Tokens

Initiate a linking process for a provider. The client application has to handle all the authentication UI in this flow (see <a href="/docs/tpp#tpp-configuration-and-api-keys">Provider authorization_types</a>). During the lifecycle, events will be added to the session which will send <a href="/docs/tpp#callbacks">Callbacks</a> to your application.

OAuth Authentication Flow

Show

Return current state of a token.

CURL

curl -i \ -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7fSwiZXhwIjoxNzM1MzQ0NDIwLCJpc3MiOiJwcmlvcmEuc2FsdGVkZ2UuY29tIn0.OUSzPN9LoiesEn5dozPBvGYI7TFhhlrmOJ-LrVdD0kY2VVcr-ytm_DR-7YpSAJ8ebqvF1sZtRDCtZiklCJa12SoXwoU88z_oZFpIcY5CeaR6lfz-bco7_C97_oKWdscgPFjBFEo1gYVlCKdPhVMdMb-IxWNdbjKZdT2DQ8d29iSS5_7KcGw78IN5YBjNVTGcmu9u7mR5vrugXXxKxAAUf0wgwFx8fjWtbg_tFXDDeWA5QbW4DrJjcorFQ3qAgU6cl_Gf0fYmqGAcFVKYP4txD5bsQWGa8hfJOTJi3A9Sic-WDg4JqAvCvdAeZKqSZflBJes_bVTZ_xi63wQFwBJqdw" \ -H "App-Id: 6mWl9hbxoN3rg_nX4804tw" \ -H "App-Secret: 6FdCub2C2AMQbyaI6KSv4Q" \ -H "Access-Token: 7eb89bd116268f02b5ab5ab6f46a89a65a8476d8c287a84fdceae03724d5511ae445b0342c73fc02681b3fcbbfeb12cf78e9292956b67ea76d20dfff0a1ba7a2" \ -H "Client-Request-Id: 54" \ -X GET "/api/v2/tokens"

curl -i  \ 
 -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7fSwiZXhwIjoxNzM1MzQ0NDIwLCJpc3MiOiJwcmlvcmEuc2FsdGVkZ2UuY29tIn0.OUSzPN9LoiesEn5dozPBvGYI7TFhhlrmOJ-LrVdD0kY2VVcr-ytm_DR-7YpSAJ8ebqvF1sZtRDCtZiklCJa12SoXwoU88z_oZFpIcY5CeaR6lfz-bco7_C97_oKWdscgPFjBFEo1gYVlCKdPhVMdMb-IxWNdbjKZdT2DQ8d29iSS5_7KcGw78IN5YBjNVTGcmu9u7mR5vrugXXxKxAAUf0wgwFx8fjWtbg_tFXDDeWA5QbW4DrJjcorFQ3qAgU6cl_Gf0fYmqGAcFVKYP4txD5bsQWGa8hfJOTJi3A9Sic-WDg4JqAvCvdAeZKqSZflBJes_bVTZ_xi63wQFwBJqdw" \ 
 -H "App-Id: 6mWl9hbxoN3rg_nX4804tw" \ 
 -H "App-Secret: 6FdCub2C2AMQbyaI6KSv4Q" \ 
 -H "Access-Token: 7eb89bd116268f02b5ab5ab6f46a89a65a8476d8c287a84fdceae03724d5511ae445b0342c73fc02681b3fcbbfeb12cf78e9292956b67ea76d20dfff0a1ba7a2" \ 
 -H "Client-Request-Id: 54" \ 
 -X GET "/api/v2/tokens"

Example of request parameters

{"data":{},"exp":1574093211}

Example of response

{"data":{"scopes":["accounts","transactions","kyc","payments","funds_availability","trusted_beneficiaries"],"access_token_expires_at":"2019-11-18T16:04:51.638Z"}}

Request

GET /api/v2/tokens

Headers

Header	Type	Description
`Authorization`	string, required	JSON Web Token containing payload, signed using RSA256 and `application.private_key`. Can raise: AuthorizationMissing
`App-Id`	string, required	Application’s `app_id` from connection details tab. Can raise: OauthAppNotFound, CertificateNotFound
`App-Secret`	string, required	Application’s `app_secret` from connection details tab.
`Access-Token`	string, required	Token for which we are requesting info. Can raise: TokenMissing, TokenNotFound, TokenRevoked, TokenExpired
`Client-Request-Id`	string, optional	Request identifier. If present, it will be returned within `meta` field in response.

Unpacked Request Authorization

data

hash, required

Wrapper for the data.

exp

integer, required

The lifetime of the request in timestamp UTC format. Values greater than: Current time.

Response

Upon successful request, 200 status code will be returned. See ‘Related Errors’ table for other possibilities.

data

hash, required

Wrapper for the data.

scopes

array, required

Set of permissions for access token. Allowed values: accounts, transactions, kyc, payments, funds_availability, trusted_beneficiaries

access_token_expires_at

datetime, required

When does access token expire.

Related Errors

Class	Code	Description
TokenMissing	400	This request cannot be performed without `Access_Token` header.
AuthorizationMissing	401	Authorization header is missing.
TokenNotFound	401	Token specified in request does not exist or cannot be retrieved.
TokenRevoked	401	Token specified in request is revoked and cannot be used anymore.
TokenExpired	401	Token specified in request is expired and cannot be used.
OauthAppNotFound	404	OAuth Application specified in request does not exist or cannot be retrieved.
CertificateNotFound	404	Certificate has no permissions.

Remote

Initiate the process of authentication on behalf of PSU. During this process, TPP will receive callbacks with instructions and current status of session. Prior to this, TPP is required to ask PSU for consent. TPP can also set up a custom expiration period for the consent in the field `consent_period_days`, which cannot be greater than 90 days.

