ob-p-a2a-pis-api

Single Payment

API Reference

Single payment is a standard payment that should be executed by the payer's bank as soon as possible after payment authorisation. 

Single payments are typically used in context of e-commerce or in-store payments but could also be used in context of incoming / outgoing invoice payments.

POST Single Payment API

The base URL is: /xs2a/routingservice/services/ob/pis/v3

Endpoint: POST /payments

You need to provide a few mandatory headers together with a few basic payment details.  The full API reference can be found here.

  • Body parameters that are marked as optional, could still be mandatory for certain ASPSP’s. Details on these optional parameters can be retrieved from the Reach API. For specific APIs parameters might be marked as Forbidden (in this case they must not be set for that ASPSP) or as Mandatory for the specific ASPSP.
  • We support Instant and standard Sepa Credit transfers in addition to local payment schemes (e.g. in Poland).  Please ensure that payer's bank support your preferred PaymentProduct as it was explained in Step 1 - payment preparation.
  • You can specify you preferred payment authorisation flow in PreferredScaMethod parameter but it is not guaranteed that the bank will follow your preference.
  • It is important to provide  a unique (for you) value in the EndToEndId parameter. Often banks will provide this value in payer's or payee's bank statement provided in machine readable format, hence allowing automated reconciliation. In addition, we recommend providing some kind of unique identifier (not UUID) in the RemittanceInformation field as well. NOTE that the RemittanceInformation field is normally visible to the payer / payee and should explain the payment context in a user friendly manner.
  • We support payments with flexible amount, meaning that the end user can update the payment amount within predefined range. You can use Amount Type parameter to control the settings. 
  • You may check the request examples and the datamodel of the request and response below.

To test your payment implementation please use our Sandbox Scenarios.

Examples

Example of a post payments request with a minimal set of fields which will work for most ASPSP's:

{
  "PaymentProduct": [
    "PSD2-SCT"
  ],
  "PsuData": {
    "AspspId": "20100"
  },
  "CommonPaymentData": {
    "EndToEndId": "ID-7853389",
    "InitiatingPartyReferenceId": "Ref-88276166",
    "Amount": {
      "Amount": "1.00",
      "Currency": "EUR"
    },
    "DebtorInformation": {
      "Name": "Juno Smith"
    },
    "RemittanceInformation": "Remittance Information"
  }
}

Example of a payment request which includes additional information about the debtor:


  {
  "PaymentProduct": [
    "PSD2-SCT"
  ],
  "PsuData": {
    "AspspId": "20100"
  },
  "CommonPaymentData": {
    "EndToEndId": "ID-0123456789",
    "InitiatingPartyReferenceId": "Ref-992098126",
    "PreferredScaMethod": [
      "Redirect"
    ],
    "Amount": {
      "Amount": "123.45",
      "Currency": "EUR"
    },
    "DebtorInformation": {
      "Name": "Bob Smith",
      "Agent": "8QB2EN7P",
      "Account": {
        "SchemeName": "IBAN",
        "Identification": "DE89370400440532013000",
        "Currency": "EUR"
      }
    },
    "RemittanceInformation": "Remittance Information"
  }
}

Datamodel

Below is a representation of the API request and response structure; click to enlarge.

Request - Post payments

Post payments request

Response - Post payments

Post payments response

 

Enable "on this page" menu on doc section
On

ob-p-a2a-reach

Reach Directory

API Reference

The Reach Directory API allows the Initiating Party to retrieve a list of all reachable ASPSP's via the Open Banking Service. The main information that can be received is the ASPSP name and ID, which has to be used to identify the ASPSP to which the payment should be addressed.

The information returned by the Reach Directory API doesn't change frequently. It will be sufficient to retrieve a new list once a day.

ASPSP's have implemented their APIs based on several standards, sometimes with proprietary deviations. Since the Open Banking Service offers a unified API to reach ASPSP's, additional information is provided to inform the Initiating Party about specific details required to make a successful payment request.

