Domestic Scheduled Payments v3.1.1

1. Navigate to the API Store at https://<WSO2_OB_APIM_HOST>:9443/store

2. Select Sign-up that is on the top left corner of the homepage.

   

3. Provide the requested details on the Sign Up page.

    Click here for more information..

   a. Generic details:

   Field	Description
   Username/Email	The username/email that the TPP uses to sign in to the API Store.
   Password	The password that the TPP uses to sign in to the API Store.
   Retype Password	This is to prevent the TPP from accidentally setting an incorrect password.
   Last Name	This is the last name of the TPP.
   First Name	This is the first name of the TPP.

   
   

   b. Company details:

   Field	Description
   Legal Entity Name	The official name of the TPP.
   Country of Registration	The country in which the TPP is registered.
   Legal Identifier Number (LEI)	This identifies the TPP.
   Company Register	The organization that registered the TPP.
   Company Registration Number	Identifier issued at the TPP registration.
   Address Line 1	Address of the TPP.
   Address Line 2	Address of the TPP.
   City	City in which the TPP is located.
   Postal Code	Postal code of the geographical location of the TPP.
   Country	The country in which the TPP is located.

   
   

   c. Competent authority registration details:

   Field	Description
   Competent Authority	The regulatory body that authorises and supervises the open banking services delivered by the TPP.
   Competent Authority Country	Country of the competent authority that authorised the TPP to provide open banking services.
   Competent Authority Registration Number	The registration number issued by the Competent Authority to the TPP.
   URL of the Competent Authority Register Page	URL of the page that has the list of organizations authorised by the competent authority.
   Open Banking Roles	Captures the open banking roles the TPP is willing to take up: Account Information Service Provider: An Account Information Service Provider (AISP) provides an aggregated view of all the accounts and past transactions that a customer has with different banks. To provide this view to the customer, the AISP should have authorisation from the customer to view the corresponding transaction and balance information of all the payment accounts. The AISPs can also provide the facility to analyze the customer's spending patterns, expenses, and financial needs. Unlike a PISP, an AISP cannot transfer funds from a payment account. Payment Initiation Service Provider: A Payment Initiation Service Provider (PISP) initiates credit transfers on behalf of a bank's customer. After selecting PISP, indicate whether the TPP is authorised by a competent authority to provide the services of the selected roles. If the TPP is not yet registered to provide the services of the selected roles, indicate whether the TPP has applied for registration or not.

4. Read terms and conditions. Click the checkbox to agree to the terms and conditions.

   

5. Click Sign Up. A request to approve the TPP sign up is now sent to the Approver users.

   

POST /domestic-scheduled-payment-consents

This API endpoint allows the PISP to ask an ASPSP to create a new domestic-scheduled-payment-consent resource. The ASPSP creates the domestic-scheduled-payment-consent resource and responds with a unique ConsentId to refer to the resource.

• Use the following format in the request body. 

  {
    "Data": {
      "Permission":"Create",
      "Initiation": {
        "RequestedExecutionDate": "2018-08-06T00:00:00+00:00",
        "InstructedAmount": {
          "Amount": "200.00",
          "Currency": "GBP"
        },
        "DebtorAccount": {
          "SchemeName": "UK.OBIE.SortCodeAccountNumber",
          "Identification": "11280001234567",
          "Name": "Andrea Frost"
        },
        "CreditorAccount": {
          "SchemeName": "UK.OBIE.SortCodeAccountNumber",
          "Identification": "08080021325698",
          "Name": "Tom Kirkman"
        },
        "RemittanceInformation": {
          "Reference": "DSR-037",
          "Unstructured": "Internal ops code 5120103"
        }
      }
    },
    "Risk": {
      "PaymentContextCode": "PartyToParty"
    }
  }

• Add all mandatory headers:
  • x-fapi-financial-id - The unique id of the ASPSP to which the request is issued. This id will be issued by the OBIE.

  • Authorization - An Authorisation Token as per https://tools.ietf.org/html/rfc6750. Enter the application access token, you generated from the above step.

  • x-idempotency-key - Every request will be processed only once per x-idempotency-key. The Idempotency key will be valid for 24 hours.
  • x-jws-signature - A detached JWS signature of the body of the payload.