CURL

curl -i \ -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7ImNyZWRlbnRpYWxzIjp7ImF1dGhvcml6YXRpb25fdHlwZSI6IlBTRF9BSVNQIn0sInByb3ZpZGVyX2NvZGUiOiJkZW1vYmFuayIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vdXNlci53aWxsLmJlL3JlZGlyZWN0ZWQvaGVyZSIsInNjb3BlcyI6WyJhY2NvdW50cyIsInRyYW5zYWN0aW9ucyIsImt5YyIsInBheW1lbnRzIiwiZnVuZHNfYXZhaWxhYmlsaXR5IiwidHJ1c3RlZF9iZW5lZmljaWFyaWVzIl0sImNvbnNlbnRfcGVyaW9kX2RheXMiOjkwfSwiZXhwIjoxNzM1MzQ0NDIwLCJpc3MiOiJwcmlvcmEuc2FsdGVkZ2UuY29tIn0.JlFgJstjlyNnIiCCZFLO4ejZVdww3QWbWnu6qi2Rttvmy87G7yhrj9LVqqP0K84a2-B2Z79hJbIrH5RJypGnwiqZjIrgvezlSz7HJ60o56nlk8K1CHf-Tx6lGrNjqIggACZGRm4k3dz4nEl_xsSXEXmfWUzSdwGe6_CuhV3SGOmBcuiVoXY6aq28jjc14IQaBwqEorOcm7G7QqEB_tH_H9SGAYNKL7q1vDWLdQYQFiDfqxQLgWPEuVrNpsnofS9nxoFjw_8mmKeibPXMCcdlt59DtGzuPHAcyrohZM8odlSNWbN5nI2FeswNuoZ1B4FYkVl9QMRb-M1NCjrdlAb_NQ" \ -H "App-Id: 8PmTDEfMengvyK1SNFkQ4A" \ -H "App-Secret: n4eSP_GK0CLYoeoT8mOQLg" \ -H "Client-Request-Id: 17" \ -X POST "/api/v2/tokens/remote"

curl -i  \ 
 -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7ImNyZWRlbnRpYWxzIjp7ImF1dGhvcml6YXRpb25fdHlwZSI6IlBTRF9BSVNQIn0sInByb3ZpZGVyX2NvZGUiOiJkZW1vYmFuayIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vdXNlci53aWxsLmJlL3JlZGlyZWN0ZWQvaGVyZSIsInNjb3BlcyI6WyJhY2NvdW50cyIsInRyYW5zYWN0aW9ucyIsImt5YyIsInBheW1lbnRzIiwiZnVuZHNfYXZhaWxhYmlsaXR5IiwidHJ1c3RlZF9iZW5lZmljaWFyaWVzIl0sImNvbnNlbnRfcGVyaW9kX2RheXMiOjkwfSwiZXhwIjoxNzM1MzQ0NDIwLCJpc3MiOiJwcmlvcmEuc2FsdGVkZ2UuY29tIn0.JlFgJstjlyNnIiCCZFLO4ejZVdww3QWbWnu6qi2Rttvmy87G7yhrj9LVqqP0K84a2-B2Z79hJbIrH5RJypGnwiqZjIrgvezlSz7HJ60o56nlk8K1CHf-Tx6lGrNjqIggACZGRm4k3dz4nEl_xsSXEXmfWUzSdwGe6_CuhV3SGOmBcuiVoXY6aq28jjc14IQaBwqEorOcm7G7QqEB_tH_H9SGAYNKL7q1vDWLdQYQFiDfqxQLgWPEuVrNpsnofS9nxoFjw_8mmKeibPXMCcdlt59DtGzuPHAcyrohZM8odlSNWbN5nI2FeswNuoZ1B4FYkVl9QMRb-M1NCjrdlAb_NQ" \ 
 -H "App-Id: 8PmTDEfMengvyK1SNFkQ4A" \ 
 -H "App-Secret: n4eSP_GK0CLYoeoT8mOQLg" \ 
 -H "Client-Request-Id: 17" \ 
 -X POST "/api/v2/tokens/remote"

Example of request parameters

Example of response

{"data":{"session_secret":"i8wJ74uDGEMjmzjULLWB"}}

Request

POST /api/v2/tokens/remote

Headers

Header	Type	Description
`Authorization`	string, required	JSON Web Token containing payload, signed using RSA256 and `application.private_key`. Can raise: AuthorizationMissing
`App-Id`	string, required	Application’s `app_id` from connection details tab. Can raise: OauthAppNotFound, CertificateNotFound
`App-Secret`	string, required	Application’s `app_secret` from connection details tab.
`Client-Request-Id`	string, optional	Request identifier. If present, it will be returned within `meta` field in response.

Unpacked Request Authorization

Response

Upon successful request, 200 status code will be returned. See ‘Related Errors’ table for other possibilities.

data

hash, required

Wrapper for the data.

session_secret

string, required

Session identifier in Salt Edge PSD2 Compliance.

Related Errors

Class	Code	Description
ScopesInvalid	400	Specified scopes don't match with the ones specified in Provider or OAuthApp. More info in `error_message`
AccessDenied	401	Action you want to perform is not allowed. More in `error_message`
AuthorizationMissing	401	Authorization header is missing.
ProviderNotFound	404	Provider specified in request does not exist or cannot be retrieved.
OauthAppNotFound	404	OAuth Application specified in request does not exist or cannot be retrieved.
CertificateNotFound	404	Certificate has no permissions.

Revoke

Revoke an already existing and active access token.