How these specific details are communicated in the Reach Directory response is described in the sections 'Details' and 'Options'

Details

The Details section in the reach directory response consists of the following fields:

  • Api
  • FieldName
  • Type
  • Value
  • ProtocolVersion

Mandatory information in this section is the Api, which is defining for which endpoint the information is applicable. If there is no FieldName given, the Type is describing whether this endpoint is available (SUPPORTED) or not (UNSUPPORTED).

TypeDescription if NOT combined with a FieldName
UNSUPPORTED

The mentioned Api is not supported by the ASPSP, the Open Banking Service will throw an error if it’s used.

This is mentioned for Api’s which are normally supported (for the api’s not mentioned in the row below)

SUPPORTED

The mentioned Api is supported by the ASPSP. This is mentioned for the following Api’s (because they are usually not supported):

- POST /psus/{psuId}/Aspsps/{aspspId}/pre-authentication"

If the Post is supported the corresponding api methods (GET, PUT, DELETE) are also supported, if defined in the swagger.

If the FieldName is given, the Type is describing whether the field is UNSUPPORTED, SUPPORTED, MANDATORY or FORBIDDEN. The table below specifies the rules for the Type-FieldName combination:

TypeDescription if combined with a FieldName
UNSUPPORTEDThe mentioned FieldName is ignored if provided to the Open Banking Service, the Open Banking Service will not throw an error
SUPPORTEDA subset of the values in the mentioned FieldName is supported. The Value field (which is always supplied with the SUPPORTED Type) will indicate which values are supported. If no value is provided by the initiating party the Open Banking Service will use a default value. If an unsupported value is used, the Open Banking Service will throw an error.
MANDATORYThe mentioned FieldName is mandatory and has to be filled. If supplied, the Value field will indicate which values are supported. If the Value field is not supplied no validation on the field is done by the Open Banking Service. If the mentioned FieldName is not filled by the initiating party the Open Banking Service will throw an error. If an unsupported value is used, the Open Banking Service will throw an error.
FORBIDDENThe mentioned FieldName is forbidden. The Open Banking Service will throw an error if the initiating party fills this field and the request will not be sent to the ASPSP.

The FieldName may refer to a header field in the same way. Since the fields in an API endpoint are unique for header and body there is no distinction between header and body in the Details record.

The Value is providing detailed information of that field within the given Api. If the Value contains a list of values, they are separated by ‘|’.

In addition the ProtocolVersion used for the communication between the Open Banking Service and the ASPSP is provided, although this information isn’t crucial for the Initiating Party.

Example for API

An example for Api without the FieldName is the pre-authentication Api. For most ASPSPs a pre-authentication is not supported. For those ASPSPs where a pre-authentication is possible there is a record in the Details:

"Api": "POST /psus/{psuId}/Aspsps/{aspspId}/pre-authentication",
"Type": "SUPPORTED",
"ProtocolVersion": "BG_V_1_3_0"

Examples for Api combined with FieldName

An example of Api combined with a FieldName is the Post /payments Api with the PaymentProduct field. This field is defined as optional in the corresponding swagger file. The swagger also indicates that four values can be given: Normal, Instant, Target2 or Domestic. In the case that only a subset of these values is supported by the ASPSP, the following record is provided in the reach directory response:

"Api": "POST /payments",
"FieldName": "PaymentProduct",
"Type": "SUPPORTED",
"Value": "Normal|Instant",
"ProtocolVersion": "BG_V_1_3_0"

In this example above Type SUPPORTED indicates the PaymentProduct field is still optional but the values to be used are restricted to Normal and Instant.

It would be possible to configure the same for Type MANDATORY. In that case the PaymentProduct has to be specified in the POST payment request.

"Api": "POST /payments",
"FieldName": "DebtorName",
"Type": "MANDATORY",
"ProtocolVersion": "BG_V_1_3_0"

In this example the Type is MANDATORY, the DebtorName has to be provided in the body. No Value is given, so no validation is done for the content.

Options

The Options section is providing information regarding the way of using API endpoints for specific ASPSPs similar to the Details section. But the information given here is not that specifically related a single API’s endpoint. It is more to be seen as a parameter for the ASPSP itself even though a clear separation between API endpoint and ASPSP globally isn’t that clear always.

