Introduction

Status UAT
Certificate Production
URL https://mci-xtransfer.saltedge.com
Launch date TBD

PSD2 Regulation

Article 31 (PSD2 RTS) - Outlines the access interface options, according to which the ASPSPs can provide access:

  1. via a dedicated interface (generally understood to refer to an API-based solution);
  2. by allowing the use by TPPs, the interfaces used for authentication and communication with the ASPSP's payment service users.

Article 33 (PSD2 RTS) - Outlines the requirements of contingency interface.


MCI Description

Modified Customer Interface (MCI) enables TPPs to access the designated payment accounts of PSUs for inscope banking entities under PSD2.

TPP is able to retrieve account information and transaction data by using the XTransfer authentication mechanism and forwarding the issued access token to the MCI interface.

Using the MCI

Authentication

The authentication URL is provided as static. The TPP shall generate the full authentication URL themselves by appending the required query parameters to the base URL below.

Base URL: https://siths80.xtrfr.cn/login/mci-fallback

Authentication URL Example
https://siths80.xtrfr.cn/login/mci-fallback?scope=ais&channel=MCI&state={value}&tpp_name={name}&tpp_redirect_uri={link}&client_id={value}
Query Parameters
scope
string, required
Allowed value: ais
channel
string, required
Allowed value: MCI
state
string, required
A unique identifier provided by the TPP for maintaining state between the request and callback phases. Should be generated as a universally unique identifier (UUID).
tpp_name
string, required
The name of the TPP application.
tpp_redirect_uri
string, required
The URI where the customer will be redirected after successful authentication.
client_id
string, required
TPP unique identifier.
Customer Redirection and Authentication Process

  • The customer is redirected to the generated authentication URL, which initiates the consent and authentication process on the XTransfer side.
  • The customer authenticates using their XTransfer credentials and confirms the consent.
  • After successful authentication, XTransfer redirects the customer back to the TPP's tpp_redirect_uri with the access token appended as a query parameter.

TPP Callback

The TPP must define a callback endpoint to handle the following parameters, which are appended to the %code tpp_redirect_uri upon redirection:

Redirect

GET https://tppCallbackUrl

Example of parameters

{"state":"4f168760-20e6-4d6b-9ab5-ee9e34054fd5","accessToken":"ada9123x-uuid-token"}
Parameters
state
string, required
Returns the state parameter provided initially. Used to correlate the request with the callback response.
accessToken
string, required
Access token issued by XTransfer. Must be used as the %code Access-Token header value in subsequent API calls.

Accounts

Retrieves the list of accounts and balances belonging to a PSU.

Request

GET https://mci-xtransfer.saltedge.com/api/priora/v2/accounts

CURL

curl -i  \ 
 -H "TPP-Signature-Certificate: base64encodedCertificate" \ 
 -H "TPP-Signature: eyJhbGciOiJSUzI1NiJ9..." \ 
 -H "Client-Id: your-client-id" \ 
 -H "Access-Token: ada9123x-uuid-token" \ 
 -H "Channel: MCI" \ 
 -H "Content-Type: application/json" \ 
 -H "MCI-TYPE: ais" \ 
 -X GET "https://mci-xtransfer.saltedge.com/api/priora/v2/accounts"

Example response body

{"data":{"id":"acc-123456","name":"XTransfer Business Account","currency":"EUR","cash_account_type":"CACC","status":"enabled","balances":{"type":"closingBooked","amount":"1500.00","currency":"EUR"}}}
Headers
Header Type Description
TPP-Signature-Certificate string, required The certificate used for signing the request, in base64 encoding that should comply with RFC 4648 (No line feeds). Can raise: TppCertificateInvalid
TPP-Signature string, required JSON Web Signature containing payload, signed using RS256 and application.private_key. Can raise: MciSignatureInvalid
Client-Id string, required TPP unique identifier.
Access-Token string, required Access token received in the TPP callback (%code accessToken parameter).
Channel string, required Indicates the channel of the request. Allowed value: MCI
Content-Type string, required The media type of the body of the request. Accepted value: application/json
MCI-TYPE string, required MCI target type. Accepted value: ais
TPP-Signature Payload
method
string, required
HTTP method. Allowed values: GET
url
string, required
The full called URL including query parameters.
body
string, required
Raw POST data. For GET requests the value should be an empty string "".
Response