CURL

curl -i \ -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7fSwiZXhwIjoxNzM1MzQ0NDIwLCJpc3MiOiJwcmlvcmEuc2FsdGVkZ2UuY29tIn0.OUSzPN9LoiesEn5dozPBvGYI7TFhhlrmOJ-LrVdD0kY2VVcr-ytm_DR-7YpSAJ8ebqvF1sZtRDCtZiklCJa12SoXwoU88z_oZFpIcY5CeaR6lfz-bco7_C97_oKWdscgPFjBFEo1gYVlCKdPhVMdMb-IxWNdbjKZdT2DQ8d29iSS5_7KcGw78IN5YBjNVTGcmu9u7mR5vrugXXxKxAAUf0wgwFx8fjWtbg_tFXDDeWA5QbW4DrJjcorFQ3qAgU6cl_Gf0fYmqGAcFVKYP4txD5bsQWGa8hfJOTJi3A9Sic-WDg4JqAvCvdAeZKqSZflBJes_bVTZ_xi63wQFwBJqdw" \ -H "App-Id: iiniPo3zkfpOgmHrmk0Osg" \ -H "App-Secret: gNebmvKyKAVTxY_fSVe-kQ" \ -H "Access-Token: 874bcafd85e1332e8657cfb68016ed33f52b055adeead1d97fdfd96fc4cb847b957ee63f407d459b80eef76951e967501ca6c0282e4a4e7f838906856720a0bf" \ -H "Client-Request-Id: 17" \ -X DELETE "/api/v2/tokens"

curl -i  \ 
 -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7fSwiZXhwIjoxNzM1MzQ0NDIwLCJpc3MiOiJwcmlvcmEuc2FsdGVkZ2UuY29tIn0.OUSzPN9LoiesEn5dozPBvGYI7TFhhlrmOJ-LrVdD0kY2VVcr-ytm_DR-7YpSAJ8ebqvF1sZtRDCtZiklCJa12SoXwoU88z_oZFpIcY5CeaR6lfz-bco7_C97_oKWdscgPFjBFEo1gYVlCKdPhVMdMb-IxWNdbjKZdT2DQ8d29iSS5_7KcGw78IN5YBjNVTGcmu9u7mR5vrugXXxKxAAUf0wgwFx8fjWtbg_tFXDDeWA5QbW4DrJjcorFQ3qAgU6cl_Gf0fYmqGAcFVKYP4txD5bsQWGa8hfJOTJi3A9Sic-WDg4JqAvCvdAeZKqSZflBJes_bVTZ_xi63wQFwBJqdw" \ 
 -H "App-Id: iiniPo3zkfpOgmHrmk0Osg" \ 
 -H "App-Secret: gNebmvKyKAVTxY_fSVe-kQ" \ 
 -H "Access-Token: 874bcafd85e1332e8657cfb68016ed33f52b055adeead1d97fdfd96fc4cb847b957ee63f407d459b80eef76951e967501ca6c0282e4a4e7f838906856720a0bf" \ 
 -H "Client-Request-Id: 17" \ 
 -X DELETE "/api/v2/tokens"

Example of request parameters

{"data":{},"exp":1574093211}

Example of response

{"data":{"revoked":true,"access_token":"yVJ-2246zz-1yRutZstm"}}

Request

DELETE /api/v2/tokens

Headers

Header	Type	Description
`Authorization`	string, required	JSON Web Token containing payload, signed using RSA256 and `application.private_key`. Can raise: AuthorizationMissing
`App-Id`	string, required	Application’s `app_id` from connection details tab. Can raise: OauthAppNotFound, CertificateNotFound
`App-Secret`	string, required	Application’s `app_secret` from connection details tab.
`Access-Token`	string, required	Token for which we are requesting info. Can raise: TokenMissing, TokenNotFound, TokenRevoked, TokenExpired
`Client-Request-Id`	string, optional	Request identifier. If present, it will be returned within `meta` field in response.

Unpacked Request Authorization

data

hash, required

Wrapper for the data.

exp

integer, required

The lifetime of the request in timestamp UTC format. Values greater than: Current time.

Response

Upon successful request, 200 status code will be returned. See ‘Related Errors’ table for other possibilities.

data

hash, required

Wrapper for the data.

revoked

boolean, required

Whether token was revoked or not. Allowed values: true, false

access_token

string, required

Token which was revoked or not.

Related Errors

Class	Code	Description
TokenMissing	400	This request cannot be performed without `Access_Token` header.
AuthorizationMissing	401	Authorization header is missing.
TokenNotFound	401	Token specified in request does not exist or cannot be retrieved.
TokenRevoked	401	Token specified in request is revoked and cannot be used anymore.
TokenExpired	401	Token specified in request is expired and cannot be used.
OauthAppNotFound	404	OAuth Application specified in request does not exist or cannot be retrieved.
CertificateNotFound	404	Certificate has no permissions.

Sessions

Show

Due to the asynchronous nature of requests, most of responses represent a session_secret. This endpoint could be used to verify the currrent state of newly created sessions.

CURL

curl -i \ -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7fSwiZXhwIjoxNzM1MzQ0NDIxLCJpc3MiOiJwcmlvcmEuc2FsdGVkZ2UuY29tIn0.WJ5RBvshRfwUtLRm977JXKvo7Si_VAl1_z6RrXwtxlc0KSmSkiisWdmA1IvZbi6Qgt8VfVlCSkHVDNsngReIKLC3zJSIJOLQNBMgZEkaBui0S8-dQSNLBGXaX1aVykVZg1tGIEkYgv3undb9PE8-A4Zq6clLeoWV_q7SjI8QOKNhKaOK4mMOCtrw1EygJezfL7EeyyHviY8w1i92FmLdr2CzN1ba4oOCDsjqT9yyJBJWVziXD4amgUiPgEKaPXqZhFUf3yLgofhncscZsudGixiVufu3y526NImxcTs37E1wAaGSJ9acJ16oyh-50s_GHBzzuR3SapRC9x-8SpzNgQ" \ -H "App-Id: lYbM35hScWwT52d6Zxz-Lg" \ -H "App-Secret: ssZn53PTzxSv6kI1nJzlUQ" \ -H "Client-Request-Id: 4565" \ -X GET "/api/v2/sessions/:secret"

