> ## Documentation Index > Fetch the complete documentation index at: https://docs.spenza.com/llms.txt > Use this file to discover all available pages before exploring further. # Purchase a plan (synchronous) > Purchase / activate a plan for a SIM. Synchronous — blocks and returns the finished purchase. For an async variant, use `POST /api/v3/plans/purchase` instead (a different request/response contract, not an alias of this one). Throttled at 60 requests/60s specific to this route, tighter than the 120 req/60s account-wide default. A `429` can also occur when the purchase for this exact SIM+plan is momentarily lock-contended by a concurrent request — same `RATE_LIMITED` code and status, but with the message "Too many concurrent purchase requests for this account — please retry in a moment." rather than a generic throttle message. ## OpenAPI ````yaml /openapi.yaml post /api/v1.1/plans/purchase openapi: 3.1.0 info: title: Spenza Partner API version: 3.0.0 summary: >- Partner API for SIMs, eSIMs, plans, billing, users, groups and numbers — v1.1 surface. description: > The **Spenza Partner API** lets you manage SIMs, eSIMs, plans, subscriptions, billing, users, phone numbers, teams and device/SIM/user groups programmatically. All endpoints follow one consistent standard: - **Auth** — exchange your API `key` + `secret` for a bearer token, then send `Authorization: Bearer ` on every request. - **Envelopes** — success responses are `{ success, data, meta? }`; errors are `{ success: false, error: { code, message, details? } }`. - **Pagination** — list endpoints accept `page` (1-indexed) and `pageSize` (max 100); totals are returned in `meta`. - **Idempotency** — many write endpoints honor an optional `Idempotency-Key` request header so a retried call replays the original result instead of repeating the side effect. - **Async operations** — a handful of endpoints (eSIM provisioning, port-in, the `/api/v3/...` purchase variants, top-up) return `202` (`201` for top-up) with a `transactionId` + `statusEndpoint` instead of the finished resource. Poll `GET /api/v3/transactions/{transactionId}` (no auth required) until the transaction reaches a terminal status. One resource — **port-in submission** — is a documented exception: it lives at `POST /api/v3/port-in`, requires an Admin-tier account role rather than just a valid bearer token, and is **not** on the standard envelope (see that operation's description for its exact response shape). contact: name: Spenza API Support email: support@spenza.com url: https://spenza.com license: name: Proprietary url: https://spenza.com/terms x-logo: url: https://spenza.com/logo.png altText: Spenza servers: - url: https://api.spenza.com description: Production security: - bearerAuth: [] tags: - name: Authentication description: Exchange API credentials for a bearer token. - name: SIMs description: List, inspect, assign and manage SIMs. - name: Subscriptions description: Plan subscriptions attached to SIMs. - name: Plans & Catalog description: Purchasable plans and SIM products. - name: eSIM description: Provision eSIMs and fetch activation QR / install status. - name: Billing description: Invoices, credit balance and top-ups. - name: Users description: End users (employees) on your account that SIMs/devices are assigned to. - name: Orders & Transactions description: Order history and financial transactions. - name: Numbers & Port-in description: Check port-in eligibility and port existing numbers into Spenza. - name: Messaging description: Send outbound SMS from a provisioned number. - name: Webhooks description: Register endpoints for operator SMS/voice events and inspect deliveries. - name: Notifications description: In-account notifications and delivery preferences. - name: Device Groups description: Organize devices into named groups with spend/data limits. - name: SIM Groups description: Organize SIMs into named groups with spend/data limits. - name: User Groups description: Organize users (departments) into named groups with spend/data limits. - name: Devices description: The device catalog (phones/tablets) and their assignment to users. - name: Team Members description: Admins who manage your Spenza account (distinct from Users/end-users). - name: Async Status description: Universal status poll for any asynchronous (v3) operation. paths: /api/v1.1/plans/purchase: post: tags: - Plans & Catalog summary: Purchase a plan (synchronous) description: | Purchase / activate a plan for a SIM. Synchronous — blocks and returns the finished purchase. For an async variant, use `POST /api/v3/plans/purchase` instead (a different request/response contract, not an alias of this one). Throttled at 60 requests/60s specific to this route, tighter than the 120 req/60s account-wide default. A `429` can also occur