Since the Options are not defined for a single endpoint there is no Api attribute given for the single options. Instead they have two keys (Key1 and Key2) identifying the use of the single Option. An example for this is:

"Key1": "PREAUTH_MANDATORY",
"Value": "1",
"Level": "INFORMATIONAL"

In this case for the given ASPSP pre-authentication is mandatory because the value is set to 1. The setting of 1 is reflecting that the option is set. A list of possible option keys is given below. The Key2 is currently not used. It is foreseen to allow definition of grouped options having the same main key Key1 and a different sub-key key2. An example for options provided in the Reach API is shown below:

Key1Key2ValueLevelDescription
PREAUTH_MANDATORY 1, 0INFORMATIONALThe pre-authentication (regardless whether being done implicitly or explicitly) is mandatory. Default 0
PREAUTH_EXPLICIT_REQUIRED 1, 0CRITICALPre-authentication has to be done explicitly by the POST pre-authentication endpoint

GET ASPSPs

The base URL for the Reach Directory is: /xs2a/routingservice/services/directory/v3 

Endpoint: GET /aspsps

This endpoint is used to retrieve the reach directory.

Request

Get reach request

Response

Get reach response

Example: Reach PIS

Request

GET https://xs2a.awltest.de/xs2a/routingservice/services/directory/v2/aspsps?allDetails=true
 
Authorization: Bearer 4248ce19f27a7df671b29a1816a0ff1f
Accept: application/json
Host: xs2a.ewl.de

Response

HTTP/1.1 200 OK
Cache-Control: no-cache,no-store
MessageCreateDateTime: 2021-03-22T13:51:34.431Z
X-Request-ID: 4aa13498-b3eb-4dbf-b373-a9878b29214d
Pragma: no-cache
Date: Mon, 22 Mar 2021 13:51:34 GMT
Content-Type: application/json;charset=UTF-8
Connection: close
Strict-Transport-Security: max-age=16070400; includeSubDomains
Transfer-Encoding: chunked
{
    "Service": "PIS",
    "ASPSP": [
        {
            "AspspId": "1401",
            "Name": [    {
                "Label": "French example bank",
                "Language": "en"
            }],
            "CountryCode": "FR",
            "CategoryLabel": [],
            "Details": [
                {
                    "Api": "POST /payments",
                    "Fieldname": "PaymentProduct",
                    "Type": "SUPPORTED",
                    "Value": "Normal",
                    "ProtocolVersion": "STET_V_1_4_2_1_7"
                },
                {
                    "Api": "POST /payments",
                    "Fieldname": "RemittanceInformation",
                    "Type": "MANDATORY",
                    "ProtocolVersion": "STET_V_1_4_2_1_7"
                },
                {
                    "Api": "POST /payments/{paymentId}/identification",
                    "Fieldname": "preferredScaMethod",
                    "Type": "SUPPORTED",
                    "Value": "REDIRECT",
                    "ProtocolVersion": "STET_V_1_4_2_1_7"
                }
            ],
            "BIC": "FREBFRPP"
        }
    ]
}
Enable "on this page" menu on doc section
On

ob-obp-common-elements

Common API Elements

The following common elements apply to all Open Banking APIs, so please keep it in mind while implementing any of the endpoints.

Timezones and Time Formats

The ISODateTime standard is used in the Open Banking v3 API.

  • Datetime fields sent towards the Open Banking Service should have a timezone (for example: YYYY-MM-DDThh:mm:ssZ or YYYY-MM-DDThh:mm:ss+02)

  • Date fields sent towards the Open Banking Service are always interpreted as being in UTC.

API Compatibility Policy

All APIs follow the robustness principle: "be conservative in what you do, be liberal in what you accept from others". This means the following cases MUST NOT cause an error on client or server side:

  • unrecognized query parameters

  • unrecognized headers

  • unrecognized fields in body

Links Section

In the responses to API calls, usually a section called Links is included. This section contains endpoints that might be or even have to be called by the Initiating Party for the next steps. As described in section Authorization Flow, the ASPSP decides on the authorization approach. The next steps for authorization of a consent or payment depend on this decision. Additionally some ASPSPs have implemented a standard protocol with some deviations which may result in slightly different flows as well.