curl -i  \ 
 -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7fSwiZXhwIjoxNzM1MzQ0NDIxLCJpc3MiOiJwcmlvcmEuc2FsdGVkZ2UuY29tIn0.WJ5RBvshRfwUtLRm977JXKvo7Si_VAl1_z6RrXwtxlc0KSmSkiisWdmA1IvZbi6Qgt8VfVlCSkHVDNsngReIKLC3zJSIJOLQNBMgZEkaBui0S8-dQSNLBGXaX1aVykVZg1tGIEkYgv3undb9PE8-A4Zq6clLeoWV_q7SjI8QOKNhKaOK4mMOCtrw1EygJezfL7EeyyHviY8w1i92FmLdr2CzN1ba4oOCDsjqT9yyJBJWVziXD4amgUiPgEKaPXqZhFUf3yLgofhncscZsudGixiVufu3y526NImxcTs37E1wAaGSJ9acJ16oyh-50s_GHBzzuR3SapRC9x-8SpzNgQ" \ 
 -H "App-Id: lYbM35hScWwT52d6Zxz-Lg" \ 
 -H "App-Secret: ssZn53PTzxSv6kI1nJzlUQ" \ 
 -H "Client-Request-Id: 4565" \ 
 -X GET "/api/v2/sessions/:secret"

Example of request parameters

{"data":{},"exp":1574093210}

Example of response

{"data":{"secret":"BVuveSLQCrA5jBYUyxXe","status":"fetched_kyc","extra":{"scopes":["accounts","transactions","kyc","payments","funds_availability","trusted_beneficiaries"]},"token":{"access_token":"5kHijxm_DEWoP5ncHWcF","expires_at":"2019-11-18T16:04:50.915Z"},"provider_code":"demobank","id":302,"fail_at":"2019-11-18T16:04:50.915Z","success_at":"2019-11-18T16:04:50.915Z","created_at":"2019-11-18T16:04:50.915Z","updated_at":"2019-11-18T16:04:50.915Z","events":[{}],"authorization_details":{"instruction":"Use PIN code from the received SMS.","mfa_fields":[{"code":"sms_pincode","display_name":"SMS-PIN","optional":true,"type":"embedded","nature":"text"}]},"customer_id":983}}

Request

GET /api/v2/sessions/:secret

Headers

Header	Type	Description
`Authorization`	string, required	JSON Web Token containing payload, signed using RSA256 and `application.private_key`. Can raise: AuthorizationMissing
`App-Id`	string, required	Application’s `app_id` from connection details tab. Can raise: OauthAppNotFound, CertificateNotFound
`App-Secret`	string, required	Application’s `app_secret` from connection details tab.
`Client-Request-Id`	string, optional	Request identifier. If present, it will be returned within `meta` field in response.

Unpacked Request Authorization

data

hash, required

Wrapper for the data.

exp

integer, required

The lifetime of the request in timestamp UTC format. Values greater than: Current time.

secret (path)

string, required

Another session identifier that can be used for session lookup and confirmation. Can raise: SessionNotFound

Response

Upon successful request, 200 status code will be returned. See ‘Related Errors’ table for other possibilities.

data

hash, required

Wrapper for the data.

integer, required

Session identifier in Salt Edge PSD2 Compliance.

secret

string, required

Another session identifier that can be used for session lookup and confirmation.

status

string, required

Conveys current status of the operation. Allowed values: processing, redirect, waiting_confirmation, waiting_confirmation_code, executing, closed, fetched_kyc, fetched_accounts, fetched_transactions, fetched_trusted_beneficiaries

extra

hash, required

Extra details that should persist in the session.

scopes

array, optional

Set of permissions for access token. Allowed values: accounts, transactions, kyc, payments, funds_availability, trusted_beneficiaries

token

hash, required

Access token that will be used to access ASPSP data.

access_token

string, optional

Access token that will be used to access ASPSP data. Token is an unique value which is linked to authenticated user.

expires_at

datetime, optional

Datetime of token expiration.

fail_at

datetime, optional

Datetime of session failure.

success_at

datetime, optional

Datetime of session successful closure.

created_at

datetime, required

Datetime of session creation.

updated_at

datetime, required

Datetime of last session update.

events

array, required

Session progress events.

authorization_details

hash, required

Data which was used for authorization.

instruction

string, optional

Authorization type description.

mfa_fields

array, optional

Multi-Factor Authentication fields wrapper.

code

string, required

MFA Field identifier.

display_name

string, required

MFA Field label.

optional

boolean, required

Whether this MFA field is required to fill. Allowed values: true, false

type

string, required

Type of MFA Field value. Allowed values: number, password, text

customer_id

string, optional

PSU identifier on Salt Edge PSD2 Compliance side.

provider_code

string, required

Human readable Provider identifier.

Related Errors

Class	Code	Description
AuthorizationMissing	401	Authorization header is missing.
SessionNotFound	404	Session specified in request does not exist or cannot be retrieved.
OauthAppNotFound	404	OAuth Application specified in request does not exist or cannot be retrieved.
CertificateNotFound	404	Certificate has no permissions.

Destroy

Cancel session.