• A sample request follows the format given below.

  curl POST \
    https://<WSO2_OB_APIM_HOST>:8243/open-banking/v3.1/pisp/domestic-scheduled-payment-consents \
    -H 'x-fapi-financial-id: OB/2017/001' \
    -H 'x-idempotency-key: 500415' \
    -H 'Authorizatio: Bearer <APPLICATION_ACCESS_TOKEN>' \
    -H 'Accept: application/json' \
    -H 'x-jws-signature: eyJhbGciOiJQUzI1NiIsImtpZCI6Imp5UlVjeXQxa1ZDbGNJdmxVbGNEdWtWWjN0VSIsImNyaXQiOlsiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay9pYXQiLCJodHRwOi8vb3BlbmJhbmtpbmcub3JnLnVrL3RhbiIsImh0dHA6Ly9vcGVuYmFua2luZy5vcmcudWsvaXNzIl0sImh0dHA6Ly9vcGVuYmFua2luZy5vcmcudWsvaWF0IjoxNjAxOTYzNTY0LCJodHRwOi8vb3BlbmJhbmtpbmcub3JnLnVrL3RhbiI6Im9wZW5iYW5raW5nLm9yZy51ayIsImh0dHA6Ly9vcGVuYmFua2luZy5vcmcudWsvaXNzIjoiQ049U0NtRXY5R1FlQnJuZFBaTlo1QVdObiwgT1U9MDAxNTgwMDAwMUhRUXJaQUFYLCBPPU9wZW5CYW5raW5nLCBDPUdCIn0..zm9EfBGWVEaCUvKBKW79peA1966tfNYMeKX533pkGeFPyuEQCFaXDjlw19ls0ErEupYhNfH88uUQKkyL6hIrQ_beavwdcrysAPOb2_6UKIbsWyMGzftBSEWsbXb-d880ux5eBJfdXFjwQQ-XK0f-3KdokD6_ZNo0MK1tKQhIkImtPR6MwVPL88NyN02oNApZqBOQuDgMKgvhwYmh7KVN8J9e4veU0NI4w8W09MDDzhH8RLb_E6NCKg-z6eHWh7eji3qs3tbJjDwDonIU2rHjoZ65yhZPkYt7V-x7KgEB_AT1AMmp6hRc1_gywJBZJAp9IAsbKA6rv-h5xJaKk-D34w' \
    -H 'charset: UTF-8'\
    -H 'Content-Type: application/json; charset=UTF-8' \
    --cert <PUBLIC_KEY_FILE_PATH> --key <PRIVATE_KEY_FILE_PATH> \
    -d '{
    "Data": {
      "Permission":"Create",
      "Initiation": {
        "RequestedExecutionDate": "2018-08-06T00:00:00+00:00",
        "InstructedAmount": {
          "Amount": "200.00",
          "Currency": "GBP"
        },
        "DebtorAccount": {
          "SchemeName": "UK.OBIE.SortCodeAccountNumber",
          "Identification": "11280001234567",
          "Name": "Andrea Frost"
        },
        "CreditorAccount": {
          "SchemeName": "UK.OBIE.SortCodeAccountNumber",
          "Identification": "08080021325698",
          "Name": "Tom Kirkman"
        },
        "RemittanceInformation": {
          "Reference": "DSR-037",
          "Unstructured": "Internal ops code 5120103"
        }
      }
    },
    "Risk": {
      "PaymentContextCode": "PartyToParty"
    }
  }'

• The response will bear the ConsentId.

  {
    "Data": {
      "ConsentId": "7290",
      "Permission": "Create",
      "Status": "AwaitingAuthorisation",
      "CreationDateTime": "2018-05-05T15:15:13+00:00",
      "StatusUpdateDateTime": "2018-05-05T15:15:13+00:00",
      "Initiation": {
        "RequestedExecutionDate": "2018-08-06T00:00:00+00:00",
        "InstructedAmount": {
          "Amount": "200.00",
          "Currency": "GBP"
        },
        "DebtorAccount": {
          "SchemeName": "UK.OBIE.SortCodeAccountNumber",
          "Identification": "11280001234567",
          "Name": "Andrea Frost"
        },
        "CreditorAccount": {
          "SchemeName": "UK.OBIE.SortCodeAccountNumber",
          "Identification": "08080021325698",
          "Name": "Tom Kirkman"
        },
        "RemittanceInformation": {
          "Reference": "DSR-037",
          "Unstructured": "Internal ops code 5120103"
        }
      }
    },
    "Risk": {
      "PaymentContextCode": "PartyToParty"
    },
    "Links": {
      "Self": "https://obank.com/open-banking/v3.1/pisp/domestic-scheduled-payment-consents/7290"
    },
    "Meta": {}
  }

GET /domestic-scheduled-payment-consents/{ConsentId}

A PISP is able to retrieve a payment consent resource that they have created to check its status. The PISP must have an access token issued by the ASPSP using a client credentials grant.

