Accounts Information Service Provider Flow v1.3

1. Sign in to the WSO2 Open Banking API Manager Admin portal as an Approver at https://<WSO2_OB_APIM_HOST>:9443/admin.

2. Locate the approval request and click Assign To Me.
   

3. Click Start to start the approval process.
   
4. Select Approve then Complete.
   

Now the TPP can sign in to the API store. 

1. Sign in to the API Store as the TPP at https://<WSO2_OB_APIM_HOST>:9443/store.

2. Click Sign In and navigate to the Sign In page.

3. Enter the username and the password you entered when signing up as a TPP.

4. Click Sign In . 

The homepage of the API store is now displayed along with the APIs.

1. In the API store, click Applications.


   

2. Click Add Application .

   

3. Enter application details.

   

   Field	Description
   Name	Application name.
   Per Token Quota	Determines the maximum number of API requests accepted within a given duration.
   Description	This describes the purpose of the application.

4. Click Add. 

1. Generate the client assertion by signing the following JSON payload using the supported algorithms. The supported algorithms are RS256 and PS256.

   { 
   "alg": "<This will be the algorithm used for signing>", 
   "kid": "<This will be the certificate fingerprint>", 
   "typ": "JWT" 
   } 
   
   { 
   "iss": "<This is the issuer of the token, e.g., client ID of your application>", 
   "sub": "<This is the subject identifier of the issuer, e.g., client ID of your application>", 
   "exp": "<This is epoch time of the token expiration date/time>", 
   "iat": "<This is epoch time of the token issuance date/time>", 
   "jti": "<This is an incremental unique value>", 
   "aud": "<This is the audience that the ID token is intended for, e.g., https://<WSO2_OB_APIM_HOST>:8243/token>" 
   } 
   <signature>

   The value of the aud claim should contain the same value as the Identity Provider Entity ID.

    Click here to view the Identity Provider Entity ID:

   1. Sign in to the Identity and Access Management console at https://localhost:9446/carbon. 
   2. In the Main menu, go to Home > Identity > Identity Providers > Resident.
   3. View the value in Resident Identity Provider > Inbound Authentication Configuration > OAuth2/OpenID Connect Configuration > Identity Provider Entity ID. By default this value is set to https://localhost:8243/token.

2. Run the following cURL command in a command prompt to generate the access token. Update the placeholders with the relevant values.

   curl -v POST -H "Content-Type: application/x-www-form-urlencoded;charset=ISO-8859-1" -k -d "grant_type=client_credentials&scope=accounts+openid&client_assertion_type=<eg:-urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer>&client_assertion=<jwt_key>&redirect_uri=<The callback URL of your application>" https://<WSO2_OB_APIM_HOST>:8243/token

   The access token is now generated.

   
   

   You can use the same cURL command to regenerate the access token.

POST / consents - Create consent

First, the TPP must state the accounts and permissions in the account initiation request and send it to the bank. Then, the bank responds with a URL that redirects the PSU to provide the consent for the accounts that the TPP wishes to access. The request and the response are as follows:

POST /consents/{consentId}/authorisations - Start the authorisation process for a consent

The sample request is shown below using the request body that we used to seek access to PSU's account. In this case, the TPP is creating an authorisation subresource, that the PSU can use to authorise.

• The open banking solution sends the authorisation URL that was generated under scaOAuth link of the response. The response the TPP uses differs according to the authorisation as follows:

  Implicit authorisation	The response the TPP gets when initiating an account consent.
  Explicit authorisation	The response the TPP gets when invoking POST /consents/{consentId}/authorisations API resource.

  A sample well-known URL under scaOAuth parameter looks as below:

  {
  	"scaOAuth":
  		{
  		"href":"https://<WSO2_OB_APIM_HOST>:8243/.well-known/openid-configuration"
  		}
  	}

• Paste the authorisation URL in the web browser. The format for the authorisation URL looks as follows:

  Sample URL Format

  https://<WSO2_OB_APIM_HOST>:8243/authorize/?scope=YOUR_SCOPES&response_type=code&redirect_uri=REDIRECT_URI&state=DYNAMICALLY_SET_VALUE&code_challenge_method=YOUR_CODE_CHALLENGE_METHOD&client_id=ORGANIZATION_ID&code_challenge=YOUR_CODE_CHALLENGE

  Use the following table to find the descriptions for the parameters:

  Parameter	Description
  scope	This is the reference to the consent resource for account access. It is in the form of ais:<consentId>
  response_type	code is recommended.
  redirect_uri	The TPP's URI that the OAuth2 server redirects the PSU's user agent after the authorisation.
  state	Prevents XSRF attacks by TPP setting a dynamic value.
  code_challenge_method	Code verifier transformation method. It is recommended in the Berlin specification to use S256.
  client_id	As provided in the eIDAS certificate, the organization_Identifier must contain the following information in it: - "PSD" as 3 character legal person identity type reference - 2 character ISO 3166 country code representing the NCA country - hyphen-minus "-" and - 2-8 character NCA identifier (A-Z uppercase only, no separator - hyphen-minus "-" - PSP identifier (authorization number as specified by NCA)
  code_challenge	This is used to avoid code injection attacks using the PKCE challenge in the cryptographic RFC 7636. Go to https://tools.ietf.org/html/rfc7636 for more information on the cryptographic RFC 7636.

• The authorisation URL points to a web interface as follows:
  

• Upon the user approving or denying the account consent, the user can invoke consent/authorization API resource of the authentication endpoint. By invoking this API resource, the user retrieves the consent approval/denial, that is displayed on the consent web-app.

Use the following sample request in order to generate the user access token: