openFinance API Framework XS2A API as PSD2 Interface Implementation Guidelines - Payment Initiation Service (2.3)

Download OpenAPI specification:Download

URL: https://api.bog.ge/docs/openbanking License: Creative Commons Attribution 4.0 International Public License

The payment initiation flow depends heavily on the SCA approach implemented by the ASPSP. The most complex flow is the flow for the Embedded SCA Approach, which further differs on whether there are various authentication methods available for the PSU. In the following, the different API flows are provided as an overview for these different scenarios. Remark: The flows do not always cover all variances or complexities of the implementation and are exemplary flows.

openFinance API Framework XS2A API as PSD2 Interface Implementation Guidelines

Payment Initiation Service (PIS)

The component for Payment Initiation Service (PIS) offers the following services:

Initiation and update of a payment request
Status information of a payment

Payment Initiation Request for Single Payments

Creates a payment initiation request at the ASPSP. See "XS2A API as PSD2 Interface Implementation Guidelines ", sections "Payment Initiation with JSON encoding of the Payment Instruction" and "Payment Initiation with pain.001 XML message as Payment Instruction ".

Authorizations:

NoneBearerAuthOAuth

path Parameters

payment-product

required

string

Enum: "sepa-credit-transfers" "instant-sepa-credit-transfers" "target-2-payments" "cross-border-credit-transfers" "pain.001-sepa-credit-transfers" "pain.001-instant-sepa-credit-transfers" "pain.001-target-2-payments" "pain.001-cross-border-credit-transfers"

Example: sepa-credit-transfers

The addressed payment product endpoint, e.g. for SEPA Credit Transfers (SCT). The ASPSP will publish which of the payment products/endpoints will be supported. The following payment products are supported:

For request bodies with JSON encoding: -- sepa-credit-transfers -- instant-sepa-credit-transfers -- target-2-payments -- cross-border-credit-transfers
For request bodies with XML encoding (ISO20022 pain.001): -- pain.001-sepa-credit-transfers -- pain.001-instant-sepa-credit-transfers -- pain.001-target-2-payments -- pain.001-cross-border-credit-transfers The ASPSP will publish which of the payment products/endpoints will be supported. For definitions of basic non euro generic products see [oFA PFDom]. Further products might be published by the ASPSP within its XS2A documentation. These new product types will end in further endpoints of the XS2A Interface.

header Parameters

PSU-IP-Port	string Example: 1234 The forwarded IP Port header field consists of the corresponding HTTP request IP Port field between PSU and TPP, if available.
PSU-Accept	string Example: application/json The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Charset	string Example: * The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Encoding	string Example: * The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Language	string Example: en-gb,en;0.8 The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-User-Agent	string Example: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 The forwarded Agent header field of the HTTP request between PSU and TPP, if available.
PSU-Http-Method	string Enum: "GET" "POST" "PUT" "PATCH" "DELETE" Example: GET HTTP method used at the PSU ? TPP interface, if available. Valid values are: GET POST PUT PATCH DELETE
PSU-Device-ID	string <uuid> Example: 99435c7e-ad88-49ec-a2ad-99ddcb1f5555 UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of an installation identification this ID needs to be unaltered until removal from device.
PSU-Geo-Location	stringGEO:-?[0-9]{1,2}\.[0-9]{6};-?[0-9]{1,3}\.[0-9... Example: GEO:52.506931;13.144558 The forwarded Geo Location of the corresponding http request between PSU and TPP if available.
PSU-ID	string (Max140Text) <= 140 characters Example: PSU-1234 Client ID of the PSU in the ASPSP client interface. Might be mandated in the ASPSP's documentation. It might be contained even if an OAuth2 based authentication was performed in a pre-step or an OAuth2 based SCA was performed in an preceding AIS service in the same session. In this case the ASPSP might check whether PSU-ID and token match, according to ASPSP documentation.
PSU-ID-Type	string (Max35Text) <= 35 characters Example: PSU-ID-TYPE_C Type of the PSU-ID, needed in scenarios where PSUs have several PSU-IDs as access possibility. In this case, the mean and use are then defined in the ASPSP's documentation.
PSU-Corporate-ID	string (Max140Text) <= 140 characters Example: PSU-CORP-ID1234 Might be mandated in the ASPSP's documentation. Only used in a corporate context.
PSU-Corporate-ID-Type	string (Max35Text) <= 35 characters Example: PSU-CORP-ID-TYPE_A Might be mandated in the ASPSP's documentation. Only used in a corporate context.
Client-SCA-Approach-Preference	string (Max35Text) <= 35 characters Example: decoupled, redirect, embedded A comma separated list of attributes, where the first entry will have a higher priority than the next or to every SCA Approach which is not indicated at all, e.g. "decoupled, redirect, embedded" or "decoupled" This attribute may be ignored by the ASPSP
Client-Redirect-URI	string <uri> Example: https://exampleclient.com/redirectUri?clientEvent=11111111 URI of the TPP, where the transaction flow shall be redirected to after a Redirect. Mandated for the Redirect SCA Approach. It is recommended to always use this header field.
Client-Nok-Redirect-URI	string <uri> Example: https://exampleclient.com/NokUri?clientEvent=11111111 If this URI is contained, the TPP is asking to redirect the transaction flow to this address instead of the Client-Redirect-URI in case of a negative result of the redirect SCA method. This might be ignored by the ASPSP.
Client-Explicit-Authorisation-Preferred	boolean Example: true If it equals "true", the API Client prefers to start the authorisation process separately, e.g. because of the usage of a signing basket or because of asynchronous authorisation. This preference might be ignored by the ASPSP, if a signing basket is not supported as functionality or if asynchronous authorisation is not supported. If it equals "false" or if the parameter is not used, there is no preference of the API Client. This especially indicates that the API Client assumes a direct authorisation of the transaction in the next step, without using a signing basket.
Client-Notification-URI	string Example: https://exampleclient.com/NotificationUri?clientEvent=11111111 URI for the Endpoint of the Client API to which the status of the resource should be sent. This header field may by ignored by the ASPSP if the resource status push function is not supported for the related API client.
Client-Notification-Content-Preferred	string Example: status=SCA The string has the form status=X1, ..., Xn where Xi is one of the constants SCA, PROCESS, LAST and where constants are not repeated. The usage of the constants supports the of following semantics: SCA: A notification on every change of the scaStatus attribute for all related authorisation processes is preferred by the API Client. PROCESS: A notification on all changes of consentStatus or transactionStatus attributes is preferred by the API Client. LAST: Only a notification on the last consentStatus or transactionStatus as available in the XS2A interface is preferred by the API Client. This header field may be ignored, if the ASPSP does not support resource notification services for the related API Client.
Client-VOP-Requested	boolean true: The client requests the ASPSP to perform a VOP check, where applicable. false: The API Client requests the ASPSP not to perform a VOP check. Reasons for this are e.g. that the API client has already performed the VOP check in a TPP scenario or is requiring an opt out in a direct access scenario. The related VOP check could have been performed up front via the dedicated VOP API, if provided by the ASPSP. not used: The API Client does not request to perform a VOP request. An ASPSP may ignore this header
Client-VOP-Request-ID	string <uuid> Example: 99435c7e-ad88-49ec-a2ad-99ddcb1f5555 This attribute contains the X-Request-ID of the related request on the dedicated VOP API. This attribute might be ignored by the ASPSP. If the ASPSP offers the dedicated VOP API, it might mandate the usage of this attribute via the ASPSP documentation and then make the usage of this attribute mandatory, if applicable to the related payment product and if VOP has not been opted out.
Client-Brand-Logging-Information	string (Max140Text) <= 140 characters Example: ClientBrandB This header might be used by API Clients to inform the ASPSP about the brand used by the API Client towards the PSU. This information is meant for logging entries to enhance communication between ASPSP and PSU or ASPSP and API Client. This header might be ignored by the ASPSP.
Digest	string Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A= When API Client include a signature according to this signature profile, they also must include a "Digest" header as defined in [RFC3230]. The "Digest" Header contains a Hash of the message body. If the message does not contain a body, the "Digest" header must contain the hash of an empty byte list. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512 as defined in [RFC5843].
x-jws-signature	string Example: eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIwLTEwLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyJ4LXJlcXVlc3QtaWQiLCJkaWdlc3QiXSwibUlkIjoiaHR0cDovL3VyaS5ldHNpLm9yZy8xOTE4Mi9IdHRwSGVhZGVycyJ9LCJhbGciOiJSUzI1NiJ9..NuGglWBtHcXavob2ZmW-PoSpMmhJS9U6z8zPqHFoE97vHI3z8wtaVdbwsj5WzgPjtVWUUnk8cxP4JjLXdwzwhhHB2uJ5FI4ZZGdSQQw-9pXPUx3cCJSzHmrgkJ-di-A4 The attribute x-jws-signature contains the JSON Web Signature.
X-Request-ID required	string <uuid> Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721 ID of the request, unique to the call, as determined by the initiating party.
Body-Sig-Profile	string Enum: "JAdES_JS" "XAdES" "EMV_AC" Example: XAdES Indicates the signature profile used for signing (parts of) the body. Shall be used if the body is signed.
Body-Enc-Profile	string Enum: "JWE_CS" "XML_ENC" Example: JWE_CS Indicates the encryption profile used for the encryption of (parts of) the body.
Body-Enc-List	string Example: BODY Contains a List of names of data elements/ attributes of the body which contain encrypted information
Content-Type required	string Example: application/json
Consent-ID	string (Max70Text) <= 70 characters Example: 123cons456 This data element may be contained, if the payment initiation transaction is part of a session, i.e. combined AIS/PIS service. This then contains the consentId of the related AIS consent, which was performed prior to this payment initiation.
PSU-IP-Address required	string <ipv4> Example: 192.168.8.78 The forwarded IP Address header field consists of the corresponding http request IP Address field between PSU and TPP. If not available, the TPP shall use the IP Address used by the TPP when submitting this request.
TPP-Rejection-NoFunds-Preferred	boolean Example: true If it equals "true" then the TPP prefers a rejection of the payment initiation in case the ASPSP is providing an integrated confirmation of funds request an the result of this is that not sufficient funds are available. If it equals "false" then the TPP prefers that the ASPSP is dealing with the payment initiation like in the ASPSPs online channel, potentially waiting for a certain time period for funds to arrive to initiate the payment. This parameter might be ignored by the ASPSP.

Request Body schema:
application/json

Any of

	object Set of elements used to reference a payment instruction.
paymentMethod	string Enum: "TRF" "CHK" Specifies the means of payment that will be used to move the amount of money. Usage: Only used for cross-border transactions. If no paymentMethod is explicitly stated, paymentMethod will be interpreted as TRF (Credit Transfer).
required	object Amount of money to be moved between the debtor and creditor, before deduction of charges, expressed in the currency as ordered by the initiating party.
required	object Unambiguous identification of the account of the creditor to which a credit entry will be posted as a result of the payment transaction.
	object Financial institution servicing an account for the creditor.
required	object Party to which an amount of money is due.
	object Ultimate party to which an amount of money is due.
remittanceInformationUnstructured	Array of strings (Max140Text) = 1 items [ items <= 140 characters ] Information supplied to enable the matching/reconciliation of an entry with the items that the payment is intended to settle, such as commercial invoices in an accounts' receivable system, in an unstructured form.
required	object Unambiguous identification of the account of the debtor to which a debit entry will be made as a result of the transaction.