In order to inform the Initiating Party on the next request required for an authorization the links section provides the corresponding links. If a redirection of the PSU is required for example, the corresponding URL for that redirection is given in the link called RedirectUrl. In case of Decoupled Approach the PSU needs to be identified to the ASPSP for enabling him to send out a Push Notification to a mobile device for example. In this case the PostIdentificationForDecoupled is given in the response.

In the description of the response to the different API requests all possible links that may appear in the links section for that API are listed. Depending on the actual situation one or more links might be included in the response.

The URLs given in the links section are provided as complete ones including the domain name and query parameters if required. An example for links with query parameters are paginated responses where the query parameter allows to address the first, next, previous or last page.

Error Response

If a request cannot be executed successfully an error response is given. The structure of error responses is the same for all APIs. Additional to the standard HTTP Status a body is provided giving more detailed information on the error. The link is provided in the error response for future use and is currently not filled for any error response.

Mult.

Name

Comments

Type

[1..1]

Code

The Error code

String

[1..1]

Message

The description of the error. In a human readable form.

String

[0..1]

Details

Details of the error which could be useful for a developer

String

[0..1]

Link

 

Group

[1..1]

+ Href

URL

String

 

Retries

  • Transaction initiation: In case of receipt of a non-deterministic failure (timeout or 5xx), parties SHOULD retry the POST /payments API once.

    • When after this retry a second non-deterministic failure (timeout or 5xx) is received, this SHOULD be considered and communicated as a deterministic failure.

  • Transaction callback: The Open Banking Service will attempt to perform incremental retries of a callback up to 24 hours if it does not receive a response within 8 seconds and/or receives a different response code than 200 OK, 202 ACCEPTED or 204 NO CONTENT to the initial callback. The retries follow a fixed schedule that are defined in the API specifications.

Enable "on this page" menu on doc section
On

ob-obp-notification-service

Push Notification

API Reference

The Push Notification APIs described in this chapter need to be implemented on the Initiating Party side, if the Initiating Party decides to use them. The Open Banking Service will post notifications to these endpoints.

POST Status

Endpoint: POST /status

This API will notify the initiating party about the status of the payment. A different request will be sent for the Payment and Data. More details about the fields can be found in the API reference.

Request Payment (PaymentDetailedInformation)

Post status request payment

Response

HTML 204 (No Content)

Post status response

 

Enable "on this page" menu on doc section
On

ob-obp-security

Security

IT Security Management refers to the systematic approach of identifying, assessing, and mitigating risks to protect institution's resources and information from unauthorized access, damage, disruption or misuse. The implementation of control mechanisms such as policies and procedures are natural to ensure the confidentiality and availability of critical business information and infrastructure.

IT Security Management covers a wide range of aspects such as cybersecurity, cryptography, data protection, risk management, incident response and of course compliance with all applicable standards. 

We effectively manage security and minimize the impact of security breaches:

As a trusted partner of the largest financial institutions around the world, we maintain a secure and trusted environment for your operations -  Authentication, Authorization and Message Integrity of requests between you and Worldline are guaranteed through three different mechanisms:

Transport Level Security   -   Digital Signatures   -   Access Tokens

Transport Level Security

On the transport level all requests to the Open Banking Service, as well as all requests sent by the Open Banking Service MUST be encrypted using TLS and be made over HTTPS. TLS 1.3 SHOULD be used; TLS 1.2 MAY be used. Anything below TLS 1.2 MUST NOT be used and will be refused by the Open Banking Service. The TLS authentication method used is one-way, that means in requests to Worldline your server authenticates itself with its certificate and in case of requests from Worldline to you, the latter authenticates itself with its certificate.

Any connection without TLS encryption, such as plain http will be refused.

Digital Signatures

Signing the authorization request

On the application level, your application is authenticated and authorized by sending a digitally signed request to the Authorization API endpoint (see Authorization API). The signature validation allows to check the authenticity and integrity of the request. This is achieved by applying the "Authorization" scheme as described in Datatracker and further detailed in Authorization API.