CURL

curl -i \ -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7fSwiZXhwIjoxNzM1MzQ0NDIxLCJpc3MiOiJwcmlvcmEuc2FsdGVkZ2UuY29tIn0.WJ5RBvshRfwUtLRm977JXKvo7Si_VAl1_z6RrXwtxlc0KSmSkiisWdmA1IvZbi6Qgt8VfVlCSkHVDNsngReIKLC3zJSIJOLQNBMgZEkaBui0S8-dQSNLBGXaX1aVykVZg1tGIEkYgv3undb9PE8-A4Zq6clLeoWV_q7SjI8QOKNhKaOK4mMOCtrw1EygJezfL7EeyyHviY8w1i92FmLdr2CzN1ba4oOCDsjqT9yyJBJWVziXD4amgUiPgEKaPXqZhFUf3yLgofhncscZsudGixiVufu3y526NImxcTs37E1wAaGSJ9acJ16oyh-50s_GHBzzuR3SapRC9x-8SpzNgQ" \ -H "App-Id: TnzE5rqosgx9vrox4mU5EA" \ -H "App-Secret: ngYWj5vwwkf-fT1MkB6DBQ" \ -H "Client-Request-Id: 17" \ -X DELETE "/api/v2/sessions/:secret"

curl -i  \ 
 -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7fSwiZXhwIjoxNzM1MzQ0NDIxLCJpc3MiOiJwcmlvcmEuc2FsdGVkZ2UuY29tIn0.WJ5RBvshRfwUtLRm977JXKvo7Si_VAl1_z6RrXwtxlc0KSmSkiisWdmA1IvZbi6Qgt8VfVlCSkHVDNsngReIKLC3zJSIJOLQNBMgZEkaBui0S8-dQSNLBGXaX1aVykVZg1tGIEkYgv3undb9PE8-A4Zq6clLeoWV_q7SjI8QOKNhKaOK4mMOCtrw1EygJezfL7EeyyHviY8w1i92FmLdr2CzN1ba4oOCDsjqT9yyJBJWVziXD4amgUiPgEKaPXqZhFUf3yLgofhncscZsudGixiVufu3y526NImxcTs37E1wAaGSJ9acJ16oyh-50s_GHBzzuR3SapRC9x-8SpzNgQ" \ 
 -H "App-Id: TnzE5rqosgx9vrox4mU5EA" \ 
 -H "App-Secret: ngYWj5vwwkf-fT1MkB6DBQ" \ 
 -H "Client-Request-Id: 17" \ 
 -X DELETE "/api/v2/sessions/:secret"

Example of request parameters

{"data":{},"exp":1574093210}

Example of response

{"data":{"session_secret":"_PkwuzoztNR3vz2-MzrJ"}}

Request

DELETE /api/v2/sessions/:secret

Headers

Header	Type	Description
`Authorization`	string, required	JSON Web Token containing payload, signed using RSA256 and `application.private_key`. Can raise: AuthorizationMissing
`App-Id`	string, required	Application’s `app_id` from connection details tab. Can raise: OauthAppNotFound, CertificateNotFound
`App-Secret`	string, required	Application’s `app_secret` from connection details tab.
`Client-Request-Id`	string, optional	Request identifier. If present, it will be returned within `meta` field in response.

Unpacked Request Authorization

data

hash, required

Wrapper for the data.

exp

integer, required

The lifetime of the request in timestamp UTC format. Values greater than: Current time.

secret (path)

string, required

Session secret. Can raise: SessionNotFound, SessionClosed, SessionExpired, ActionNotAllowed

Response

Upon successful request, 200 status code will be returned. See ‘Related Errors’ table for other possibilities.

data

hash, required

Wrapper for the data.

session_secret

string, required

Session identifier in Salt Edge PSD2 Compliance.

Related Errors

Class	Code	Description
SessionClosed	400	Session specified in request is already closed and cannot be modified.
SessionExpired	401	Found session is expired and cannot be processed anymore.
AuthorizationMissing	401	Authorization header is missing.
SessionNotFound	404	Session specified in request does not exist or cannot be retrieved.
OauthAppNotFound	404	OAuth Application specified in request does not exist or cannot be retrieved.
CertificateNotFound	404	Certificate has no permissions.
ActionNotAllowed	406	You're not allowed to perform this action. This might be a configuration problem or parameters incompatibility.

Trusted Beneficiary

Show

Endpoint used to fetch all data relevant to a trusted beneficiary including alias_name, identifiers, status and other.

CURL

curl -i \ -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7fSwiZXhwIjoxNzM1MzQ0NDIxLCJpc3MiOiJwcmlvcmEuc2FsdGVkZ2UuY29tIn0.WJ5RBvshRfwUtLRm977JXKvo7Si_VAl1_z6RrXwtxlc0KSmSkiisWdmA1IvZbi6Qgt8VfVlCSkHVDNsngReIKLC3zJSIJOLQNBMgZEkaBui0S8-dQSNLBGXaX1aVykVZg1tGIEkYgv3undb9PE8-A4Zq6clLeoWV_q7SjI8QOKNhKaOK4mMOCtrw1EygJezfL7EeyyHviY8w1i92FmLdr2CzN1ba4oOCDsjqT9yyJBJWVziXD4amgUiPgEKaPXqZhFUf3yLgofhncscZsudGixiVufu3y526NImxcTs37E1wAaGSJ9acJ16oyh-50s_GHBzzuR3SapRC9x-8SpzNgQ" \ -H "App-Id: uNwDiUgp12XhONz1E_rV6g" \ -H "App-Secret: QsSGnN7sJHqUCyRnP6IHsQ" \ -H "Access-Token: bf0d0bb0c89896811579dbe456507cb7cf2f5bb9b0b06291670339a22e55eb484f81de6b286235c71c0f27adb1229a717c4b7f089dadaa51cc24145128ad65ab" \ -H "Client-Request-Id: 13" \ -X GET "/api/v2/trusted_beneficiaries/:id"

curl -i  \ 
 -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7fSwiZXhwIjoxNzM1MzQ0NDIxLCJpc3MiOiJwcmlvcmEuc2FsdGVkZ2UuY29tIn0.WJ5RBvshRfwUtLRm977JXKvo7Si_VAl1_z6RrXwtxlc0KSmSkiisWdmA1IvZbi6Qgt8VfVlCSkHVDNsngReIKLC3zJSIJOLQNBMgZEkaBui0S8-dQSNLBGXaX1aVykVZg1tGIEkYgv3undb9PE8-A4Zq6clLeoWV_q7SjI8QOKNhKaOK4mMOCtrw1EygJezfL7EeyyHviY8w1i92FmLdr2CzN1ba4oOCDsjqT9yyJBJWVziXD4amgUiPgEKaPXqZhFUf3yLgofhncscZsudGixiVufu3y526NImxcTs37E1wAaGSJ9acJ16oyh-50s_GHBzzuR3SapRC9x-8SpzNgQ" \ 
 -H "App-Id: uNwDiUgp12XhONz1E_rV6g" \ 
 -H "App-Secret: QsSGnN7sJHqUCyRnP6IHsQ" \ 
 -H "Access-Token: bf0d0bb0c89896811579dbe456507cb7cf2f5bb9b0b06291670339a22e55eb484f81de6b286235c71c0f27adb1229a717c4b7f089dadaa51cc24145128ad65ab" \ 
 -H "Client-Request-Id: 13" \ 
 -X GET "/api/v2/trusted_beneficiaries/:id"