Responses

Request samples

Payload

Content type

application/json

Example

SinglePayment_SCT_Core

{"paymentIdentification": {"endToEndId": "Text, maximum of 35 characters."
},
"paymentMethod": "TRF",
"instructedAmount": {"currency": "EUR",
"amount": "string"
},
"creditorAccount": {"iban": "FR7612345987650123456789014",
"bban": "BARC12345612345678",
"pan": "Text, maximum of 35 characters.",
"maskedPan": "Text, maximum of 35 characters.",
"currency": "EUR"
},
"creditorAgent": {"financialInstitutionId": {"bicfi": "ECBFDEFFFIM",
"clearingSystemMemberId": {"memberId": "Text, maximum of 35 characters.",
"clearingSystemIdentificationCode": "DEBLZ",
"clearingSystemIdentificationProprietary": "Text, maximum of 35 characters."
},
"name": "Text, maximum of 140 characters.",
"postalAddress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "string",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
}
},
"creditor": {"name": "Text, maximum of 140 characters."
},
"ultimateCreditor": {"name": "Text, maximum of 140 characters."
},
"remittanceInformationUnstructured": ["{\"Ref Number Merchant\"}"
],
"debtorAccount": {"iban": "FR7612345987650123456789014",
"bban": "BARC12345612345678",
"pan": "Text, maximum of 35 characters.",
"maskedPan": "Text, maximum of 35 characters.",
"currency": "EUR"
}
}

Response samples

Content type

application/json

{"transactionStatus": "ACCC",
"paymentId": "Text, maximum of 70 characters.",
"transactionFees": {"currency": "EUR",
"amount": "string"
},
"currencyConversionFee": {"currency": "EUR",
"amount": "string"
},
"estimatedTotalAmount": {"currency": "EUR",
"amount": "string"
},
"estimatedInterbankSettlementAmount": {"currency": "EUR",
"amount": "string"
},
"transactionFeeIndicator": true,
"scaMethods": [{"authenticationType": "PUSH_OTP",
"authenticationVersion": "string",
"authenticationMethodId": "Text, maximum of 35 characters.",
"name": "string",
"explanation": "string"
}
],
"chosenScaMethod": {"authenticationType": "PUSH_OTP",
"authenticationVersion": "string",
"authenticationMethodId": "Text, maximum of 35 characters.",
"name": "string",
"explanation": "string"
},
"challengeData": {"image": "string",
"data": ["string"
],
"imageLink": "string",
"otpMaxLength": 0,
"otpFormat": "string",
"additionalInformation": "string"
},
"_links": {"scaRedirect": {"href": "string"
},
"scaOAuth": {"href": "string"
},
"confirmation": {"href": "string"
},
"startAuthorisation": {"href": "string"
},
"startAuthorisationWithPsuIdentification": {"href": "string"
},
"startAuthorisationWithPsuAuthentication": {"href": "string"
},
"startAuthorisationWithEncryptedPsuAuthentication": {"href": "string"
},
"startAuthorisationWithAuthenticationMethodSelection": {"href": "string"
},
"startAuthorisationWithTransactionAuthorisation": {"href": "string"
},
"self": {"href": "string"
},
"status": {"href": "string"
},
"scaStatus": {"href": "string"
},
"creditorNameConfirmation": {"href": "string"
},
"encryptionCertificates": [{"href": "string"
}
],
"property1": {"href": "string"
},
"property2": {"href": "string"
}
},
"psuMessage": "Text, maximum of 500 characters.",
"apiClientMessages": [{"category": "string",
"code": "FORMAT_ERROR",
"path": "string",
"text": "Text, maximum of 500 characters."
}
]
}

Payment Initiation Request for Bulk Payments

Creates a payment initiation request at the ASPSP. See "XS2A API as PSD2 Interface Implementation Guidelines ", sections "Bulk Payment Initiation with JSON encoding of the Payment Instruction" and "Bulk Payment Initiation with XML message as Payment Instruction".

Authorizations:

NoneBearerAuthOAuth

path Parameters

payment-product

required

string

Example: sepa-credit-transfers

For request bodies with JSON encoding: -- sepa-credit-transfers -- instant-sepa-credit-transfers -- target-2-payments -- cross-border-credit-transfers
For request bodies with XML encoding (ISO20022 pain.001): -- pain.001-sepa-credit-transfers -- pain.001-instant-sepa-credit-transfers -- pain.001-proprietary-credit-transfers The ASPSP will publish which of the payment products/endpoints will be supported. For definitions of basic non euro generic products see [oFA PFDom]. Further products might be published by the ASPSP within its XS2A documentation. These new product types will end in further endpoints of the XS2A Interface.

header Parameters

PSU-IP-Port	string Example: 1234 The forwarded IP Port header field consists of the corresponding HTTP request IP Port field between PSU and TPP, if available.
PSU-Accept	string Example: application/json The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Charset	string Example: * The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Encoding	string Example: * The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Language	string Example: en-gb,en;0.8 The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-User-Agent	string Example: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 The forwarded Agent header field of the HTTP request between PSU and TPP, if available.
PSU-Http-Method	string Enum: "GET" "POST" "PUT" "PATCH" "DELETE" Example: GET HTTP method used at the PSU ? TPP interface, if available. Valid values are: GET POST PUT PATCH DELETE
PSU-Device-ID	string <uuid> Example: 99435c7e-ad88-49ec-a2ad-99ddcb1f5555 UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of an installation identification this ID needs to be unaltered until removal from device.
PSU-Geo-Location	stringGEO:-?[0-9]{1,2}\.[0-9]{6};-?[0-9]{1,3}\.[0-9... Example: GEO:52.506931;13.144558 The forwarded Geo Location of the corresponding http request between PSU and TPP if available.
PSU-ID	string (Max140Text) <= 140 characters Example: PSU-1234 Client ID of the PSU in the ASPSP client interface. Might be mandated in the ASPSP's documentation. It might be contained even if an OAuth2 based authentication was performed in a pre-step or an OAuth2 based SCA was performed in an preceding AIS service in the same session. In this case the ASPSP might check whether PSU-ID and token match, according to ASPSP documentation.
PSU-ID-Type	string (Max35Text) <= 35 characters Example: PSU-ID-TYPE_C Type of the PSU-ID, needed in scenarios where PSUs have several PSU-IDs as access possibility. In this case, the mean and use are then defined in the ASPSP's documentation.
PSU-Corporate-ID	string (Max140Text) <= 140 characters Example: PSU-CORP-ID1234 Might be mandated in the ASPSP's documentation. Only used in a corporate context.
PSU-Corporate-ID-Type	string (Max35Text) <= 35 characters Example: PSU-CORP-ID-TYPE_A Might be mandated in the ASPSP's documentation. Only used in a corporate context.
Client-SCA-Approach-Preference	string (Max35Text) <= 35 characters Example: decoupled, redirect, embedded A comma separated list of attributes, where the first entry will have a higher priority than the next or to every SCA Approach which is not indicated at all, e.g. "decoupled, redirect, embedded" or "decoupled" This attribute may be ignored by the ASPSP
Client-Redirect-URI	string <uri> Example: https://exampleclient.com/redirectUri?clientEvent=11111111 URI of the TPP, where the transaction flow shall be redirected to after a Redirect. Mandated for the Redirect SCA Approach. It is recommended to always use this header field.
Client-Nok-Redirect-URI	string <uri> Example: https://exampleclient.com/NokUri?clientEvent=11111111 If this URI is contained, the TPP is asking to redirect the transaction flow to this address instead of the Client-Redirect-URI in case of a negative result of the redirect SCA method. This might be ignored by the ASPSP.
Client-Explicit-Authorisation-Preferred	boolean Example: true If it equals "true", the API Client prefers to start the authorisation process separately, e.g. because of the usage of a signing basket or because of asynchronous authorisation. This preference might be ignored by the ASPSP, if a signing basket is not supported as functionality or if asynchronous authorisation is not supported. If it equals "false" or if the parameter is not used, there is no preference of the API Client. This especially indicates that the API Client assumes a direct authorisation of the transaction in the next step, without using a signing basket.
Client-Notification-URI	string Example: https://exampleclient.com/NotificationUri?clientEvent=11111111 URI for the Endpoint of the Client API to which the status of the resource should be sent. This header field may by ignored by the ASPSP if the resource status push function is not supported for the related API client.
Client-Notification-Content-Preferred	string Example: status=SCA The string has the form status=X1, ..., Xn where Xi is one of the constants SCA, PROCESS, LAST and where constants are not repeated. The usage of the constants supports the of following semantics: SCA: A notification on every change of the scaStatus attribute for all related authorisation processes is preferred by the API Client. PROCESS: A notification on all changes of consentStatus or transactionStatus attributes is preferred by the API Client. LAST: Only a notification on the last consentStatus or transactionStatus as available in the XS2A interface is preferred by the API Client. This header field may be ignored, if the ASPSP does not support resource notification services for the related API Client.
Client-VOP-Requested	boolean true: The client requests the ASPSP to perform a VOP check, where applicable. false: The API Client requests the ASPSP not to perform a VOP check. Reasons for this are e.g. that the API client has already performed the VOP check in a TPP scenario or is requiring an opt out in a direct access scenario. The related VOP check could have been performed up front via the dedicated VOP API, if provided by the ASPSP. not used: The API Client does not request to perform a VOP request. An ASPSP may ignore this header
Client-VOP-Request-ID	string <uuid> Example: 99435c7e-ad88-49ec-a2ad-99ddcb1f5555 This attribute contains the X-Request-ID of the related request on the dedicated VOP API. This attribute might be ignored by the ASPSP. If the ASPSP offers the dedicated VOP API, it might mandate the usage of this attribute via the ASPSP documentation and then make the usage of this attribute mandatory, if applicable to the related payment product and if VOP has not been opted out.
Client-Brand-Logging-Information	string (Max140Text) <= 140 characters Example: ClientBrandB This header might be used by API Clients to inform the ASPSP about the brand used by the API Client towards the PSU. This information is meant for logging entries to enhance communication between ASPSP and PSU or ASPSP and API Client. This header might be ignored by the ASPSP.
Digest	string Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A= When API Client include a signature according to this signature profile, they also must include a "Digest" header as defined in [RFC3230]. The "Digest" Header contains a Hash of the message body. If the message does not contain a body, the "Digest" header must contain the hash of an empty byte list. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512 as defined in [RFC5843].
x-jws-signature	string Example: eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIwLTEwLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyJ4LXJlcXVlc3QtaWQiLCJkaWdlc3QiXSwibUlkIjoiaHR0cDovL3VyaS5ldHNpLm9yZy8xOTE4Mi9IdHRwSGVhZGVycyJ9LCJhbGciOiJSUzI1NiJ9..NuGglWBtHcXavob2ZmW-PoSpMmhJS9U6z8zPqHFoE97vHI3z8wtaVdbwsj5WzgPjtVWUUnk8cxP4JjLXdwzwhhHB2uJ5FI4ZZGdSQQw-9pXPUx3cCJSzHmrgkJ-di-A4 The attribute x-jws-signature contains the JSON Web Signature.
X-Request-ID required	string <uuid> Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721 ID of the request, unique to the call, as determined by the initiating party.
Body-Sig-Profile	string Enum: "JAdES_JS" "XAdES" "EMV_AC" Example: XAdES Indicates the signature profile used for signing (parts of) the body. Shall be used if the body is signed.
Body-Enc-Profile	string Enum: "JWE_CS" "XML_ENC" Example: JWE_CS Indicates the encryption profile used for the encryption of (parts of) the body.
Body-Enc-List	string Example: BODY Contains a List of names of data elements/ attributes of the body which contain encrypted information
Content-Type required	string Example: application/json
Consent-ID	string (Max70Text) <= 70 characters Example: 123cons456 This data element may be contained, if the payment initiation transaction is part of a session, i.e. combined AIS/PIS service. This then contains the consentId of the related AIS consent, which was performed prior to this payment initiation.
PSU-IP-Address required	string <ipv4> Example: 192.168.8.78 The forwarded IP Address header field consists of the corresponding http request IP Address field between PSU and TPP. If not available, the TPP shall use the IP Address used by the TPP when submitting this request.
TPP-Rejection-NoFunds-Preferred	boolean Example: true If it equals "true" then the TPP prefers a rejection of the payment initiation in case the ASPSP is providing an integrated confirmation of funds request an the result of this is that not sufficient funds are available. If it equals "false" then the TPP prefers that the ASPSP is dealing with the payment initiation like in the ASPSPs online channel, potentially waiting for a certain time period for funds to arrive to initiate the payment. This parameter might be ignored by the ASPSP.