In order to generate the string that is signed with a key, you should use the values of each HTTP header field in the `headers` Signature Parameter, in the order they appear in the `headers` Signature Parameter.

The `headers` Signature Parameter is fixed: headers=”app client id date”.

The header field string is created by concatenating the lowercased header field name followed with an ASCII colon `:`, an ASCII space ` `, and the header field value. Leading and trailing optional whitespace (OWS) in the header field value MUST be omitted. If the value is not the last value, then an ASCII newline `\n` is appended.

Example: For the request:

POST /authorize/token HTTP/1.1
App: IDEAL
Date: Fri, 25 Mar 2022 20:51:35 GMT
Client: idealClient
Id: 434

The concatenated String to sign would be:

app: IDEAL
client: idealClient
id: 434
date: Fri, 25 Mar 2022 20:51:35 GMT

The signature algorithm is fixed: algorithm=”SHA256withRSA”.

The ‘keyId’ Signature Parameter is the thumbprint of the used certificate, viewed with the SHA1 algorithm. The private key associated with `keyId` is used to generate a digital signature on the concatenated signature string applying the SHA256withRSA algorithm. The complete Authorization header looks then like this:

Authorization: Signature keyId=”DCAC7209573D506FC56095B8B23E8555A8F38B29”, algorithm=”SHA256withRSA”, headers=”app client id date”, signature=” guoLSHgl/zGRujqkDnmaWCL8kgCVnDazqkKu7nWU/uAHrS+M9eQsI8ueB4uWgxyPOnZps3vpNgkW1f4aBsdFYLS0jYeup4yhCMN6vis2zfMKxUhZFkjELslQkit9Gwc9pqvcyH0IxUnDLbCQwkiYjf6nGbP1YNfoxVXQpfq6i6CbIXCotLfwH2kbkrnSWwAS5skZY77+znmLDjtP3et2K94C36yPo0EEGqGkQ5xkD7owA7YxzA30xzsvkDvU3hzDzTK5wZmsgVsoyjRvMrokG0HrszUpNTwUtxflukcgs0pH7GuT+JrIpQ55f1dpzULqxeBggnCvD9DRSuKeTakqlw==”

You should provide the used public certificate to our Support team or upload it in the back-office so that the Open Banking Service is able to validate the signature. If the signature could be validated and the sender has a valid subscription, a response containing an access token is returned. This access token can be used in all follow-up requests until it is expired. After expiration a new access token must be requested from the Authorization API endpoint.

Signing requests and responses

Signing requests and responses could be enforced depending on  your preferred configuration. The following options exist:

  • Requests to the Payment Initiation, Payment Status and Debtor Preference APIs sent to Worldline

  • Requests to the Notification API, sent by Worldline to you

  • Responses sent back from Worldline to you

The digital signing is done by applying the “Signature” scheme as described in Signatures. This is equivalent to the “Authorization” scheme and the same procedure is followed to generate the signature and header parts but it uses the Signature header instead of the Authorization header.

A notification request or response from Open Banking Service to the Initiating Party may contain for example a header like:

Signature: keyId="2DOXXL7lNBNKJSMHKO2IBQC1", algorithm="SHA256withRSA", headers="digest x-request-id messagecreatedatetime", signature="lulVhOhRwFs5G8+uGCh3BjJHBG540AyTCyaKhr9QE71YTtljxFt1b7i55C9QROw/zGt+iac3cBfGGRiTAfW4ta9Hn8+u7LvyfYHFcdxBhNj7T6dgrv+MLG6aI6hw/3Cwmkz/OwESBrQJzISWf8/0bgYNuXnuPf5r7BGMhHdhIr+RNxocW6wkSOEVQfOGYazy7YsoJhVEwNEt9gN++sw9HVfaxmwjl8MqxGNcLoVAgoGMcUOvNhjATA1MSzOj2cmw6kdi2yY2w7XiMuU9Tma0jQ3CGKhxIkD8Na2Vq1K2bs/n2DOxxL7lNbnKjsmhkO2ibQc1+RV3pXQJ1SDSI3EW/w=="

The Initiating Party may then validate that the content of the sent message is correct and has not been altered during transmission or storage. For this please use Worldline public certificate that can be provided to you by our Support team or downloaded from the back-office.