• Add the mandatory headers.
  • ConsentId - The unique id of the consent which you want to retrieve.
  • x-fapi-financial-id - The unique id of the ASPSP to which the request is issued. This id will be issued by the OBIE.
  • Authorization - An Authorisation Token as per https://tools.ietf.org/html/rfc6750. Enter the application access token, you generated from the above step.

• A sample request follows the format given below.

  curl GET \ 
    https://<WSO2_OB_APIM_HOST>:8243/open-banking/v3.1/pisp/domestic-scheduled-payment-consents/<ConsentId> \
    -H 'x-fapi-financial-id: OB/2017/001' \
    -H 'Authorization: Bearer <APPLICATION_ACCESS_TOKEN>' \
    -H 'Accept: application/json' \
    -H 'charset: UTF-8' \
    -H 'Content-Type: application/json; charset=UTF-8' \
    --cert <PUBLIC_KEY_FILE_PATH> --key <PRIVATE_KEY_FILE_PATH> \

1. Generate the request object by signing the following JSON payload using the supported algorithms.

   {
     "kid": "<CERTIFICATE_FINGERPRINT>",
     "alg": "<SUPPORTED_ALGORITHM>",
     "typ": "JWT"
   }
   {
     "max_age": 86400,
     "aud": "<This is the audience that the ID token is intended for. e.g., https://<WSO2_OB_APIM_HOST>:8243/token>",
     "scope": "payments openid",
     "iss": "<APPLICATION_ID>",
     "claims": {
       "id_token": {
         "acr": {
           "values": [
             "urn:openbanking:psd2:sca",
             "urn:openbanking:psd2:ca"
           ],
           "essential": true
         },
         "openbanking_intent_id": {
           "value": "<CONSENTID>",
           "essential": true
         }
       },
       "userinfo": {
         "openbanking_intent_id": {
           "value": "<CONSENTID>",
           "essential": true
         }
       }
     },
     "response_type": "<code:Retrieves authorize code/code id_token: Retrieves authorize token and ID token>",   
     "redirect_uri": "<CLIENT_APPLICATION_REDIRECT_URI>",
     "state": "YWlzcDozMTQ2",
     "exp": <EPOCH_TIME_OF_TOKEN_EXPIRATION>,
     "nonce": "<PREVENTS_REPLAY_ATTACKS>",
     "client_id": "<APPLICATION_ID>"
   }

2. Run the following in a browser to prompt the invocation of the authorize API. Make sure you update the placeholders with the relevant values:

   https://<WSO2_OB_APIM_HOST>:8243/authorize/?response_type=<RESPONSE_TYPE>&client_id=<APPLICATION_ID>&scope=payments%20openid&redirect_uri=<APPLICATION_REDIRECT_URI>&state=YWlzcDozMTQ2&request=<REQUEST_OBJECT>&prompt=login&nonce=<REQUEST_OBJECT_NONCE>

3. You are directed to a login page. Log in with the credentials of a user that has a subscriber role.
4. If a secondary factor is required, e.g. SMSOTP, provide the relevant values. Upon successful authentication, the user is redirected to the consent management page.
5. Upon providing consent, an authorization code is generated.

Run the following cURL command in a command prompt to generate the access token as a TPP user:

curl POST \
  https://<WSO2_OB_APIM_HOST>:8243/token \
  -H 'Cache-Control: no-cache' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --cert <PUBLIC_KEY_FILE_PATH> --key <PRIVATE_KEY_FILE_PATH> \
  -d 'client_id=<APPLICATION_ID>&grant_type=authorization_code&code=<CODE_GENERATED>&redirect_uri=<APPLICATION_REDIRECT_URI>&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&client_assertion=<CLIENT_ASSERTION>'

The response contains an access token and a refresh token.

curl POST \ 
  https://<WSO2_OB_APIM_HOST>:8243/token \
 -H 'Authorization: Basic <APPLICATION CLIENTID:CLIENT_SECRET_BASE64_ENCODED>' \
 -H 'Content-Type: application/x-www-form-urlencoded' \
 -H 'cache-control: no-cache' \
 --cert <PUBLIC_KEY_FILE_PATH> --key <PRIVATE_KEY_FILE_PATH> \
 -d 'grant_type=refresh_token&refresh_token=<REFRESH_TOKEN>'