Request Body schema:
application/json

Any of

paymentInformationId required	string <= 35 characters Unique identification as assigned by the sending party to unambiguously identify this bulk payment. This attribute may be used by ASPSPs or communities as an optional field.
paymentMethod	string Enum: "TRF" "CHK" Specifies the means of payment that will be used to move the amount of money. Usage: Only used for cross-border transactions. If no paymentMethod is explicitly indicated, paymentMethod will be interpreted as "TRF" (Credit Transfer).
batchBooking	boolean If this element equals true, the PSU pre-fers only one booking entry. If this element equals false, the PSU prefers individual booking of all contained individual transactions. The ASPSP will follow this preference according to contracts agreed on with the PSU.
numberOfTransactions required	integer Number of individual transactions con-tained in the related bulk.
controlSum required	string <= 35 characters Total of all individual amounts included in the group, irrespective of currencies.
required	object Unambiguous identification of the account of the debtor to which a debit entry will be made as a result of the transaction.
required	Array of objects (minimum_SCT_Core) The Credit Transfer Bulk Entry is a type which follows the JSON formats for the supported products for single payments, excluding the data elements debtorAccount, debtor debtorAgent requestedExecutionDate, requestedExecutionDateTime. These data elements may not be contained in any bulk entry. In addition, the following entries will be allowed for every single entry, if not used already on bulk level: chargeBearer chargesAccount categoryPurposeCode categoryPurposeProprietary serviceLevelCode localnstrumentCode localInstrumentProprietary ultimateDebtor In addition, the attributes purposeCode remittanceInformationStructured are always available on entry level if sup-ported by the related payment product.

Responses

Request samples

Payload

Content type

application/json

Example

BulkPayment_SCT_Core

{"paymentInformationId": "Text, maximum of 35 characters.",
"paymentMethod": "TRF",
"batchBooking": true,
"numberOfTransactions": 0,
"controlSum": "Text, maximum of 35 characters.",
"debtorAccount": {"iban": "FR7612345987650123456789014",
"bban": "BARC12345612345678",
"pan": "Text, maximum of 35 characters.",
"maskedPan": "Text, maximum of 35 characters.",
"currency": "EUR"
},
"creditTransfers": [{"paymentIdentification": {"endToEndId": "Text, maximum of 35 characters."
},
"paymentMethod": "TRF",
"instructedAmount": {"currency": "EUR",
"amount": "string"
},
"creditorAccount": {"iban": "FR7612345987650123456789014",
"bban": "BARC12345612345678",
"pan": "Text, maximum of 35 characters.",
"maskedPan": "Text, maximum of 35 characters.",
"currency": "EUR"
},
"creditorAgent": {"financialInstitutionId": {"bicfi": "ECBFDEFFFIM",
"clearingSystemMemberId": {"memberId": "Text, maximum of 35 characters.",
"clearingSystemIdentificationCode": "DEBLZ",
"clearingSystemIdentificationProprietary": "Text, maximum of 35 characters."
},
"name": "Text, maximum of 140 characters.",
"postalAddress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "string",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
}
},
"creditor": {"name": "Text, maximum of 140 characters."
},
"ultimateCreditor": {"name": "Text, maximum of 140 characters."
},
"remittanceInformationUnstructured": ["{\"Ref Number Merchant\"}"
]
}
]
}

Response samples

Content type

application/json

{"transactionStatus": "ACCC",
"paymentId": "Text, maximum of 70 characters.",
"transactionFees": {"currency": "EUR",
"amount": "string"
},
"currencyConversionFee": {"currency": "EUR",
"amount": "string"
},
"estimatedTotalAmount": {"currency": "EUR",
"amount": "string"
},
"estimatedInterbankSettlementAmount": {"currency": "EUR",
"amount": "string"
},
"transactionFeeIndicator": true,
"scaMethods": [{"authenticationType": "PUSH_OTP",
"authenticationVersion": "string",
"authenticationMethodId": "Text, maximum of 35 characters.",
"name": "string",
"explanation": "string"
}
],
"chosenScaMethod": {"authenticationType": "PUSH_OTP",
"authenticationVersion": "string",
"authenticationMethodId": "Text, maximum of 35 characters.",
"name": "string",
"explanation": "string"
},
"challengeData": {"image": "string",
"data": ["string"
],
"imageLink": "string",
"otpMaxLength": 0,
"otpFormat": "string",
"additionalInformation": "string"
},
"_links": {"scaRedirect": {"href": "string"
},
"scaOAuth": {"href": "string"
},
"confirmation": {"href": "string"
},
"startAuthorisation": {"href": "string"
},
"startAuthorisationWithPsuIdentification": {"href": "string"
},
"startAuthorisationWithPsuAuthentication": {"href": "string"
},
"startAuthorisationWithEncryptedPsuAuthentication": {"href": "string"
},
"startAuthorisationWithAuthenticationMethodSelection": {"href": "string"
},
"startAuthorisationWithTransactionAuthorisation": {"href": "string"
},
"self": {"href": "string"
},
"status": {"href": "string"
},
"scaStatus": {"href": "string"
},
"creditorNameConfirmation": {"href": "string"
},
"encryptionCertificates": [{"href": "string"
}
],
"property1": {"href": "string"
},
"property2": {"href": "string"
}
},
"psuMessage": "Text, maximum of 500 characters.",
"apiClientMessages": [{"category": "string",
"code": "FORMAT_ERROR",
"path": "string",
"text": "Text, maximum of 500 characters."
}
]
}

Payment Status Request

Reads the status of a payment initiation. See "XS2A API as PSD2 Interface Implementation Guidelines ", section "Get Transaction Status Request".

Authorizations:

NoneBearerAuthOAuth

path Parameters

payment-service required	string Enum: "payments" "bulk-payments" "periodic-payments" Example: payments Payment service: Possible values are: payments bulk-payments periodic-payments
payment-product required	string Enum: "sepa-credit-transfers" "instant-sepa-credit-transfers" "target-2-payments" "cross-border-credit-transfers" "pain.001-sepa-credit-transfers" "pain.001-instant-sepa-credit-transfers" "pain.001-target-2-payments" "pain.001-cross-border-credit-transfers" "pain.001-proprietary-credit-transfers" Example: sepa-credit-transfers The payment product, under which the payment under paymentId has been initiated. It shall be checked by the ASPSP, if the payment-product is matching the payment initiation addressed by paymentId.
paymentId required	string (Max70Text) <= 70 characters Example: fe7552ee-0728-4bd1-baf7-94942331e478 Resource identification of the related payment.

header Parameters

Digest	string Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A= When API Client include a signature according to this signature profile, they also must include a "Digest" header as defined in [RFC3230]. The "Digest" Header contains a Hash of the message body. If the message does not contain a body, the "Digest" header must contain the hash of an empty byte list. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512 as defined in [RFC5843].
x-jws-signature	string Example: eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIwLTEwLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyJ4LXJlcXVlc3QtaWQiLCJkaWdlc3QiXSwibUlkIjoiaHR0cDovL3VyaS5ldHNpLm9yZy8xOTE4Mi9IdHRwSGVhZGVycyJ9LCJhbGciOiJSUzI1NiJ9..NuGglWBtHcXavob2ZmW-PoSpMmhJS9U6z8zPqHFoE97vHI3z8wtaVdbwsj5WzgPjtVWUUnk8cxP4JjLXdwzwhhHB2uJ5FI4ZZGdSQQw-9pXPUx3cCJSzHmrgkJ-di-A4 The attribute x-jws-signature contains the JSON Web Signature.
X-Request-ID required	string <uuid> Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721 ID of the request, unique to the call, as determined by the initiating party.

Responses

Response samples

Content type

application/json

{"transactionStatus": "ACCC",
"reasonCode": "AM04",
"reasonProprietary": "Text, maximum of 35 characters.",
"fundsAvailable": true,
"transactionFees": {"currency": "EUR",
"amount": "string"
},
"currencyConversionFees": {"currency": "EUR",
"amount": "string"
},
"estimatedTotalAmount": {"currency": "EUR",
"amount": "string"
},
"estimatedInterbankSettlementAmount": {"currency": "EUR",
"amount": "string"
},
"psuMessage": "Text, maximum of 500 characters.",
"ownerNames": [{"name": "Text, maximum of 70 characters.",
"role": "Text, maximum of 35 characters.",
"postalAddress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"identification": {"organisationId": {"anyBIC": "ECBFDEFFFIM",
"lei": "549300DTUYXVMJXZNY75",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "BOID",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
},
"privateId": {"birthDate": "2020-01-01",
"provinceOfBirth": "Text, maximum of 35 characters.",
"cityOfBirth": "Text, maximum of 35 characters.",
"countryOfBirth": "SE",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "NIDN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
}
},
"countryOfResidence": "SE",
"contactDetails": {"namePrefix": "MADM",
"name": "Text, maximum of 70 characters.",
"phoneNumber": "Text, maximum of 35 characters.",
"mobileNumber": "Text, maximum of 35 characters.",
"faxNumber": "Text, maximum of 35 characters.",
"emailAddress": "Text, maximum of 70 characters.",
"emailPurpose": "Text, maximum of 35 characters.",
"jobTitle": "Text, maximum of 35 characters.",
"responsibility": "Text, maximum of 35 characters.",
"department": "Text, maximum of 35 characters.",
"preferredMethod": "MAIL"
}
}
],
"_links": {"scaRedirect": {"href": "string"
},
"scaOAuth": {"href": "string"
},
"confirmation": {"href": "string"
},
"startAuthorisation": {"href": "string"
},
"startAuthorisationWithPsuIdentification": {"href": "string"
},
"startAuthorisationWithPsuAuthentication": {"href": "string"
},
"startAuthorisationWithEncryptedPsuAuthentication": {"href": "string"
},
"startAuthorisationWithAuthenticationMethodSelection": {"href": "string"
},
"startAuthorisationWithTransactionAuthorisation": {"href": "string"
},
"self": {"href": "string"
},
"status": {"href": "string"
},
"scaStatus": {"href": "string"
},
"encryptionCertificates": [{"href": "string"
}
],
"property1": {"href": "string"
},
"property2": {"href": "string"
}
},
"apiClientMessages": [{"category": "string",
"code": "FORMAT_ERROR",
"path": "string",
"text": "Text, maximum of 500 characters."
}
]
}

Get Payment Request

Reads the content of a payment initiation. See "XS2A API as PSD2 Interface Implementation Guidelines ", section "Get Payment Request".