Access Token

API calls towards Worldline

The access token as has been returned from the Authorization request endpoint can be used for subsequent requests towards Worldline. The default validity time of the access token is one hour after which a new one must be requested from the Authorization endpoint. A refresh token does not exist for this type of request.

The access token must be put into the request Authorization header like for example: Authorization:Bearer 4944daeae6c9115a10dafecbfad4a9c

With the access token the Open Banking Service can validate and authorize the request.

API calls from Worldline (for Notifications)

The access token used in requests from the Open Banking Service towards you can be configured in the Back-office, on the subscription page (the name of the field is: 'Notification BearerToken'). The token is static and does not have validity time.

The access token will be placed in the notification request Authorization header. With the access token you can validate and authorize the request.

Enable "on this page" menu on doc section
On

ob-obp-platform-setup

Platform Setup

Structure

We support 3 hierarchy levels of entities using Worldline Open Banking Platform:

1. Tenant - the highest level of hierarchy: 

A Tenant is typically licensed as AISP or PISP:

The AISP Tenant is authorized to retrieve account information from financial institutions - with the consent of the customer (see 2. Initiating Party or Merchant). This  can be a bank or a payment institution, that offers Services according to  PSD2.

The PISP Tenant is is authorized to initiate payments into or out of an consumer’s bank account - on behalf of a customer (see 2. Initiating Party or Merchant). PISPs are allowed to withdraw money directly from the customer's account, as long as the customer has given his consent. 

2. Initiating Party / Merchant

- client of AISP and / or PISP

The Initiating Party is the client of a licensed AISP /PISP (see 1. Tenant) who wants to access data or initiate payments on behalf of his customers. Typically this is the role, you will have in this hierarchy. 

(The Initiating Party can also be setup in the role of a Third Party Provider (TPP) as an intermediate between Merchants and ASPSPs / PISPs - the TPP  and provides an interface used by the Merchant.

3. Sub Merchant

- a client of the Initiating Party

The hierarchy is used in order to setup appropriate access rights (e.g. specific geographies or sub services) and for reporting purposes.

Setup

Tenant setup is done by Worldline, while the Merchant and Sub Merchant setup can be managed by yourself via: 

  • Back Office; a set of screens which can be offered white labeled

  • Merchant Subscription Management API; useful if integration with an existing CRM system is desired.

You already would like to kick off your onboarding or you might have further questions?
Please contact us to get access to the Back Office and kick off your onboarding.

Tenant Setup

Worldline sets up the Tenant on base of his requirements. Here are the main topics, which are configurable by the tenant and set up by Worldline:

- Which services are available (e.g. PIS, AIS, Ideal etc.)?
- Which User Roles should be set up? 
- Which modules should be ready for use in the Back office and for which roles should the modules be available?
- Should Merchant Self-Onboarding be available?
- Which Way of Integration should be set up?
- Should API's (for Merchant- and Subscription Management) be available?
- Additional features as Content Style, Translations, GUI Languages, Input Field Configuration etc. 

Enable "on this page" menu on doc section
On

ob-p-general

Payments Overview

Here you will find implementation details of our Payment Products. All Payment Products except iDeal / iDeal 2.0  are based on Account-to-Account payments.

Account-to-Account Payments

A payment request can be initiated by a payer or a payee. To be processed by the payer's bank, the payment needs to be authorised by the payer to the bank. A payer's bank will apply a strong customer authentication to ensure payer's identity. This can lead to multiple flows in which a payment can be completed.

We support single SEPA, Instant SEPA, Domestic and cross-border payments with our Payment API. In addition, we can offer also an ability to initiate bulk payments, periodic or scheduled payments. To learn what kind of payments is supported by payer's bank, you should use Reach API once a day.

For faster integration and better user experience we offer a set of predefined screens that could be customised with your branding allowing to choose the payer's bank and handling the complexity of different PSD2 authorization flows (redirect / decoupled / embedded), so that you will be able to focus on your product and leave the boring stuff to us.