Upon successful request, 200 status code will be returned. See 'Related Errors' table for other possibilities.


data
object, required
Wrapper for the account data.
id
string, required
Account identifier on ASPSP side.
name
string, required
Human readable account name.
currency
string, required
Account currency code (ISO 4217).
cash_account_type
string, required
ExternalCashAccountType1Code from ISO 20022. Allowed value: CACC
status
string, required
Account status. Allowed values: enabled, deleted, blocked
balances
object, required
Wrapper for balance information.
type
string, required
Name value of ExternalBalanceType1code from ISO 20022.
amount
string, required
Amount of balance.
currency
string, required
Currency code of balance (ISO 4217).
Related Errors
Class Code Description
TppCertificateInvalid 400 Invalid certificate or given certificate doesn't have permissions.
Details are stored in error_message.
MciSignatureInvalid 400 Given signature is invalid or malformed.

Transactions

Retrieves the list of transactions belonging to a PSU account.

Request

GET https://mci-xtransfer.saltedge.com/api/priora/v2/accounts/:account_id/transactions

CURL

curl -i  \ 
 -H "TPP-Signature-Certificate: base64encodedCertificate" \ 
 -H "TPP-Signature: eyJhbGciOiJSUzI1NiJ9..." \ 
 -H "Client-Id: your-client-id" \ 
 -H "Access-Token: ada9123x-uuid-token" \ 
 -H "Channel: MCI" \ 
 -H "Content-Type: application/json" \ 
 -H "MCI-TYPE: ais" \ 
 -X GET "https://mci-xtransfer.saltedge.com/api/priora/v2/accounts/acc-123456/transactions?from_date=2026-01-01&to_date=2026-04-27"

Example response body

{"data":{"id":"txn-789012","amount":"-250.00","status":"booked","currency":"EUR","value_date":"2026-04-01","extra":{"transaction_type":"TRANSFER","transaction_sub_type":"OUTGOING"}}}
Path Parameters
account_id
string, required
Account identifier received from the Accounts endpoint.
Query Parameters
from_date
string, required
Start date for transactions in ISO 8601 format (%code yyyy-mm-dd). Defaults to 90 days ago.
to_date
string, required
End date for transactions in ISO 8601 format (%code yyyy-mm-dd). Defaults to today's date.
from_id
string, optional
The ID of the item from which to start returning results (for pagination).
limit
string, optional
Maximum number of items to return.
offset
string, optional
Starting point from which to return results (used with %code limit).
order
string, optional
Sort order of the returned collection.
order_by
string, optional
Attribute by which the collection is ordered.
booking_status
string, optional
Filters the collection by booking status.
Headers
Header Type Description
TPP-Signature-Certificate string, required The certificate used for signing the request, in base64 encoding that should comply with RFC 4648 (No line feeds). Can raise: TppCertificateInvalid
TPP-Signature string, required JSON Web Signature containing payload, signed using RS256 and application.private_key. Can raise: MciSignatureInvalid
Client-Id string, required TPP unique identifier.
Access-Token string, required Access token received in the TPP callback (%code accessToken parameter).
Channel string, required Indicates the channel of the request. Allowed value: MCI
Content-Type string, required The media type of the body of the request. Accepted value: application/json
MCI-TYPE string, required MCI target type. Accepted value: ais
TPP-Signature Payload
method
string, required
HTTP method. Allowed values: GET
url
string, required
The full called URL including path and query parameters.
body
string, required
Raw POST data. For GET requests the value should be an empty string "".
Response

Upon successful request, 200 status code will be returned. See 'Related Errors' table for other possibilities.


data
object, required
Wrapper for the transaction data.
id
string, required
Unique transaction identifier on ASPSP side.
amount
string, required
Transaction amount. Negative amounts are signed by minus.
status
string, required
Current status of the transaction. Allowed values: booked, pending
currency
string, required
Transaction currency code (ISO 4217).
value_date
string, required
Date at which assets become available to the account owner in ISO 8601 format (%code yyyy-mm-dd).
extra
object, optional
Additional transaction information.
transaction_type
string, required
Transaction type.
transaction_sub_type
string, required
Transaction sub type.
Related Errors
Class Code Description
TppCertificateInvalid 400 Invalid certificate or given certificate doesn't have permissions.
Details are stored in error_message.
MciSignatureInvalid 400 Given signature is invalid or malformed.

