Account and Transaction API v3.1.5

1. Once the client is successfully registered, sign in to WSO2 Open Banking Developer Portal and go to the Applications tab.

2. Select your client application from the Application List. 

3. You can view the keys you generated at the bottom of this page:
   

4. The Consumer Key shown above is the client ID of your application.

5. Generate the client assertion by signing the following JSON payload using the supported algorithms. 

   If you have configured the OB certificates, you may use the attached certificate and keys for signing and transports layer security testing purposes.

   The value of the aud claim should contain the same value as the Identity Provider Entity ID.

    Click here to view the Identity Provider Entity ID:

   1. Sign in to the Identity and Access Management console at  https://<WSO2_OB_IAM_HOST>t:9446/carbon . 
   2. In the Main menu, go to Home > Identity > Identity Providers > Resident.
   3. View the value in Resident Identity Provider > Inbound Authentication Configuration > OAuth2/OpenID Connect Configuration > Identity Provider Entity ID. By default this value is set to  https://<WSO2_OB_APIM>:8243/token .

6. Run the following cURL command in a command prompt to generate the access token. Update the placeholders with the relevant values.

   curl POST \
     https://<WSO2_OB_APIM_HOST>:8243/token \ 
     -H 'Cache-Control: no-cache' \
     -H 'Content-Type: application/x-www-form-urlencoded' \ 
     --cert <PUBLIC_KEY_FILE_PATH> --key <PRIVATE_KEY_FILE_PATH> \
      -d 'client_id=<CLIENT_ID>&grant_type=client_credentials&scope=accounts%20openid%20&client_assertion=<CLIENT_ASSERTION_JWT>&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&redirect_uri=<APPLICATION_CALLBACK_URL>'

   The access token is now generated.

   
   

   You can use the same cURL command to regenerate the access token.

POST/ account-access-consents

• This resource creates an account access consent. Use the following format in the request body.

  {
     "Data":{
        "Permissions":[
           "ReadAccountsDetail",
           "ReadBalances",
           "ReadBeneficiariesDetail",
           "ReadDirectDebits",
           "ReadProducts",
           "ReadStandingOrdersDetail",
           "ReadTransactionsCredits",
           "ReadTransactionsDebits",
           "ReadTransactionsDetail",
           "ReadOffers",
           "ReadPAN",
           "ReadParty",
           "ReadPartyPSU",
           "ReadScheduledPaymentsDetail",
           "ReadStatementsDetail"
        ],
        "ExpirationDateTime":"2020-10-11T10:28:49.599+05:30",
        "TransactionFromDateTime":"2020-10-06T10:28:49.600+05:30",
        "TransactionToDateTime":"2020-10-09T10:28:49.600+05:30"
     },
     "Risk":{
        
     }
  }

• Fill in the following mandatory field:

  • Authorization - An Authorisation Token as per https://tools.ietf.org/html/rfc6750. Enter the application access token, you generated from the above step.

• A sample request and response follows the format given below.

  • The response contains the  ConsentId.

GET/ account-access-consents/{ConsentId}

• An AISP may retrieve an account-access-consent resource that they have created to check its status. In order to make this request, the AISP must have an access token issued by the ASPSP using a client credentials grant.

• Fill in the mandatory fields:
• ConsentId -  The unique id of the consent which you want to retrieve.

• Authorization - An Authorisation Token as per https://tools.ietf.org/html/rfc6750. Enter the application access token, you generated from the above step.

• A sample request is in the format below.

  curl GET \
    https://<WSO2_OB_APIM_HOST>:8243/open-banking/v3.1/aisp/account-access-consents/<CONSENT_ID> \
    -H 'x-fapi-financial-id: open-bank' \
    -H 'Authorization: Bearer <APPLICATION_ACCESS_TOKEN>' \
    -H 'Accept: application/json' \
    -H 'charset: UTF-8' \
    -H 'Content-Type: application/json; charset=UTF-8' \
    --cert <PUBLIC_KEY_FILE_PATH> --key <PRIVATE_KEY_FILE_PATH> 

• Following is a sample response.

  {
      "Meta": {
          "TotalPages": 1
      },
      "Risk": {},
      "Links": {
          "Self": "https://localhost:8243/open-banking/v3.1/aisp/account-access-consents/41042513-fa45-4da8-93be-1513b3caffac"
      },
      "Data": {
          "Status": "Authorised",
          "StatusUpdateDateTime": "2020-10-07T12:46Z",
          "CreationDateTime": "2020-10-07T09:29Z",
          "TransactionToDateTime": "2020-10-09T10:28:49+05:30",
          "ExpirationDateTime": "2020-10-11T10:28:49+05:30",
          "Permissions": [
              "ReadAccountsDetail",
              "ReadBalances",
              "ReadBeneficiariesDetail",
              "ReadDirectDebits",
              "ReadProducts",
              "ReadStandingOrdersDetail",
              "ReadTransactionsCredits",
              "ReadTransactionsDebits",
              "ReadTransactionsDetail",
              "ReadOffers",
              "ReadPAN",
              "ReadParty",
              "ReadPartyPSU",
              "ReadScheduledPaymentsDetail",
              "ReadStatementsDetail"
          ],
          "ConsentId": "41042513-fa45-4da8-93be-1513b3caffac",
          "TransactionFromDateTime": "2020-10-06T10:28:49+05:30"
      }
  }