Example of request parameters

{"data":{},"exp":1574173799,"id":414}

Example of response

{"data":{"alias_name":"John Smith GB","status":"approved","template_id":"516","identifiers":{"iban":"FK35****81**45****5635","currency_code":"GBP"},"session_secret":"P5rrqb4hWZ_ghjTj4cBj","provider_code":"demobank","id":719}}

Request

GET /api/v2/trusted_beneficiaries/:id

Headers

Header	Type	Description
`Authorization`	string, required	JSON Web Token containing payload, signed using RSA256 and `application.private_key`. Can raise: AuthorizationMissing
`App-Id`	string, required	Application’s `app_id` from connection details tab. Can raise: OauthAppNotFound, CertificateNotFound
`App-Secret`	string, required	Application’s `app_secret` from connection details tab.
`Access-Token`	string, required	Token for which we are requesting info. Can raise: TokenMissing, TokenNotFound, TokenRevoked, TokenExpired
`Client-Request-Id`	string, optional	Request identifier. If present, it will be returned within `meta` field in response.

Unpacked Request Authorization

data

hash, required

Wrapper for the data.

exp

integer, required

The lifetime of the request in timestamp UTC format. Values greater than: Current time.

integer, required

Trusted Beneficiary identifier on Salt Edge PSD2 Compliance side. Can raise: TrustedBeneficiaryNotFound

Response

Endpoint used to fetch all data relevant to a trusted beneficiary including alias_name, identifiers, status and other.

data

hash, required

Wrapper for the data.

integer, required

Trusted Beneficiary identifier on Salt Edge PSD2 Compliance side.

alias_name

string, required

Any human-readable description that is used to identify the trusted beneficiary on TPP side.

status

string, required

Conveys current status of the operation. Allowed values: approved

template_id

string, required

Payment template identifier on Salt Edge PSD2 Compliance side.

identifiers

hash, required

Object which maps the field of related payment template with its masked value. The value can be also empty.

session_secret

string, required

Session identifier in Salt Edge PSD2 Compliance.

provider_code

string, required

Human readable Provider identifier.

Related Errors

Class	Code	Description
TokenMissing	400	This request cannot be performed without `Access_Token` header.
AuthorizationMissing	401	Authorization header is missing.
TokenNotFound	401	Token specified in request does not exist or cannot be retrieved.
TokenRevoked	401	Token specified in request is revoked and cannot be used anymore.
TokenExpired	401	Token specified in request is expired and cannot be used.
TrustedBeneficiaryNotFound	404	Trusted Beneficiary specified in request does not exist or cannot be retrieved.
OauthAppNotFound	404	OAuth Application specified in request does not exist or cannot be retrieved.
CertificateNotFound	404	Certificate has no permissions.

Index

Endpoint used to fetch all data relevant to trusted beneficiaries.

CURL

curl -i \ -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7InByb3ZpZGVyX2NvZGUiOiJkZW1vYmFuayJ9LCJleHAiOjE3MzUzNDQ0MjEsImlzcyI6InByaW9yYS5zYWx0ZWRnZS5jb20ifQ.aMSXH_iM2tk77DrgS1etO18V06p8u_rVvaa4-7nu19cPuqca58r-eDiX4nloEVLk5oYr9rVaMt5PXUAmkk-uWmb1O7Hii-pS5oTY8QjP5OrTJXjWn94DgYRKm_yetP6D0BGddCZitsn6x01hvKUrtHTVBuQCRUP6qDVuZQj_i0zn06ajMgM01Omf_UrBPjDf3HcwlNyskfnqZLMx-dod2DlaxGGgFHROWHkVBc_exwDy7FdrTbPUl-N3T1myaAJsNuf1HrI2tm1b2XnXWO3BoCNu19DirBVwR0GSyxwTdh-llFBDHMDoV6soELypWW1AcVnsHm2cX8qD7ca4jux_qg" \ -H "App-Id: IsiyTiKCOZDsV6mbafDzgg" \ -H "App-Secret: fzST4gs0xQHOJA9bToRqeQ" \ -H "Access-Token: 2bae74fd42f750e7401e0aa3cc9d5644ac815f5b9d2c16627af18cc76b2f507bc2dac1a10ab77c1b90b7e16423e2a0396d786959f09db9dc02128d820609d8df" \ -H "Client-Request-Id: 17" \ -X GET "/api/v2/trusted_beneficiaries"