PIS Authentication

The PIS authentication URL is returned in the response to the POST /payments request (in _links.scaRedirect field). The TPP shall generate the full authentication URL by appending the required query parameters to the base URL received in the response.

Base URL: https://siths80.xtrfr.cn/login/mci-fallback

Authentication URL Example
https://siths80.xtrfr.cn/login/mci-fallback?type=pis&channel=MCI&state={value}&tpp_name={name}&tpp_redirect_uri={link}&authorized_id={value}
Query Parameters
type
string, required
Allowed value: pis
channel
string, required
Allowed value: MCI
state
string, required
A unique identifier provided by the TPP for maintaining state between the request and callback phases. Should be generated as a universally unique identifier (UUID).
tpp_name
string, required
The name of the TPP application.
tpp_redirect_uri
string, required
The URI where the customer will be redirected after successful authentication.
authorized_id
string, required
The payment identifier returned in the POST /payments response (paymentId field).

Initiate Payment

Initiates a new payment and returns an authentication URL for the PSU to authorise the payment.

Request

POST https://mci-xtransfer.saltedge.com/api/priora/v2/payments

CURL

curl -i  \ 
 -H "TPP-Signature-Certificate: base64encodedCertificate" \ 
 -H "TPP-Signature: eyJhbGciOiJSUzI1NiJ9..." \ 
 -H "Client-Id: your-client-id" \ 
 -H "Access-Token: ada9123x-uuid-token" \ 
 -H "Channel: MCI" \ 
 -H "Content-Type: application/json" \ 
 -H "MCI-TYPE: pis" \ 
 -d '"{\"endToEndIdentification\":\"E2E-ref-001\",\"instructedAmount\":{\"amount\":\"100.00\",\"currency\":\"EUR\"},\"creditorName\":\"John Doe\",\"creditorAgentName\":\"XTransfer\",\"creditorType\":\"PRIVATE\",\"creditorAccount\":{\"iban\":\"DE89370400440532013000\"},\"creditorAddress\":{\"streetName\":\"Main St\",\"buildingNumber\":\"1\",\"townName\":\"Berlin\",\"postCode\":\"10115\",\"country\":\"DE\"},\"debtorAccount\":{\"bankAccountIdentifier\":\"your-account-id\"}}"' \ 
-X POST "https://mci-xtransfer.saltedge.com/api/priora/v2/payments"

Example response body

{"paymentId":123456,"transactionStatus":"PDNG","_links":{"self":{"href":"https://mci-xtransfer.saltedge.com/api/priora/v2/payments/123456"},"status":{"href":"https://mci-xtransfer.saltedge.com/api/priora/v2/payments/123456/status"},"scaRedirect":{"href":"https://siths80.xtrfr.cn/login/mci-fallback"}}}
Headers
Header Type Description
TPP-Signature-Certificate string, required The certificate used for signing the request, in base64 encoding that should comply with RFC 4648 (No line feeds). Can raise: TppCertificateInvalid
TPP-Signature string, required JSON Web Signature containing payload, signed using RS256 and application.private_key. Can raise: MciSignatureInvalid
Client-Id string, required TPP unique identifier.
Access-Token string, required Access token received in the TPP callback (%code accessToken parameter).
Channel string, required Indicates the channel of the request. Allowed value: MCI
Content-Type string, required The media type of the body of the request. Accepted value: application/json
MCI-TYPE string, required MCI target type. Accepted value: pis
TPP-Signature Payload
method
string, required
HTTP method. Allowed values: POST
url
string, required
The full called URL including query parameters.
body
string, required
Raw POST data.
Request Body Parameters
endToEndIdentification
string, required, max 35 chars
Unique end-to-end reference provided by the TPP.
instructedAmount
object, required
Payment amount details.
amount
string, required
Payment amount.
currency
string, required
Currency code (ISO 4217).
creditorName
string, required
Name of the creditor.
creditorAgentName
string, required
Name of the creditor's agent (bank).
creditorType
string, required
Type of the creditor. Allowed values: PRIVATE, PUBLIC
creditorAccount
object, required
Creditor account details.
iban
string, optional
Creditor IBAN.
bic
string, optional
Creditor BIC.
creditorAddress
object, required
Creditor address details.
streetName
string, required
Street name of the creditor's address.
buildingNumber
string, required
Building number.
townName
string, required
Town or city name.
postCode
string, required
Postal code.
country
string, required
ISO 3166-1 alpha-2 country code.
province
string, optional
Province or state.
debtorAccount
object, optional
Debtor account details.
bankAccountIdentifier
string, required
Debtor account identifier on XTransfer side.
remittanceInformationUnstructured
string, optional
Unstructured remittance information.
Response