DELETE/ account-access-consents/{ConsentId}

• If the PSU revokes consent to data access with the AISP, the AISP must delete the account-access-consent resource. In order to make this request, the AISP must have an access token issued by the ASPSP using a client credentials grant.
• Fill in the mandatory fields:
  • ConsentId -  The unique id of the consent which you want to delete.

  • Authorization - An Authorisation Token as per https://tools.ietf.org/html/rfc6750. Enter the application access token, you generated from the above step. Use the following format and replace the placeholders.

• Given below is a sample request.

  curl DELETE \
    https://<WSO2_OB_APIM_HOST>:8243/open-banking/v3.1/aisp/account-access-consents/<CONSENT_ID> \
    -H 'x-fapi-financial-id: open-bank' \
    -H 'Authorization: Bearer 0895e677-9f13-3ce3-84f4-46113f9048be' \
    -H 'Accept: application/json' \
    -H 'charset: UTF-8' \
    -H 'Content-Type: application/json; charset=UTF-8' \
    --cert <PUBLIC_KEY_FILE_PATH> --key <PRIVATE_KEY_FILE_PATH> 
    -d '{
     "Data":{
        "Permissions":[
           "ReadAccountsDetail",
           "ReadBalances",
           "ReadBeneficiariesDetail",
           "ReadDirectDebits",
           "ReadProducts",
           "ReadStandingOrdersDetail",
           "ReadTransactionsCredits",
           "ReadTransactionsDebits",
           "ReadTransactionsDetail",
           "ReadOffers",
           "ReadPAN",
           "ReadParty",
           "ReadPartyPSU",
           "ReadScheduledPaymentsDetail",
           "ReadStatementsDetail"
        ],
        "ExpirationDateTime":"2020-10-11T10:28:49.599+05:30",
        "TransactionFromDateTime":"2020-10-06T10:28:49.600+05:30",
        "TransactionToDateTime":"2020-10-09T10:28:49.600+05:30"
     },
     "Risk":{
        
     }
  }'

• If the deletion is successful you will get a 204 No Content response.

1. Generate the request object by signing the following JSON payload using the supported algorithms.

2. Run the following in a browser to prompt the invocation of the authorize API. Make sure you update the placeholders with the relevant values:

   https://<WSO2_OB_APIM_HOST>:8243/authorize/?response_type=<RESPONSE_TYPE>&client_id=<APPLICATION_ID>&scope=accounts%20openid&redirect_uri=<APPLICATION_REDIRECT_URI>&state=YWlzcDozMTQ2&request=<REQUEST_OBJECT>&prompt=login&nonce=<REQUEST_OBJECT_NONCE>

3. You are directed to a login page. Log in with the credentials of a user that has a subscriber role.
   

4. If a secondary factor is required, e.g. SMSOTP, provide the relevant values. Upon successful authentication, the user is redirected to the consent management page.

   

5. Upon providing consent, an authorization code is generated.

1. The client_assertion is a JSON Web Token (JWT). Generate the client_assertion by signing the following JSON payload using the supported algorithms:

2. Run the following cURL command in a command prompt to generate the access token as a TPP user:

   curl POST \https://<WSO2_OB_APIM_HOST>:8243/token \
   -H 'Cache-Control: no-cache' \
   -H 'Content-Type: application/x-www-form-urlencoded' \
   --cert <PUBLIC_KEY_FILE_PATH> --key <PRIVATE_KEY_FILE_PATH> \
   -d 'grant_type=authorization_code&scope=openid accounts&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion=<CLIENT_ASSERTION>&redirect_uri=<APPLICATION_REDIRECT_URI>&code=<CODE_GENERATED>client_id=<APPLICATION_ID>'

   The response contains an access token and a refresh token.

   The access tokens have an expiration period, once an access token expires, you need to regenerate it. Run the following cURL command to generate a new access token as an AISP:

   curl POST \
    https://<WSO2_OB_APIM_HOST>:8243/token \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -H 'cache-control: no-cache' \
    --cert <PUBLIC_KEY_FILE_PATH> --key <PRIVATE_KEY_FILE_PATH> \
    -d 'grant_type=refresh_token&refresh_token=<REFRESH_TOKEN>&client_id=4hZILATfPyXlLFqkP3Z0OBYhmDwa&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion=<CLIENT_ASEERTION>'