Authorizations:

NoneBearerAuthOAuth

path Parameters

payment-service required	string Enum: "payments" "bulk-payments" "periodic-payments" Example: payments Payment service: Possible values are: payments bulk-payments periodic-payments
payment-product required	string Enum: "sepa-credit-transfers" "instant-sepa-credit-transfers" "target-2-payments" "cross-border-credit-transfers" "pain.001-sepa-credit-transfers" "pain.001-instant-sepa-credit-transfers" "pain.001-target-2-payments" "pain.001-cross-border-credit-transfers" "pain.001-proprietary-credit-transfers" Example: sepa-credit-transfers The payment product, under which the payment under paymentId has been initiated. It shall be checked by the ASPSP, if the payment-product is matching the payment initiation addressed by paymentId.
paymentId required	string (Max70Text) <= 70 characters Example: fe7552ee-0728-4bd1-baf7-94942331e478 Resource identification of the related payment.

header Parameters

Digest	string Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A= When API Client include a signature according to this signature profile, they also must include a "Digest" header as defined in [RFC3230]. The "Digest" Header contains a Hash of the message body. If the message does not contain a body, the "Digest" header must contain the hash of an empty byte list. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512 as defined in [RFC5843].
x-jws-signature	string Example: eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIwLTEwLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyJ4LXJlcXVlc3QtaWQiLCJkaWdlc3QiXSwibUlkIjoiaHR0cDovL3VyaS5ldHNpLm9yZy8xOTE4Mi9IdHRwSGVhZGVycyJ9LCJhbGciOiJSUzI1NiJ9..NuGglWBtHcXavob2ZmW-PoSpMmhJS9U6z8zPqHFoE97vHI3z8wtaVdbwsj5WzgPjtVWUUnk8cxP4JjLXdwzwhhHB2uJ5FI4ZZGdSQQw-9pXPUx3cCJSzHmrgkJ-di-A4 The attribute x-jws-signature contains the JSON Web Signature.
X-Request-ID required	string <uuid> Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721 ID of the request, unique to the call, as determined by the initiating party.

Responses

Response samples

Content type

application/json

Example

SinglePayment_generic

{"paymentIdentification": {"instructionId": "Text, maximum of 35 characters.",
"endToEndId": "Text, maximum of 35 characters.",
"uetr": "99435c7e-ad88-49ec-a2ad-99ddcb1f5555"
},
"paymentMethod": "TRF",
"chargeBearer": "SLEV",
"chargesAccount": {"iban": "FR7612345987650123456789014",
"bban": "BARC12345612345678",
"pan": "Text, maximum of 35 characters.",
"maskedPan": "Text, maximum of 35 characters.",
"msisdn": "Text, maximum of 35 characters.",
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "AIIN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
},
"typeCode": "CACC",
"typeProprietary": "Text, maximum of 35 characters.",
"currency": "EUR",
"proxy": {"typeCode": "EMAL",
"typeProprietary": "Text, maximum of 35 characters.",
"identification": "Text, maximum of 2048 characters."
},
"name": "Text, maximum of 70 characters.",
"owner": {"name": "Text, maximum of 140 characters.",
"postaladdress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
}
},
"servicer": {"bicfi": "ECBFDEFFFIM",
"clearingSystemMemberId": {"memberId": "Text, maximum of 35 characters.",
"clearingSystemIdentificationCode": "DEBLZ",
"clearingSystemIdentificationProprietary": "Text, maximum of 35 characters."
},
"name": "Text, maximum of 140 characters.",
"postalAddress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "string",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
}
},
"ultimateDebtor": {"name": "Text, maximum of 140 characters.",
"postaladdress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"identification": {"organisationId": {"anyBIC": "ECBFDEFFFIM",
"lei": "549300DTUYXVMJXZNY75",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "BOID",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
},
"privateId": {"birthDate": "2020-01-01",
"provinceOfBirth": "Text, maximum of 35 characters.",
"cityOfBirth": "Text, maximum of 35 characters.",
"countryOfBirth": "SE",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "NIDN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
}
},
"additionalPartyInformation": {"tradeName": "Text, maximum of 70 characters.",
"merchantCategoryCode": "stri",
"logoURL": "Text, maximum of 2048 characters.",
"geoLocation": "GEO:52.506931;13.144558"
}
},
"instructedAmount": {"currency": "EUR",
"amount": "string"
},
"creditorAccount": {"iban": "FR7612345987650123456789014",
"bban": "BARC12345612345678",
"pan": "Text, maximum of 35 characters.",
"maskedPan": "Text, maximum of 35 characters.",
"msisdn": "Text, maximum of 35 characters.",
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "AIIN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
},
"typeCode": "CACC",
"typeProprietary": "Text, maximum of 35 characters.",
"currency": "EUR",
"proxy": {"typeCode": "EMAL",
"typeProprietary": "Text, maximum of 35 characters.",
"identification": "Text, maximum of 2048 characters."
},
"name": "Text, maximum of 70 characters.",
"owner": {"name": "Text, maximum of 140 characters.",
"postaladdress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
}
},
"servicer": {"bicfi": "ECBFDEFFFIM",
"clearingSystemMemberId": {"memberId": "Text, maximum of 35 characters.",
"clearingSystemIdentificationCode": "DEBLZ",
"clearingSystemIdentificationProprietary": "Text, maximum of 35 characters."
},
"name": "Text, maximum of 140 characters.",
"postalAddress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "string",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
}
},
"creditorAgent": {"financialInstitutionId": {"bicfi": "ECBFDEFFFIM",
"clearingSystemMemberId": {"memberId": "Text, maximum of 35 characters.",
"clearingSystemIdentificationCode": "DEBLZ",
"clearingSystemIdentificationProprietary": "Text, maximum of 35 characters."
},
"name": "Text, maximum of 140 characters.",
"postalAddress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "string",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
},
"branchIdentificationId": "Text, maximum of 35 characters.",
"branchIdentificationName": "Text, maximum of 140 characters."
},
"creditor": {"name": "Text, maximum of 140 characters.",
"postaladdress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"identification": {"organisationId": {"anyBIC": "ECBFDEFFFIM",
"lei": "549300DTUYXVMJXZNY75",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "BOID",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
},
"privateId": {"birthDate": "2020-01-01",
"provinceOfBirth": "Text, maximum of 35 characters.",
"cityOfBirth": "Text, maximum of 35 characters.",
"countryOfBirth": "SE",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "NIDN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
}
},
"additionalPartyInformation": {"tradeName": "Text, maximum of 70 characters.",
"merchantCategoryCode": "stri",
"logoURL": "Text, maximum of 2048 characters.",
"geoLocation": "GEO:52.506931;13.144558"
}
},
"ultimateCreditor": {"name": "Text, maximum of 140 characters.",
"postaladdress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"identification": {"organisationId": {"anyBIC": "ECBFDEFFFIM",
"lei": "549300DTUYXVMJXZNY75",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "BOID",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
},
"privateId": {"birthDate": "2020-01-01",
"provinceOfBirth": "Text, maximum of 35 characters.",
"cityOfBirth": "Text, maximum of 35 characters.",
"countryOfBirth": "SE",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "NIDN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
}
},
"additionalPartyInformation": {"tradeName": "Text, maximum of 70 characters.",
"merchantCategoryCode": "stri",
"logoURL": "Text, maximum of 2048 characters.",
"geoLocation": "GEO:52.506931;13.144558"
}
},
"remittanceInformationUnstructured": ["{\"Ref Number Merchant\"}"
],
"remittanceInformationStructured": [ ],
"debtorAccount": {"iban": "FR7612345987650123456789014",
"bban": "BARC12345612345678",
"pan": "Text, maximum of 35 characters.",
"maskedPan": "Text, maximum of 35 characters.",
"msisdn": "Text, maximum of 35 characters.",
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "AIIN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
},
"typeCode": "CACC",
"typeProprietary": "Text, maximum of 35 characters.",
"currency": "EUR",
"proxy": {"typeCode": "EMAL",
"typeProprietary": "Text, maximum of 35 characters.",
"identification": "Text, maximum of 2048 characters."
},
"name": "Text, maximum of 70 characters.",
"owner": {"name": "Text, maximum of 140 characters.",
"postaladdress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
}
},
"servicer": {"bicfi": "ECBFDEFFFIM",
"clearingSystemMemberId": {"memberId": "Text, maximum of 35 characters.",
"clearingSystemIdentificationCode": "DEBLZ",
"clearingSystemIdentificationProprietary": "Text, maximum of 35 characters."
},
"name": "Text, maximum of 140 characters.",
"postalAddress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "string",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
}
},
"transactionStatus": "ACCC",
"apiClientMessages": [{"category": "string",
"code": "FORMAT_ERROR",
"path": "string",
"text": "Text, maximum of 500 characters."
}
]
}

Payment Cancellation Request

Initiates the cancellation of a payment See "XS2A API as PSD2 Interface Implementation Guidelines ", section "Payment Cancellation Request".

