; DataSync is the durable feed of what happened to the subscription over its life: renewals, failures, endings. Both matter, and they are not substitutes. → DataSync
6. Delivery is at-least-once, so your receiver must be idempotent. The same event can arrive twice. Treat the event id as the deduplication key.
Where to go next
- Integrating for the first time? → Getting started: credentials, allowlisting, first call.
- Moving from the legacy platform? → Migration from legacy: call by call, and what changed. Read this before anything else if you already run services on the old platform: DataSync in particular is not a re-point, it is a rewrite.
- Want to see a whole flow before the detail? → the overview page of each flow carries a sequence diagram.
Conventions in this documentation
- Every example value is fictional. Keys, short codes, numbers and hostnames are illustrative.
- Where a limit or behaviour is configured per service, the documentation says so rather than quoting a number that may not be yours.
- Where something does not exist yet, it says so. The Testing page is explicit about what is and is not available today. An integrator who discovers a gap by hitting it trusts us less than one who was told about it.