Everything worth knowing, nothing that isn't.
What the lookup actually does
An HLR Lookup request triggers an SS7 MAP-SRI-FOR-SM (or a SIP/IMS-equivalent on 5G) toward the recipient's home network. The response carries the IMSI, the serving MSC address, and the current MNC/MCC (which reveals roaming). It does not reveal the subscriber's location beyond country/operator granularity, and it does not deliver a message — it is the lookup step the SMSC would perform anyway, exposed as a standalone API.
Why it matters commercially
Three reasons. You stop paying SMS fees on dead numbers (typically 8–18% of a stale marketing list). You route around ported numbers correctly — sending to a number's original operator when it has ported costs 40–60% more on some routes and increases failure rates. You catch numbers that are roaming and decide whether to charge the international rate or hold the send.
Latency and limits
BroadNet's HLR Lookup API answers in about 350ms for a live query and under 50ms from cache, across 200+ countries, with batch endpoints for the once-a-week list scrub and a streaming endpoint for the before-every-send-OTP pattern. There is no fixed per-account lookup rate limit; throughput is sized to your traffic. See /products/hlr-lookup for the full spec.
Privacy and compliance
HLR Lookup is regulated. In the EU under GDPR, an HLR query against a subscriber number is treated as personal data processing — you need a lawful basis. In KSA under PDPL 2023, MSISDN-level queries are also in scope. BroadNet's HLR Lookup endpoint logs only the hash of the queried number by default, with optional full-trace for customers in fraud-prevention use cases that have legal basis.