Authorizations:

NoneBearerAuthOAuth

path Parameters

payment-service required	string Enum: "payments" "bulk-payments" "periodic-payments" Example: payments Payment service: Possible values are: payments bulk-payments periodic-payments
payment-product required	string Enum: "sepa-credit-transfers" "instant-sepa-credit-transfers" "target-2-payments" "cross-border-credit-transfers" "pain.001-sepa-credit-transfers" "pain.001-instant-sepa-credit-transfers" "pain.001-target-2-payments" "pain.001-cross-border-credit-transfers" "pain.001-proprietary-credit-transfers" Example: sepa-credit-transfers The payment product, under which the payment under paymentId has been initiated. It shall be checked by the ASPSP, if the payment-product is matching the payment initiation addressed by paymentId.
paymentId required	string (Max70Text) <= 70 characters Example: fe7552ee-0728-4bd1-baf7-94942331e478 Resource identification of the related payment.

header Parameters

PSU-IP-Port	string Example: 1234 The forwarded IP Port header field consists of the corresponding HTTP request IP Port field between PSU and TPP, if available.
PSU-Accept	string Example: application/json The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Charset	string Example: * The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Encoding	string Example: * The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Language	string Example: en-gb,en;0.8 The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-User-Agent	string Example: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 The forwarded Agent header field of the HTTP request between PSU and TPP, if available.
PSU-Http-Method	string Enum: "GET" "POST" "PUT" "PATCH" "DELETE" Example: GET HTTP method used at the PSU ? TPP interface, if available. Valid values are: GET POST PUT PATCH DELETE
PSU-Device-ID	string <uuid> Example: 99435c7e-ad88-49ec-a2ad-99ddcb1f5555 UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of an installation identification this ID needs to be unaltered until removal from device.
PSU-Geo-Location	stringGEO:-?[0-9]{1,2}\.[0-9]{6};-?[0-9]{1,3}\.[0-9... Example: GEO:52.506931;13.144558 The forwarded Geo Location of the corresponding http request between PSU and TPP if available.
PSU-ID	string (Max140Text) <= 140 characters Example: PSU-1234 Client ID of the PSU in the ASPSP client interface. Might be mandated in the ASPSP's documentation. It might be contained even if an OAuth2 based authentication was performed in a pre-step or an OAuth2 based SCA was performed in an preceding AIS service in the same session. In this case the ASPSP might check whether PSU-ID and token match, according to ASPSP documentation.
PSU-ID-Type	string (Max35Text) <= 35 characters Example: PSU-ID-TYPE_C Type of the PSU-ID, needed in scenarios where PSUs have several PSU-IDs as access possibility. In this case, the mean and use are then defined in the ASPSP's documentation.
PSU-Corporate-ID	string (Max140Text) <= 140 characters Example: PSU-CORP-ID1234 Might be mandated in the ASPSP's documentation. Only used in a corporate context.
PSU-Corporate-ID-Type	string (Max35Text) <= 35 characters Example: PSU-CORP-ID-TYPE_A Might be mandated in the ASPSP's documentation. Only used in a corporate context.
Client-SCA-Approach-Preference	string (Max35Text) <= 35 characters Example: decoupled, redirect, embedded A comma separated list of attributes, where the first entry will have a higher priority than the next or to every SCA Approach which is not indicated at all, e.g. "decoupled, redirect, embedded" or "decoupled" This attribute may be ignored by the ASPSP
Client-Redirect-URI	string <uri> Example: https://exampleclient.com/redirectUri?clientEvent=11111111 URI of the TPP, where the transaction flow shall be redirected to after a Redirect. Mandated for the Redirect SCA Approach. It is recommended to always use this header field.
Client-Nok-Redirect-URI	string <uri> Example: https://exampleclient.com/NokUri?clientEvent=11111111 If this URI is contained, the TPP is asking to redirect the transaction flow to this address instead of the Client-Redirect-URI in case of a negative result of the redirect SCA method. This might be ignored by the ASPSP.
Client-Explicit-Authorisation-Preferred	boolean Example: true If it equals "true", the API Client prefers to start the authorisation process separately, e.g. because of the usage of a signing basket or because of asynchronous authorisation. This preference might be ignored by the ASPSP, if a signing basket is not supported as functionality or if asynchronous authorisation is not supported. If it equals "false" or if the parameter is not used, there is no preference of the API Client. This especially indicates that the API Client assumes a direct authorisation of the transaction in the next step, without using a signing basket.
Client-Notification-URI	string Example: https://exampleclient.com/NotificationUri?clientEvent=11111111 URI for the Endpoint of the Client API to which the status of the resource should be sent. This header field may by ignored by the ASPSP if the resource status push function is not supported for the related API client.
Client-Notification-Content-Preferred	string Example: status=SCA The string has the form status=X1, ..., Xn where Xi is one of the constants SCA, PROCESS, LAST and where constants are not repeated. The usage of the constants supports the of following semantics: SCA: A notification on every change of the scaStatus attribute for all related authorisation processes is preferred by the API Client. PROCESS: A notification on all changes of consentStatus or transactionStatus attributes is preferred by the API Client. LAST: Only a notification on the last consentStatus or transactionStatus as available in the XS2A interface is preferred by the API Client. This header field may be ignored, if the ASPSP does not support resource notification services for the related API Client.
Client-Brand-Logging-Information	string (Max140Text) <= 140 characters Example: ClientBrandB This header might be used by API Clients to inform the ASPSP about the brand used by the API Client towards the PSU. This information is meant for logging entries to enhance communication between ASPSP and PSU or ASPSP and API Client. This header might be ignored by the ASPSP.
Digest	string Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A= When API Client include a signature according to this signature profile, they also must include a "Digest" header as defined in [RFC3230]. The "Digest" Header contains a Hash of the message body. If the message does not contain a body, the "Digest" header must contain the hash of an empty byte list. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512 as defined in [RFC5843].
x-jws-signature	string Example: eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIwLTEwLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyJ4LXJlcXVlc3QtaWQiLCJkaWdlc3QiXSwibUlkIjoiaHR0cDovL3VyaS5ldHNpLm9yZy8xOTE4Mi9IdHRwSGVhZGVycyJ9LCJhbGciOiJSUzI1NiJ9..NuGglWBtHcXavob2ZmW-PoSpMmhJS9U6z8zPqHFoE97vHI3z8wtaVdbwsj5WzgPjtVWUUnk8cxP4JjLXdwzwhhHB2uJ5FI4ZZGdSQQw-9pXPUx3cCJSzHmrgkJ-di-A4 The attribute x-jws-signature contains the JSON Web Signature.
X-Request-ID required	string <uuid> Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721 ID of the request, unique to the call, as determined by the initiating party.

Responses

Response samples

Content type

application/json

{"transactionStatus": "ACCC",
"scaMethods": [{"authenticationType": "PUSH_OTP",
"authenticationVersion": "string",
"authenticationMethodId": "Text, maximum of 35 characters.",
"name": "string",
"explanation": "string"
}
],
"chosenScaMethod": {"authenticationType": "PUSH_OTP",
"authenticationVersion": "string",
"authenticationMethodId": "Text, maximum of 35 characters.",
"name": "string",
"explanation": "string"
},
"challengeData": {"image": "string",
"data": ["string"
],
"imageLink": "string",
"otpMaxLength": 0,
"otpFormat": "string",
"additionalInformation": "string"
},
"_links": {"scaRedirect": {"href": "string"
},
"scaOAuth": {"href": "string"
},
"confirmation": {"href": "string"
},
"startAuthorisation": {"href": "string"
},
"startAuthorisationWithPsuIdentification": {"href": "string"
},
"startAuthorisationWithPsuAuthentication": {"href": "string"
},
"startAuthorisationWithEncryptedPsuAuthentication": {"href": "string"
},
"startAuthorisationWithAuthenticationMethodSelection": {"href": "string"
},
"startAuthorisationWithTransactionAuthorisation": {"href": "string"
},
"self": {"href": "string"
},
"status": {"href": "string"
},
"scaStatus": {"href": "string"
},
"encryptionCertificates": [{"href": "string"
}
],
"property1": {"href": "string"
},
"property2": {"href": "string"
}
}
}

Bulk Payment Extended Status Request

Can check the overall status of a bulk payment initiation together with reporting rejected transactions. See "XS2A API as PSD2 Interface Implementation Guidelines ", section "Get Bulk Extended Status Request".

Authorizations:

NoneBearerAuthOAuth

path Parameters

payment-product

required

string

Example: sepa-credit-transfers

The payment product, under which the payment under paymentId has been initiated. It shall be checked by the ASPSP, if the payment-product is matching the payment initiation addressed by paymentId.

paymentId

required

string (Max70Text) <= 70 characters

Example: fe7552ee-0728-4bd1-baf7-94942331e478

Resource identification of the related payment.

header Parameters

Digest	string Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A= When API Client include a signature according to this signature profile, they also must include a "Digest" header as defined in [RFC3230]. The "Digest" Header contains a Hash of the message body. If the message does not contain a body, the "Digest" header must contain the hash of an empty byte list. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512 as defined in [RFC5843].
x-jws-signature	string Example: eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIwLTEwLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyJ4LXJlcXVlc3QtaWQiLCJkaWdlc3QiXSwibUlkIjoiaHR0cDovL3VyaS5ldHNpLm9yZy8xOTE4Mi9IdHRwSGVhZGVycyJ9LCJhbGciOiJSUzI1NiJ9..NuGglWBtHcXavob2ZmW-PoSpMmhJS9U6z8zPqHFoE97vHI3z8wtaVdbwsj5WzgPjtVWUUnk8cxP4JjLXdwzwhhHB2uJ5FI4ZZGdSQQw-9pXPUx3cCJSzHmrgkJ-di-A4 The attribute x-jws-signature contains the JSON Web Signature.
X-Request-ID required	string <uuid> Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721 ID of the request, unique to the call, as determined by the initiating party.