Upon successful request, 201 status code will be returned. See 'Related Errors' table for other possibilities.


paymentId
integer, required
Unique payment identifier on XTransfer side. Used as %code authorized_id in subsequent calls.
transactionStatus
string, required
Current payment status. Initial value: PDNG
_links
object, required
Navigation links.
scaRedirect
object, required
Contains the base authentication URL (%code href). The TPP appends PIS query parameters (type, channel, state, tpp_name, tpp_redirect_uri, authorized_id) to this URL before redirecting the PSU.
Related Errors
Class Code Description
TppCertificateInvalid 400 Invalid certificate or given certificate doesn't have permissions.
Details are stored in error_message.
MciSignatureInvalid 400 Given signature is invalid or malformed.

Payment Status

Retrieves the current status of an existing payment.

Request

POST https://mci-xtransfer.saltedge.com/api/priora/v2/payments/authorized_id/status

CURL

curl -i  \ 
 -H "TPP-Signature-Certificate: base64encodedCertificate" \ 
 -H "TPP-Signature: eyJhbGciOiJSUzI1NiJ9..." \ 
 -H "Client-Id: your-client-id" \ 
 -H "Access-Token: ada9123x-uuid-token" \ 
 -H "Channel: MCI" \ 
 -H "Content-Type: application/json" \ 
 -H "MCI-TYPE: pis" \ 
 -H "authorized_id: 123456" \ 
 -X POST "https://mci-xtransfer.saltedge.com/api/priora/v2/payments/authorized_id/status"

Example response body

{"transactionStatus":"PDNG"}
Headers
Header Type Description
TPP-Signature-Certificate string, required The certificate used for signing the request, in base64 encoding that should comply with RFC 4648 (No line feeds). Can raise: TppCertificateInvalid
TPP-Signature string, required JSON Web Signature containing payload, signed using RS256 and application.private_key. Can raise: MciSignatureInvalid
Client-Id string, required TPP unique identifier.
Access-Token string, required Access token received in the TPP callback (%code accessToken parameter).
Channel string, required Indicates the channel of the request. Allowed value: MCI
Content-Type string, required The media type of the body of the request. Accepted value: application/json
MCI-TYPE string, required MCI target type. Accepted value: pis
authorized_id string, required The payment identifier returned in the POST /payments response (%code paymentId field).
TPP-Signature Payload
method
string, required
HTTP method. Allowed values: POST
url
string, required
The full called URL including query parameters.
body
string, required
Raw POST data. Value should be an empty string "".
Response

Upon successful request, 200 status code will be returned. See 'Related Errors' table for other possibilities.


transactionStatus
string, required
Current payment status (ISO 20022 code). Allowed values: PDNG, RCVD, RJCT, CANC, ACSC, ACSP
Related Errors
Class Code Description
TppCertificateInvalid 400 Invalid certificate or given certificate doesn't have permissions.
Details are stored in error_message.
MciSignatureInvalid 400 Given signature is invalid or malformed.