curl -i  \ 
 -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjp7InByb3ZpZGVyX2NvZGUiOiJkZW1vYmFuayJ9LCJleHAiOjE3MzUzNDQ0MjEsImlzcyI6InByaW9yYS5zYWx0ZWRnZS5jb20ifQ.aMSXH_iM2tk77DrgS1etO18V06p8u_rVvaa4-7nu19cPuqca58r-eDiX4nloEVLk5oYr9rVaMt5PXUAmkk-uWmb1O7Hii-pS5oTY8QjP5OrTJXjWn94DgYRKm_yetP6D0BGddCZitsn6x01hvKUrtHTVBuQCRUP6qDVuZQj_i0zn06ajMgM01Omf_UrBPjDf3HcwlNyskfnqZLMx-dod2DlaxGGgFHROWHkVBc_exwDy7FdrTbPUl-N3T1myaAJsNuf1HrI2tm1b2XnXWO3BoCNu19DirBVwR0GSyxwTdh-llFBDHMDoV6soELypWW1AcVnsHm2cX8qD7ca4jux_qg" \ 
 -H "App-Id: IsiyTiKCOZDsV6mbafDzgg" \ 
 -H "App-Secret: fzST4gs0xQHOJA9bToRqeQ" \ 
 -H "Access-Token: 2bae74fd42f750e7401e0aa3cc9d5644ac815f5b9d2c16627af18cc76b2f507bc2dac1a10ab77c1b90b7e16423e2a0396d786959f09db9dc02128d820609d8df" \ 
 -H "Client-Request-Id: 17" \ 
 -X GET "/api/v2/trusted_beneficiaries"

Example of request parameters

{"data":{"provider_code":"demobank"},"exp":1574093211}

Example of response

{"data":[{"id":752,"alias_name":"Example Name","status":"approved","template_id":"75","identifiers":{"amount":"227.13","to_account":"1313613","description":"Test payment.","from_account":"1313634"},"provider_code":"demobank"}]}

Request

GET /api/v2/trusted_beneficiaries

Headers

Header	Type	Description
`Authorization`	string, required	JSON Web Token containing payload, signed using RSA256 and `application.private_key`. Can raise: AuthorizationMissing
`App-Id`	string, required	Application’s `app_id` from connection details tab. Can raise: OauthAppNotFound, CertificateNotFound
`App-Secret`	string, required	Application’s `app_secret` from connection details tab.
`Access-Token`	string, required	Token for which we are requesting info. Can raise: TokenMissing, TokenNotFound, TokenRevoked, TokenExpired
`Client-Request-Id`	string, optional	Request identifier. If present, it will be returned within `meta` field in response.

Unpacked Request Authorization

data

hash, required

Wrapper for the data.

provider_code

string, required

Human readable Provider identifier. Can raise: ProviderNotFound, AccessDenied

exp

integer, required

The lifetime of the request in timestamp UTC format. Values greater than: Current time.

Response

Endpoint used to fetch all data relevant to trusted beneficiaries.

data

array, required

Wrapper for the data.

integer, required

Trusted Beneficiary identifier on Salt Edge PSD2 Compliance side.

alias_name

string, required

Any human-readable description that is used to identify the trusted beneficiary on TPP side.

status

string, required

Conveys current status of the operation. Allowed values: approved

template_id

string, required

Payment template identifier on Salt Edge PSD2 Compliance side.

session_secret

string, required

Session identifier in Salt Edge PSD2 Compliance.

identifiers

hash, required

Object which maps the field of related payment template with its masked value. The value can be also empty.

provider_code

string, required

Human readable Provider identifier.

Related Errors

Class	Code	Description
TokenMissing	400	This request cannot be performed without `Access_Token` header.
AccessDenied	401	Action you want to perform is not allowed. More in `error_message`
AuthorizationMissing	401	Authorization header is missing.
TokenNotFound	401	Token specified in request does not exist or cannot be retrieved.
TokenRevoked	401	Token specified in request is revoked and cannot be used anymore.
TokenExpired	401	Token specified in request is expired and cannot be used.
ProviderNotFound	404	Provider specified in request does not exist or cannot be retrieved.
OauthAppNotFound	404	OAuth Application specified in request does not exist or cannot be retrieved.
CertificateNotFound	404	Certificate has no permissions.

Providers

Index

Returns all ASPSPs which have approved access for your TPP. More information could be found at #requesting-provider-access compartment.

CURL

curl -i \ -H "App-Id: 5L1UlLqFeEjlFlJ4dzJFDw" \ -H "App-Secret: ym7AeWUYxHp0KG4MghAo-g" \ -H "Client-Request-Id: 17" \ -X GET "/api/v2/providers"

curl -i  \ 
 -H "App-Id: 5L1UlLqFeEjlFlJ4dzJFDw" \ 
 -H "App-Secret: ym7AeWUYxHp0KG4MghAo-g" \ 
 -H "Client-Request-Id: 17" \ 
 -X GET "/api/v2/providers"

Example of request parameters

{"per_page":50,"from_id":1}

Example of response

{"data":[{"id":846,"name":"Example Name","code":"demobank","connector_url":"https://user.will.be/redirected/here","status":"live","scopes":["accounts","transactions","kyc","payments","funds_availability","trusted_beneficiaries"],"created_at":"2019-11-18T16:04:50.725Z","updated_at":"2019-11-18T16:04:50.725Z","authorization_types":[{"code":"sms_pin","display_name":"SMS-PIN","scopes":["accounts","transactions"],"instruction":"Use PIN code from SMS to authorize.","required_fields":[{"code":"req_field","optional":"false","display_name":"Sms_pin","type":"string"}],"mfa_fields":[{"code":"req_field2","optional":"false","display_name":"Password","type":"string"}],"sandbox_credentials":{"required_fields":[{"example":"req_field","code":"req_field"}],"mfa_fields":[{"example":"mfa_field","code":"mfa_field"}]}}]}],"meta":{"next_id":2,"time":"2019-11-18T16:04:50.725Z"}}

Request

GET /api/v2/providers

Headers

Header	Type	Description
`App-Id`	string, required	Application’s `app_id` from connection details tab. Can raise: OauthAppNotFound, CertificateNotFound
`App-Secret`	string, required	Application’s `app_secret` from connection details tab.
`Client-Request-Id`	string, optional	Request identifier. If present, it will be returned within `meta` field in response.