Responses

Response samples

Content type

application/json

{"groupStatus": "PART",
"reasonCode": "AM04",
"reasonProprietary": "Text, maximum of 35 characters.",
"fundsAvailable": true,
"originalTransactionInformationAndStatus": {"originalInstructionId": "Text, maximum of 35 characters.",
"originalEndToEndId": "Text, maximum of 35 characters.",
"originalUetr": "99435c7e-ad88-49ec-a2ad-99ddcb1f5555",
"transactionStatus": "ACCC",
"statusReasonInformationCode": "AM04",
"statusReasonInformationProprietary": "Text, maximum of 35 characters.",
"statusReasonAdditionalInformation": "Text, maximum of 105 characters.",
"originalTransactionReference": {"instructedAmount": {"currency": "EUR",
"amount": "string"
},
"equivalentAmount": {"amount": {"currency": "EUR",
"amount": "string"
},
"currencyOfTransfer": "EUR"
},
"creditor": {"name": "Text, maximum of 140 characters.",
"postaladdress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"identification": {"organisationId": {"anyBIC": "ECBFDEFFFIM",
"lei": "549300DTUYXVMJXZNY75",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "BOID",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
},
"privateId": {"birthDate": "2020-01-01",
"provinceOfBirth": "Text, maximum of 35 characters.",
"cityOfBirth": "Text, maximum of 35 characters.",
"countryOfBirth": "SE",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "NIDN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
}
},
"additionalPartyInformation": {"tradeName": "Text, maximum of 70 characters.",
"merchantCategoryCode": "stri",
"logoURL": "Text, maximum of 2048 characters.",
"geoLocation": "GEO:52.506931;13.144558"
}
},
"creditorAccount": {"iban": "FR7612345987650123456789014",
"bban": "BARC12345612345678",
"pan": "Text, maximum of 35 characters.",
"maskedPan": "Text, maximum of 35 characters.",
"msisdn": "Text, maximum of 35 characters.",
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "AIIN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
},
"typeCode": "CACC",
"typeProprietary": "Text, maximum of 35 characters.",
"currency": "EUR",
"proxy": {"typeCode": "EMAL",
"typeProprietary": "Text, maximum of 35 characters.",
"identification": "Text, maximum of 2048 characters."
},
"name": "Text, maximum of 70 characters.",
"owner": {"name": "Text, maximum of 140 characters.",
"postaladdress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
}
},
"servicer": {"bicfi": "ECBFDEFFFIM",
"clearingSystemMemberId": {"memberId": "Text, maximum of 35 characters.",
"clearingSystemIdentificationCode": "DEBLZ",
"clearingSystemIdentificationProprietary": "Text, maximum of 35 characters."
},
"name": "Text, maximum of 140 characters.",
"postalAddress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "string",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
}
},
"ultimateCreditor": {"name": "Text, maximum of 140 characters.",
"postaladdress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"identification": {"organisationId": {"anyBIC": "ECBFDEFFFIM",
"lei": "549300DTUYXVMJXZNY75",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "BOID",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
},
"privateId": {"birthDate": "2020-01-01",
"provinceOfBirth": "Text, maximum of 35 characters.",
"cityOfBirth": "Text, maximum of 35 characters.",
"countryOfBirth": "SE",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "NIDN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
}
},
"additionalPartyInformation": {"tradeName": "Text, maximum of 70 characters.",
"merchantCategoryCode": "stri",
"logoURL": "Text, maximum of 2048 characters.",
"geoLocation": "GEO:52.506931;13.144558"
}
}
}
},
"transactionFees": {"currency": "EUR",
"amount": "string"
},
"currencyConversionFees": {"currency": "EUR",
"amount": "string"
},
"estimatedTotalAmount": {"currency": "EUR",
"amount": "string"
},
"estimatedInterbankSettlementAmount": {"currency": "EUR",
"amount": "string"
},
"psuMessage": "Text, maximum of 500 characters.",
"ownerNames": [{"name": "Text, maximum of 70 characters.",
"role": "Text, maximum of 35 characters.",
"postalAddress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"identification": {"organisationId": {"anyBIC": "ECBFDEFFFIM",
"lei": "549300DTUYXVMJXZNY75",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "BOID",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
},
"privateId": {"birthDate": "2020-01-01",
"provinceOfBirth": "Text, maximum of 35 characters.",
"cityOfBirth": "Text, maximum of 35 characters.",
"countryOfBirth": "SE",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "NIDN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
}
},
"countryOfResidence": "SE",
"contactDetails": {"namePrefix": "MADM",
"name": "Text, maximum of 70 characters.",
"phoneNumber": "Text, maximum of 35 characters.",
"mobileNumber": "Text, maximum of 35 characters.",
"faxNumber": "Text, maximum of 35 characters.",
"emailAddress": "Text, maximum of 70 characters.",
"emailPurpose": "Text, maximum of 35 characters.",
"jobTitle": "Text, maximum of 35 characters.",
"responsibility": "Text, maximum of 35 characters.",
"department": "Text, maximum of 35 characters.",
"preferredMethod": "MAIL"
}
}
],
"_links": {"scaRedirect": {"href": "string"
},
"scaOAuth": {"href": "string"
},
"confirmation": {"href": "string"
},
"startAuthorisation": {"href": "string"
},
"startAuthorisationWithPsuIdentification": {"href": "string"
},
"startAuthorisationWithPsuAuthentication": {"href": "string"
},
"startAuthorisationWithEncryptedPsuAuthentication": {"href": "string"
},
"startAuthorisationWithAuthenticationMethodSelection": {"href": "string"
},
"startAuthorisationWithTransactionAuthorisation": {"href": "string"
},
"self": {"href": "string"
},
"status": {"href": "string"
},
"scaStatus": {"href": "string"
},
"encryptionCertificates": [{"href": "string"
}
],
"property1": {"href": "string"
},
"property2": {"href": "string"
}
},
"apiClientMessages": [{"category": "string",
"code": "FORMAT_ERROR",
"path": "string",
"text": "Text, maximum of 500 characters."
}
]
}

Authorisation

Start Authorisation Process

Creates an account information consent resource at the ASPSP regarding access to account information to account types and accounts specified in this request.

Authorizations:

NoneBearerAuthOAuth

path Parameters

resource-path required	string Example: consents/account-access This resource path can be a one-level parameter {service} or a two-level parameter {service}/{product-type}, where {service} stands for the service type of the related business transaction, e.g. /payments or /consents source. {product-type} stands for the product-type of the related business transaction where applicable, e.g. sepa-credit-transfers in the case of payments or account-access in case of consents.
resourceId required	string (Max70Text) <= 70 characters Example: 1234-resource-567 Resource identification of the related payment initiation, signing basket, consent, subscription or other related business transaction resource.
authorisation-category required	string Enum: "authorisations" "cancellation-authorisations" Example: authorisations The following two categories are supported: authorisations: used in case of an authorisation of the related business transaction. cancellation-authorisations: used in case of the cancellation authorisation of the related business transaction. Used only if applicable to the addressed {service}

header Parameters

PSU-IP-Address	string <ipv4> Example: 192.168.8.78 The forwarded IP Address header field consists of the corresponding HTTP request IP Address field between PSU and TPP. Conditions will be defined within service specifications, If applicable.
PSU-IP-Port	string Example: 1234 The forwarded IP Port header field consists of the corresponding HTTP request IP Port field between PSU and TPP, if available.
PSU-Accept	string Example: application/json The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Charset	string Example: * The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Encoding	string Example: * The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Language	string Example: en-gb,en;0.8 The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-User-Agent	string Example: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 The forwarded Agent header field of the HTTP request between PSU and TPP, if available.
PSU-Http-Method	string Enum: "GET" "POST" "PUT" "PATCH" "DELETE" Example: GET HTTP method used at the PSU ? TPP interface, if available. Valid values are: GET POST PUT PATCH DELETE
PSU-Device-ID	string <uuid> Example: 99435c7e-ad88-49ec-a2ad-99ddcb1f5555 UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of an installation identification this ID needs to be unaltered until removal from device.
PSU-Geo-Location	stringGEO:-?[0-9]{1,2}\.[0-9]{6};-?[0-9]{1,3}\.[0-9... Example: GEO:52.506931;13.144558 The forwarded Geo Location of the corresponding http request between PSU and TPP if available.
Digest	string Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A= When API Client include a signature according to this signature profile, they also must include a "Digest" header as defined in [RFC3230]. The "Digest" Header contains a Hash of the message body. If the message does not contain a body, the "Digest" header must contain the hash of an empty byte list. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512 as defined in [RFC5843].
x-jws-signature	string Example: eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIwLTEwLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyJ4LXJlcXVlc3QtaWQiLCJkaWdlc3QiXSwibUlkIjoiaHR0cDovL3VyaS5ldHNpLm9yZy8xOTE4Mi9IdHRwSGVhZGVycyJ9LCJhbGciOiJSUzI1NiJ9..NuGglWBtHcXavob2ZmW-PoSpMmhJS9U6z8zPqHFoE97vHI3z8wtaVdbwsj5WzgPjtVWUUnk8cxP4JjLXdwzwhhHB2uJ5FI4ZZGdSQQw-9pXPUx3cCJSzHmrgkJ-di-A4 The attribute x-jws-signature contains the JSON Web Signature.
X-Request-ID required	string <uuid> Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721 ID of the request, unique to the call, as determined by the initiating party.
Body-Sig-Profile	string Enum: "JAdES_JS" "XAdES" "EMV_AC" Example: XAdES Indicates the signature profile used for signing (parts of) the body. Shall be used if the body is signed.
Body-Enc-Profile	string Enum: "JWE_CS" "XML_ENC" Example: JWE_CS Indicates the encryption profile used for the encryption of (parts of) the body.
Body-Enc-List	string Example: BODY Contains a List of names of data elements/ attributes of the body which contain encrypted information
PSU-ID	string (Max140Text) <= 140 characters Example: PSU-1234 Client ID of the PSU in the ASPSP client interface. Might be mandated in the ASPSP's documentation. It might be contained even if an OAuth2 based authentication was performed in a pre-step or an OAuth2 based SCA was performed in an preceding AIS service in the same session. In this case the ASPSP might check whether PSU-ID and token match, according to ASPSP documentation.
PSU-ID-Type	string (Max35Text) <= 35 characters Example: PSU-ID-TYPE_C Type of the PSU-ID, needed in scenarios where PSUs have several PSU-IDs as access possibility. In this case, the mean and use are then defined in the ASPSP's documentation.
PSU-Corporate-ID	string (Max140Text) <= 140 characters Example: PSU-CORP-ID1234 Might be mandated in the ASPSP's documentation. Only used in a corporate context.
PSU-Corporate-ID-Type	string (Max35Text) <= 35 characters Example: PSU-CORP-ID-TYPE_A Might be mandated in the ASPSP's documentation. Only used in a corporate context.
Client-SCA-Approach-Preference	string (Max35Text) <= 35 characters Example: decoupled, redirect, embedded A comma separated list of attributes, where the first entry will have a higher priority than the next or to every SCA Approach which is not indicated at all, e.g. "decoupled, redirect, embedded" or "decoupled" This attribute may be ignored by the ASPSP
Client-Redirect-URI	string <uri> Example: https://exampleclient.com/redirectUri?clientEvent=11111111 URI of the TPP, where the transaction flow shall be redirected to after a Redirect. Mandated for the Redirect SCA Approach. It is recommended to always use this header field.
Client-Nok-Redirect-URI	string <uri> Example: https://exampleclient.com/NokUri?clientEvent=11111111 If this URI is contained, the TPP is asking to redirect the transaction flow to this address instead of the Client-Redirect-URI in case of a negative result of the redirect SCA method. This might be ignored by the ASPSP.

Request Body schema: application/json

Any of

required

object

The password, orencryptedPassword, subfield is used, depending depending on encryption requirements of the ASPSP as indicated in the corresponding hyperlink contained in the preceding response message of the ASPSP. The related encryption requirements are defined in Document "Protocol Functions and Security Measures".

password	string Contains a password in plaintext.
encryptedPassword	string Is used when a password is encrypted on application level.