when the purchase for this exact SIM+plan is momentarily lock-contended by a concurrent request — same `RATE_LIMITED` code and status, but with the message "Too many concurrent purchase requests for this account — please retry in a moment." rather than a generic throttle message. operationId: purchasePlan parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: type: object required: - iccid - productName - activateNow properties: iccid: type: string example: '8901260853182965429' productName: type: string example: AT&T 5GB activateNow: type: boolean description: No default — must be sent explicitly. example: true scheduleDate: type: string description: YYYY-MM-DD; required when activateNow=false. example: '2026-08-01' responses: '201': description: Purchased. content: application/json: example: success: true data: iccid: '8901260853182965429' productName: AT&T 5GB status: ACTIVE startDate: '2026-07-30T00:00:00.000Z' endDate: '2026-08-30T00:00:00.000Z' orderId: ORD-20260730-0001 '400': description: Missing required fields, missing scheduleDate, or malformed input. content: application/json: examples: missing: value: success: false error: code: MISSING_FIELDS message: >- Please fill in all the required fields to purchase this plan. noSchedule: value: success: false error: code: MISSING_FIELDS message: >- Please choose a start date for a plan you're scheduling for later. '404': description: SIM or plan not found. content: application/json: examples: sim: value: success: false error: code: SIM_NOT_FOUND message: We couldn't find a SIM with that ICCID on your account. plan: value: success: false error: code: PLAN_NOT_FOUND message: We couldn't find that plan. '409': description: >- SIM already has an active plan this billing cycle, a concurrent purchase for the same SIM+plan raced this one, or the `Idempotency-Key` header was reused. content: application/json: examples: activePlan: value: success: false error: code: CONFLICT message: This SIM already has an active plan this billing cycle. concurrentRace: value: success: false error: code: CONFLICT message: >- This purchase conflicts with another in-flight request for this SIM — check the order status before retrying. idempotencyKeyReused: value: success: false error: code: IDEMPOTENCY_KEY_REUSED message: >- This request was already submitted with different details — please use a new idempotency key. idempotencyKeyInFlight: value: success: false error: code: CONFLICT message: >- This request is already being processed — please retry in a moment. '429': $ref: '#/components/responses/RateLimited' '500': description: Purchase couldn't be completed or confirmed on Spenza's side. content: application/json: examples: purchaseFailed: value: success: false error: code: INTERNAL_ERROR message: >- We weren't able to complete this purchase — check the order status for details, or contact support if it keeps happening. confirmationFailed: value: success: false error: code: INTERNAL_ERROR message: >- We weren't able to confirm this purchase — check the order status for details, or contact support if it keeps happening. components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: false description: > Any string unique to this logical request. On a retry with the same key and the same request body, the original response is replayed verbatim (with an `Idempotency-Replayed: true` response header) instead of the action repeating. Reusing the key with a **different** body or on a different route returns `409 IDEMPOTENCY_KEY_REUSED`. A replay attempted while the original call is still in flight returns `409 CONFLICT`. Optional — omit it and the endpoint behaves exactly as it would otherwise. schema: type: string example: a1b2c3d4-idem-key-001 responses: RateLimited: description: > Rate limit exceeded for this endpoint (or the account-wide default of 120 req/min). Only `Retry-After` is present on this response — the `X-RateLimit-*` headers below are sent on successful (non-429) requests, not on the 429 itself. headers: Retry-After: description: Seconds until you can retry. schema: type: integer content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' example: success: false error: code: RATE_LIMITED message: 'ThrottlerException: Too Many Requests' schemas: ErrorEnvelope: type: object required: - success - error properties: success: type: boolean example: false error: type: object required: - code - message properties: code: type: string example: SIM_NOT_FOUND message: type: string example: We couldn't find a SIM with that ICCID on your account. details: description: >- Present on some 4xx errors (for example a list of missing fields). Always absent on 5xx. type: object securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: Bearer token obtained from `POST /api/v1.1/auth/token`. ````