Unpacked Request Authorization

per_page

integer, optional

Number of providers that should be returned per request or less. Values in range between: 1 and 1000 Default value: 20

from_id

integer, optional

Return providers starting with a specific id. Default value: 0 Values greater than: 0

Response

Upon successful request, 200 status code will be returned. See ‘Related Errors’ table for other possibilities.

data

array, required

Wrapper for the data.

integer, required

ASPSP identifier in Salt Edge PSD2 Compliance Solution.

name

string, required

ASPSP name.

code

string, required

ASPSP code in Salt Edge PSD2 Compliance Solution.

connector_url

string, required

URL to Connector API layer implemented by ASPSP.

status

string, required

Current status of ASPSP. Allowed values: pending, disabled, test, live, sandbox

scopes

array, optional

Scopes supported by ASPSP. Allowed values: accounts, transactions, kyc, payments, funds_availability, trusted_beneficiaries

created_at

datetime, required

Datetime ASPSP registered in Salt Edge PSD2 Compliance Solution.

updated_at

datetime, required

Datetime ASPSP updated itself.

authorization_types

array, required

Available authorization types.

code

string, optional

Serves to identify any authorization type within the scope of a Provider on Salt Edge PSD2 Compliance Solution.

display_name

string, optional

Human readable name of given authorization type.

scopes

array, optional

List of scopes(permissions) that can be obtained through specific authorization type.

instruction

string, optional

Short instruction for the PSU.

required_fields

array, optional

List of all required(first step) authorization fields and their description.

display_name

string, optional

Human readable name of field.

code

string, optional

ASPSP code in Salt Edge PSD2 Compliance Solution.

optional

boolean, optional

Is current field required.

type

string, optional

Current field type.

mfa_fields

array, optional

List of all MFA(second step) authorization fields and their description.

display_name

string, optional

Human readable name of field.

code

string, optional

ASPSP code in Salt Edge PSD2 Compliance Solution.

optional

boolean, optional

Is current field required.

type

string, optional

Current field type.

sandbox_credentials

hash, optional

List of example credentials.

required_fields

array, optional

List of all required(first step) authorization fields and their description.

code

string, optional

ASPSP code in Salt Edge PSD2 Compliance Solution.

example

string, optional

Example of credentials for given field.

mfa_fields

array, optional

List of all MFA(second step) authorization fields and their description.

code

string, optional

ASPSP code in Salt Edge PSD2 Compliance Solution.

example

string, optional

Example of credentials for given field.

Related Errors

Class	Code	Description
OauthAppNotFound	404	OAuth Application specified in request does not exist or cannot be retrieved.
CertificateNotFound	404	Certificate has no permissions.

Templates

Returns all available payment templates which belong to a specific Provider.

CURL

curl -i \ -H "App-Id: X3R1wYzjbqdHUnePBINH8A" \ -H "App-Secret: K6gV3EPYH9ZYT7KOrjCuZg" \ -H "Client-Request-Id: 17" \ -X GET "/api/v2/providers/:provider_code/templates"

curl -i  \ 
 -H "App-Id: X3R1wYzjbqdHUnePBINH8A" \ 
 -H "App-Secret: K6gV3EPYH9ZYT7KOrjCuZg" \ 
 -H "Client-Request-Id: 17" \ 
 -X GET "/api/v2/providers/:provider_code/templates"

Example of response

{"data":[{"id":757,"description":"Internal transfer","provider_id":251,"payment_type":"internal_transfer","default":false,"extra":{},"created_at":"2019-11-18T16:04:50.658Z","updated_at":"2019-11-18T16:04:50.658Z","payment_attributes":[{"attribute_name":"amount","attribute_type":"number","label":"Amount","optional":false,"position":1,"values":[]},{"attribute_name":"to_account","attribute_type":"text","label":"To account","optional":false,"position":2,"values":[]},{"attribute_name":"currency","attribute_type":"dropdown","label":"Currency","optional":false,"position":3,"values":["EUR","USD"]}]}]}

Request

GET /api/v2/providers/:provider_code/templates

Headers

Header	Type	Description
`App-Id`	string, required	Application’s `app_id` from connection details tab. Can raise: OauthAppNotFound, CertificateNotFound
`App-Secret`	string, required	Application’s `app_secret` from connection details tab.
`Client-Request-Id`	string, optional	Request identifier. If present, it will be returned within `meta` field in response.

Unpacked Request Authorization

provider_code (path)

string, required

Human readable Provider identifier. Can raise: ProviderNotFound, AccessDenied

Response

Upon successful request, 200 status code will be returned. See ‘Related Errors’ table for other possibilities.

data

array, required

Wrapper for the data.

integer, required

Template identifier.

description

string, required

Short description of payment template.

provider_id

integer, required

Identifies Provider under which template was defined.

payment_type

string, required

Specifies the type of payment associated with a preregistered template.

default

boolean, required

States whether given template is default or not. Allowed values: true, false

extra

hash, required

Extra details that should persist in the session.

created_at

datetime, required

Datetime of template creation on Salt Edge PSD2 Compliance side.

updated_at

datetime, required

Datetime of last template update on Salt Edge PSD2 Compliance side.

payment_attributes

array, required

Contains a list of payment attributes with their characteristics.

attribute_name

string, required

Name of the attribute, should be used by application as input field name.

attribute_type

string, required

Type of the input field that should be used. Allowed values: text, number, dropdown

label

string, required

Human readable label for presentation of the payment attribute.

optional

boolean, required

Flag that shows whether the attribute is optional or not. Allowed values: true, false

position

integer, required

Position index of the attribute within payment template, should be considered when rendering the template.

values

array, optional

List of possible values for a given payment attribute.

Related Errors

Class	Code	Description
AccessDenied	401	Action you want to perform is not allowed. More in `error_message`
ProviderNotFound	404	Provider specified in request does not exist or cannot be retrieved.
OauthAppNotFound	404	OAuth Application specified in request does not exist or cannot be retrieved.
CertificateNotFound	404	Certificate has no permissions.