Responses

Request samples

Payload

Content type

application/json

{"authenticationMethodId": "string"
}

Response samples

Content type

application/json

{"transactionFees": {"currency": "EUR",
"amount": "string"
},
"currencyConversionFees": {"currency": "EUR",
"amount": "string"
},
"estimatedTotalAmount": {"currency": "EUR",
"amount": "string"
},
"estimatedInterbankSettlementAmount": {"currency": "EUR",
"amount": "string"
},
"scaStatus": "received",
"authorisationId": "string",
"originalTransactionInformationAndVopStatus": [{"originalInstructionId": "Text, maximum of 35 characters.",
"originalEndToEndId": "Text, maximum of 35 characters.",
"originalUetr": "99435c7e-ad88-49ec-a2ad-99ddcb1f5555",
"transactionStatus": "ACCC",
"statusReasonInformationCode": "AM04",
"statusReasonInformationProprietary": "Text, maximum of 35 characters.",
"statusReasonAdditionalInformation": "Text, maximum of 105 characters.",
"originalTransactionReference": {"instructedAmount": {"currency": "EUR",
"amount": "string"
},
"equivalentAmount": {"amount": {"currency": "EUR",
"amount": "string"
},
"currencyOfTransfer": "EUR"
},
"creditor": {"name": "Text, maximum of 140 characters.",
"postaladdress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"identification": {"organisationId": {"anyBIC": "ECBFDEFFFIM",
"lei": "549300DTUYXVMJXZNY75",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "BOID",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
},
"privateId": {"birthDate": "2020-01-01",
"provinceOfBirth": "Text, maximum of 35 characters.",
"cityOfBirth": "Text, maximum of 35 characters.",
"countryOfBirth": "SE",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "NIDN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
}
},
"additionalPartyInformation": {"tradeName": "Text, maximum of 70 characters.",
"merchantCategoryCode": "stri",
"logoURL": "Text, maximum of 2048 characters.",
"geoLocation": "GEO:52.506931;13.144558"
}
},
"creditorAccount": {"iban": "FR7612345987650123456789014",
"bban": "BARC12345612345678",
"pan": "Text, maximum of 35 characters.",
"maskedPan": "Text, maximum of 35 characters.",
"msisdn": "Text, maximum of 35 characters.",
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "AIIN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
},
"typeCode": "CACC",
"typeProprietary": "Text, maximum of 35 characters.",
"currency": "EUR",
"proxy": {"typeCode": "EMAL",
"typeProprietary": "Text, maximum of 35 characters.",
"identification": "Text, maximum of 2048 characters."
},
"name": "Text, maximum of 70 characters.",
"owner": {"name": "Text, maximum of 140 characters.",
"postaladdress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
}
},
"servicer": {"bicfi": "ECBFDEFFFIM",
"clearingSystemMemberId": {"memberId": "Text, maximum of 35 characters.",
"clearingSystemIdentificationCode": "DEBLZ",
"clearingSystemIdentificationProprietary": "Text, maximum of 35 characters."
},
"name": "Text, maximum of 140 characters.",
"postalAddress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"other": {"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "string",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
}
},
"ultimateCreditor": {"name": "Text, maximum of 140 characters.",
"postaladdress": {"addressLines": ["Text, maximum of 140 characters."
],
"department": "Text, maximum of 70 characters.",
"subDepartment": "Text, maximum of 70 characters.",
"streetName": "Text, maximum of 70 characters.",
"buildingNumber": "16 Chars at most",
"buildingName": "Text, maximum of 35 characters.",
"floor": "Text, maximum of 70 characters.",
"postBox": "16 Chars at most",
"room": "Text, maximum of 70 characters.",
"postCode": "16 Chars at most",
"townName": "Text, maximum of 35 characters.",
"townLocationName": "Text, maximum of 35 characters.",
"districtName": "Text, maximum of 35 characters.",
"countrySubDivision": "Text, maximum of 35 characters.",
"country": "SE"
},
"identification": {"organisationId": {"anyBIC": "ECBFDEFFFIM",
"lei": "549300DTUYXVMJXZNY75",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "BOID",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
},
"privateId": {"birthDate": "2020-01-01",
"provinceOfBirth": "Text, maximum of 35 characters.",
"cityOfBirth": "Text, maximum of 35 characters.",
"countryOfBirth": "SE",
"others": [{"identification": "Text, maximum of 35 characters.",
"schemeNameCode": "NIDN",
"schemeNameProprietary": "Text, maximum of 35 characters.",
"issuer": "Text, maximum of 35 characters."
}
]
}
},
"additionalPartyInformation": {"tradeName": "Text, maximum of 70 characters.",
"merchantCategoryCode": "stri",
"logoURL": "Text, maximum of 2048 characters.",
"geoLocation": "GEO:52.506931;13.144558"
}
}
},
"creditorNameMatch": "MBAM",
"creditorOrganisationIdMatch": "MTCH",
"matchedCreditorName": "Text, maximum of 140 characters."
}
],
"scaMethods": [{"authenticationType": "PUSH_OTP",
"authenticationVersion": "string",
"authenticationMethodId": "Text, maximum of 35 characters.",
"name": "string",
"explanation": "string"
}
],
"chosenScaMethod": {"authenticationType": "PUSH_OTP",
"authenticationVersion": "string",
"authenticationMethodId": "Text, maximum of 35 characters.",
"name": "string",
"explanation": "string"
},
"challengeData": {"image": "string",
"data": ["string"
],
"imageLink": "string",
"otpMaxLength": 0,
"otpFormat": "string",
"additionalInformation": "string"
},
"_links": {"scaRedirect": {"href": "string"
},
"scaOAuth": {"href": "string"
},
"confirmation": {"href": "string"
},
"updatePsuAuthentication": {"href": "string"
},
"updateEncryptedPsuAuthentication": {"href": "string"
},
"selectAuthenticationMethod": {"href": "string"
},
"authoriseTransaction": {"href": "string"
},
"scaStatus": {"href": "string"
},
"transactionFees": {"href": "string"
},
"encryptionCertificates": [{"href": "string"
}
],
"property1": {"href": "string"
},
"property2": {"href": "string"
}
},
"psuMessage": "Text, maximum of 500 characters."
}

Get Authorisation Sub-Resources Request

Will deliver an array of resource identifications of all generated authorisation or cancellation authorisation sub-resources.

Authorizations:

NoneBearerAuthOAuth

path Parameters

resource-path required	string Example: consents/account-access This resource path can be a one-level parameter {service} or a two-level parameter {service}/{product-type}, where {service} stands for the service type of the related business transaction, e.g. /payments or /consents source. {product-type} stands for the product-type of the related business transaction where applicable, e.g. sepa-credit-transfers in the case of payments or account-access in case of consents.
resourceId required	string (Max70Text) <= 70 characters Example: 1234-resource-567 Resource identification of the related payment initiation, signing basket, consent, subscription or other related business transaction resource.
authorisation-category required	string Enum: "authorisations" "cancellation-authorisations" Example: authorisations The following two categories are supported: authorisations: used in case of an authorisation of the related business transaction. cancellation-authorisations: used in case of the cancellation authorisation of the related business transaction. Used only if applicable to the addressed {service}

header Parameters

Digest	string Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A= When API Client include a signature according to this signature profile, they also must include a "Digest" header as defined in [RFC3230]. The "Digest" Header contains a Hash of the message body. If the message does not contain a body, the "Digest" header must contain the hash of an empty byte list. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512 as defined in [RFC5843].
x-jws-signature	string Example: eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIwLTEwLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyJ4LXJlcXVlc3QtaWQiLCJkaWdlc3QiXSwibUlkIjoiaHR0cDovL3VyaS5ldHNpLm9yZy8xOTE4Mi9IdHRwSGVhZGVycyJ9LCJhbGciOiJSUzI1NiJ9..NuGglWBtHcXavob2ZmW-PoSpMmhJS9U6z8zPqHFoE97vHI3z8wtaVdbwsj5WzgPjtVWUUnk8cxP4JjLXdwzwhhHB2uJ5FI4ZZGdSQQw-9pXPUx3cCJSzHmrgkJ-di-A4 The attribute x-jws-signature contains the JSON Web Signature.
X-Request-ID required	string <uuid> Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721 ID of the request, unique to the call, as determined by the initiating party.

Responses

Response samples

Content type

application/json

{"authorisationIds": ["string"
]
}

Get Authorisation Status Request

Checks the SCA status of an authorisation or cancellation authorisation sub-resource.

Authorizations:

NoneBearerAuthOAuth

path Parameters

resource-path required	string Example: consents/account-access This resource path can be a one-level parameter {service} or a two-level parameter {service}/{product-type}, where {service} stands for the service type of the related business transaction, e.g. /payments or /consents source. {product-type} stands for the product-type of the related business transaction where applicable, e.g. sepa-credit-transfers in the case of payments or account-access in case of consents.
resourceId required	string (Max70Text) <= 70 characters Example: 1234-resource-567 Resource identification of the related payment initiation, signing basket, consent, subscription or other related business transaction resource.
authorisation-category required	string Enum: "authorisations" "cancellation-authorisations" Example: authorisations The following two categories are supported: authorisations: used in case of an authorisation of the related business transaction. cancellation-authorisations: used in case of the cancellation authorisation of the related business transaction. Used only if applicable to the addressed {service}
authorisationId required	string (Max70Text) <= 70 characters Example: 123auth456 Resource identification of the related SCA.

header Parameters

Digest	string Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A= When API Client include a signature according to this signature profile, they also must include a "Digest" header as defined in [RFC3230]. The "Digest" Header contains a Hash of the message body. If the message does not contain a body, the "Digest" header must contain the hash of an empty byte list. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512 as defined in [RFC5843].
x-jws-signature	string Example: eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIwLTEwLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyJ4LXJlcXVlc3QtaWQiLCJkaWdlc3QiXSwibUlkIjoiaHR0cDovL3VyaS5ldHNpLm9yZy8xOTE4Mi9IdHRwSGVhZGVycyJ9LCJhbGciOiJSUzI1NiJ9..NuGglWBtHcXavob2ZmW-PoSpMmhJS9U6z8zPqHFoE97vHI3z8wtaVdbwsj5WzgPjtVWUUnk8cxP4JjLXdwzwhhHB2uJ5FI4ZZGdSQQw-9pXPUx3cCJSzHmrgkJ-di-A4 The attribute x-jws-signature contains the JSON Web Signature.
X-Request-ID required	string <uuid> Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721 ID of the request, unique to the call, as determined by the initiating party.

Responses

Response samples

Content type

application/json

{"scaStatus": "received",
"psuName": "Text, maximum of 140 characters.",
"_links": {"scaStatus": {"href": "string"
},
"property1": {"href": "string"
},
"property2": {"href": "string"
}
},
"apiClientMessages": [{"category": "string",
"code": "FORMAT_ERROR",
"path": "string",
"text": "Text, maximum of 500 characters."
}
]
}

Update PSU Data

Updates the addressed authorisation sub-resource data on the server by PSU data if requested by the ASPSP.

Authorizations:

NoneBearerAuthOAuth

path Parameters

resource-path required	string Example: consents/account-access This resource path can be a one-level parameter {service} or a two-level parameter {service}/{product-type}, where {service} stands for the service type of the related business transaction, e.g. /payments or /consents source. {product-type} stands for the product-type of the related business transaction where applicable, e.g. sepa-credit-transfers in the case of payments or account-access in case of consents.
resourceId required	string (Max70Text) <= 70 characters Example: 1234-resource-567 Resource identification of the related payment initiation, signing basket, consent, subscription or other related business transaction resource.
authorisation-category required	string Enum: "authorisations" "cancellation-authorisations" Example: authorisations The following two categories are supported: authorisations: used in case of an authorisation of the related business transaction. cancellation-authorisations: used in case of the cancellation authorisation of the related business transaction. Used only if applicable to the addressed {service}
authorisationId required	string (Max70Text) <= 70 characters Example: 123auth456 Resource identification of the related SCA.

header Parameters

PSU-IP-Address	string <ipv4> Example: 192.168.8.78 The forwarded IP Address header field consists of the corresponding HTTP request IP Address field between PSU and TPP. Conditions will be defined within service specifications, If applicable.
PSU-IP-Port	string Example: 1234 The forwarded IP Port header field consists of the corresponding HTTP request IP Port field between PSU and TPP, if available.
PSU-Accept	string Example: application/json The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Charset	string Example: * The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Encoding	string Example: * The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Language	string Example: en-gb,en;0.8 The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-User-Agent	string Example: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 The forwarded Agent header field of the HTTP request between PSU and TPP, if available.
PSU-Http-Method	string Enum: "GET" "POST" "PUT" "PATCH" "DELETE" Example: GET HTTP method used at the PSU ? TPP interface, if available. Valid values are: GET POST PUT PATCH DELETE
PSU-Device-ID	string <uuid> Example: 99435c7e-ad88-49ec-a2ad-99ddcb1f5555 UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of an installation identification this ID needs to be unaltered until removal from device.
PSU-Geo-Location	stringGEO:-?[0-9]{1,2}\.[0-9]{6};-?[0-9]{1,3}\.[0-9... Example: GEO:52.506931;13.144558 The forwarded Geo Location of the corresponding http request between PSU and TPP if available.
Digest	string Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A= When API Client include a signature according to this signature profile, they also must include a "Digest" header as defined in [RFC3230]. The "Digest" Header contains a Hash of the message body. If the message does not contain a body, the "Digest" header must contain the hash of an empty byte list. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512 as defined in [RFC5843].
x-jws-signature	string Example: eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIwLTEwLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyJ4LXJlcXVlc3QtaWQiLCJkaWdlc3QiXSwibUlkIjoiaHR0cDovL3VyaS5ldHNpLm9yZy8xOTE4Mi9IdHRwSGVhZGVycyJ9LCJhbGciOiJSUzI1NiJ9..NuGglWBtHcXavob2ZmW-PoSpMmhJS9U6z8zPqHFoE97vHI3z8wtaVdbwsj5WzgPjtVWUUnk8cxP4JjLXdwzwhhHB2uJ5FI4ZZGdSQQw-9pXPUx3cCJSzHmrgkJ-di-A4 The attribute x-jws-signature contains the JSON Web Signature.
X-Request-ID required	string <uuid> Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721 ID of the request, unique to the call, as determined by the initiating party.
Body-Sig-Profile	string Enum: "JAdES_JS" "XAdES" "EMV_AC" Example: XAdES Indicates the signature profile used for signing (parts of) the body. Shall be used if the body is signed.
Body-Enc-Profile	string Enum: "JWE_CS" "XML_ENC" Example: JWE_CS Indicates the encryption profile used for the encryption of (parts of) the body.
Body-Enc-List	string Example: BODY Contains a List of names of data elements/ attributes of the body which contain encrypted information
PSU-ID	string (Max140Text) <= 140 characters Example: PSU-1234 Client ID of the PSU in the ASPSP client interface. Might be mandated in the ASPSP's documentation. It might be contained even if an OAuth2 based authentication was performed in a pre-step or an OAuth2 based SCA was performed in an preceding AIS service in the same session. In this case the ASPSP might check whether PSU-ID and token match, according to ASPSP documentation.
PSU-ID-Type	string (Max35Text) <= 35 characters Example: PSU-ID-TYPE_C Type of the PSU-ID, needed in scenarios where PSUs have several PSU-IDs as access possibility. In this case, the mean and use are then defined in the ASPSP's documentation.
PSU-Corporate-ID	string (Max140Text) <= 140 characters Example: PSU-CORP-ID1234 Might be mandated in the ASPSP's documentation. Only used in a corporate context.
PSU-Corporate-ID-Type	string (Max35Text) <= 35 characters Example: PSU-CORP-ID-TYPE_A Might be mandated in the ASPSP's documentation. Only used in a corporate context.

Request Body schema: application/json

Any of

required

object

The password, orencryptedPassword, subfield is used, depending depending on encryption requirements of the ASPSP as indicated in the corresponding hyperlink contained in the preceding response message of the ASPSP. The related encryption requirements are defined in document "Protocol Functions and Security Measures".

password	string Contains a password in plaintext.
encryptedPassword	string Is used when a password is encrypted on application level.

Responses

Request samples

Payload

Content type

application/json

{"confirmationCode": "string"
}

Response samples

Content type

application/json

{"scaStatus": "received",
"_links": {"scaRedirect": {"href": "string"
},
"scaOAuth": {"href": "string"
},
"confirmation": {"href": "string"
},
"updatePsuIdentification": {"href": "string"
},
"updatePsuAuthentication": {"href": "string"
},
"updateAdditionalPsuAuthentication": {"href": "string"
},
"updateEncryptedPsuAuthentication": {"href": "string"
},
"updateAdditionalEncryptedPsuAuthentication": {"href": "string"
},
"updateResourceByDebtorAccountResource": {"href": "string"
},
"selectAuthenticationMethod": {"href": "string"
},
"authoriseTransaction": {"href": "string"
},
"scaStatus": {"href": "string"
},
"transactionFees": {"href": "string"
},
"status": {"href": "string"
},
"encryptionCertificates": [{"href": "string"
}
],
"property1": {"href": "string"
},
"property2": {"href": "string"
}
},
"psuMessage": "Text, maximum of 500 characters."
}

Update Resource with Debtor Account

The following method is used to update a payment related resource by an account which is associated to a PSU, and which needs to be received from the ASPSP first in the response of the "Update PSU Data with Authentication Request". Remark: This procedure might be offered by the ASPSP in decoupled or embedded SCA channels to support "noManualIbanEntry" requirements from regulators for payment initiation.

Authorizations:

NoneBearerAuthOAuth

path Parameters

resource-path

required

string

Example: consents/account-access

This resource path can be a one-level parameter {service} or a two-level parameter {service}/{product-type}, where

{service} stands for the service type of the related business transaction, e.g. /payments or /consents source.
{product-type} stands for the product-type of the related business transaction where applicable, e.g. sepa-credit-transfers in the case of payments or account-access in case of consents.

resourceId

required

string (Max70Text) <= 70 characters

Example: 1234-resource-567

Resource identification of the related payment initiation, signing basket, consent, subscription or other related business transaction resource.

header Parameters

PSU-IP-Address	string <ipv4> Example: 192.168.8.78 The forwarded IP Address header field consists of the corresponding HTTP request IP Address field between PSU and TPP. Conditions will be defined within service specifications, If applicable.
PSU-IP-Port	string Example: 1234 The forwarded IP Port header field consists of the corresponding HTTP request IP Port field between PSU and TPP, if available.
PSU-Accept	string Example: application/json The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Charset	string Example: * The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Encoding	string Example: * The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-Accept-Language	string Example: en-gb,en;0.8 The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
PSU-User-Agent	string Example: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 The forwarded Agent header field of the HTTP request between PSU and TPP, if available.
PSU-Http-Method	string Enum: "GET" "POST" "PUT" "PATCH" "DELETE" Example: GET HTTP method used at the PSU ? TPP interface, if available. Valid values are: GET POST PUT PATCH DELETE
PSU-Device-ID	string <uuid> Example: 99435c7e-ad88-49ec-a2ad-99ddcb1f5555 UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of an installation identification this ID needs to be unaltered until removal from device.
PSU-Geo-Location	stringGEO:-?[0-9]{1,2}\.[0-9]{6};-?[0-9]{1,3}\.[0-9... Example: GEO:52.506931;13.144558 The forwarded Geo Location of the corresponding http request between PSU and TPP if available.
Digest	string Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A= When API Client include a signature according to this signature profile, they also must include a "Digest" header as defined in [RFC3230]. The "Digest" Header contains a Hash of the message body. If the message does not contain a body, the "Digest" header must contain the hash of an empty byte list. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512 as defined in [RFC5843].
x-jws-signature	string Example: eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIwLTEwLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyJ4LXJlcXVlc3QtaWQiLCJkaWdlc3QiXSwibUlkIjoiaHR0cDovL3VyaS5ldHNpLm9yZy8xOTE4Mi9IdHRwSGVhZGVycyJ9LCJhbGciOiJSUzI1NiJ9..NuGglWBtHcXavob2ZmW-PoSpMmhJS9U6z8zPqHFoE97vHI3z8wtaVdbwsj5WzgPjtVWUUnk8cxP4JjLXdwzwhhHB2uJ5FI4ZZGdSQQw-9pXPUx3cCJSzHmrgkJ-di-A4 The attribute x-jws-signature contains the JSON Web Signature.
X-Request-ID required	string <uuid> Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721 ID of the request, unique to the call, as determined by the initiating party.
Body-Sig-Profile	string Enum: "JAdES_JS" "XAdES" "EMV_AC" Example: XAdES Indicates the signature profile used for signing (parts of) the body. Shall be used if the body is signed.
Body-Enc-Profile	string Enum: "JWE_CS" "XML_ENC" Example: JWE_CS Indicates the encryption profile used for the encryption of (parts of) the body.
Body-Enc-List	string Example: BODY Contains a List of names of data elements/ attributes of the body which contain encrypted information

Request Body schema: application/json

Any of

required

object

The resourceId of the account as provided in the "Update PSU Data with Authentication Request" response shall be used as the technical account reference.

resourceId

string <uuid>

To be used in authorisation processes, when updating a resource by an account.

Responses

Request samples

Payload

Content type

application/json

{"debtorAccount": {"resourceId": "99435c7e-ad88-49ec-a2ad-99ddcb1f5555"
}
}

Response samples

Content type

application/json

{"chosenScaMethod": {"authenticationType": "PUSH_OTP",
"authenticationVersion": "string",
"authenticationMethodId": "Text, maximum of 35 characters.",
"name": "string",
"explanation": "string"
},
"challengeData": {"image": "string",
"data": ["string"
],
"imageLink": "string",
"otpMaxLength": 0,
"otpFormat": "string",
"additionalInformation": "string"
},
"scaMethods": [{"authenticationType": "PUSH_OTP",
"authenticationVersion": "string",
"authenticationMethodId": "Text, maximum of 35 characters.",
"name": "string",
"explanation": "string"
}
],
"_links": {"scaRedirect": {"href": "string"
},
"scaOAuth": {"href": "string"
},
"confirmation": {"href": "string"
},
"selectAuthenticationMethod": {"href": "string"
},
"authoriseTransaction": {"href": "string"
},
"scaStatus": {"href": "string"
},
"transactionFees": {"href": "string"
},
"status": {"href": "string"
},
"encryptionCertificates": [{"href": "string"
}
],
"property1": {"href": "string"
},
"property2": {"href": "string"
}
},
"psuMessage": "Text, maximum of 500 characters."
}

openFinance API Framework XS2A API as PSD2 Interface Implementation Guidelines - Payment Initiation Service (2.3)

Payment Initiation Service (PIS)

Payment Initiation Request for Single Payments

Authorizations:

path Parameters

header Parameters

Request Body schema: application/jsonapplication/xmlapplication/json

Responses

Request samples

Response samples

Payment Initiation Request for Bulk Payments

Authorizations:

path Parameters

header Parameters

Request Body schema: application/jsonapplication/xmlapplication/json

Responses

Request samples

Response samples

Payment Status Request

Authorizations:

path Parameters

header Parameters

Responses

Response samples

Get Payment Request

Authorizations:

path Parameters

header Parameters

Responses

Response samples

Payment Cancellation Request

Authorizations:

path Parameters

header Parameters

Responses

Response samples

Bulk Payment Extended Status Request

Authorizations:

path Parameters

header Parameters

Responses

Response samples

Authorisation

Start Authorisation Process

Authorizations:

path Parameters

header Parameters

Request Body schema: application/json

Responses

Request samples

Response samples

Get Authorisation Sub-Resources Request

Authorizations:

path Parameters

header Parameters

Responses

Response samples

Get Authorisation Status Request

Authorizations:

path Parameters

header Parameters

Responses

Response samples

Update PSU Data

Authorizations:

path Parameters

header Parameters

Request Body schema: application/json

Responses

Request samples

Response samples

Update Resource with Debtor Account

Authorizations:

path Parameters

header Parameters

Request Body schema: application/json

Responses

Request samples

Response samples

Request Body schema:
application/json

Request Body schema:
application/json