You can learn about payment execution progress either by polling the payment status by yourself or by subscribing to our push notifications. If you chose to subscribe to push notifications, we will continuously check with the bank on payment authorisation and execution progress and proactively notify you on the changes.

We also offer a Refund API allowing to refund historical payments.

Once you finished your implementation we recommend to go through the list of suggested testing scenarios.

Creditor Account Options

A merchant on the Worldline Open Banking Platform, can be setup as either a E-Commerce or p2p merchant. When E-Commerce is selected, the Open banking Platform will initialize payments using a predefined creditor account. When p2p is selected the merchant can specify the creditor account in the post payments API call.

For E-Commerce merchants an additional service is available: In case you act as a payee and hold multiple bank accounts, you may want allow Worldline to choose the account that will be credited as a result of the payment. In case you hold bank account with the same bank as the payer, this account will be prioritised to ensure quick intra-bank settlement and reduce transaction fees paid to the bank. If you are interested, please request to switch on the Dynamic Creditor Account Lookup feature for you during the integration phase.

iDEAL Payments

We allow banks to become acquirers for iDeal 2.0 transactions in Netherlands. That means that merchants who are the clients of the bank will be able to initiate iDeal payments using our Payment API.

You can learn about payment execution progress either by polling the payment status by yourself or by subscribing to our push notifications. If you chose to subscribe to push notifications, we will continuously check with the bank on payment authorisation and execution progress and proactively notify you on the changes.

We also offer a Refund API allowing to refund historical payments.

Need help?

Please get in touch with us and we will  help you to integrate our APIs.

 

Enable "on this page" menu on doc section
On

Test_RN

Version 2.7.1 to 2.8.0

What's New


GET /issuers/{issuerId}/accounts/external-accounts/{issuerAccountExternalReference}/turnover-information

Retrieve turnover information for an account

The API is used to get the turnover information for an account

GET /issuers/{issuerId}/accounts/{accountReference}/turnover-information

Retrieve turnover information for an account

The API is used to get the turnover information for an account

GET /issuers/{issuerId}/companies/{customerReference}

Retrieve company's information

PUT /issuers/{issuerId}/companies/{customerReference}

Update company

The "update company" API allows the user to update the attributes of a customer. To identify the customer, it is needed to provide:

  • The issuer ID
  • The customer reference (internal or external) for which updates are required

The customer reference can be retrieved by using the "list customers" API. All the attributes must be given in input even if they remain unchanged. For that, It can be needed to use the "retrieve customer" API to get all the current attributes.

PATCH /issuers/{issuerId}/companies/{customerReference}

Update company partially

The "update company partially" API allows the user to update the attributes of a customer. To identify the customer, it is needed to provide:

  • The issuer ID
  • The customer reference (internal or external) for which updates are required

The customer reference can be retrieved by using the "List customers" API. With this API, only attributes that need to be updated must be given in input.

GET /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}

Retrieve company information by external reference

PUT /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}

Update Company

The "update Company" API allows the user to update the attributes of a customer. To identify the customer, it is needed to provide:

  • The issuer ID
  • The customer reference (internal or external) for which updates are required

The customer reference can be retrieved by using the "list customers" API. All the attributes must be given in input even if they remain unchanged. For that, It can be needed to use the "retrieve customer" API to get all the current attributes.

PATCH /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}

Update Company partially

The "update customer partially" API allows the user to update the attributes of a customer. To identify the customer, it is needed to provide:

  • The issuer ID
  • The customer reference (internal or external) for which updates are required

The customer reference can be retrieved by using the "List customers" API. With this API, only attributes that need to be updated must be given in input.

GET /issuers/{issuerId}/companies

Retrieve list of company's information

POST /issuers/{issuerId}/companies

Create company

GET /issuers/{issuerId}/companies/{customerReference}/addresses

Retrieve company's Address information list

POST /issuers/{issuerId}/companies/{customerReference}/addresses

Create address for a company customer

The API creates an address for the customer, identified with his reference. An address includes the following information:

  • the issuer address external reference
  • the label (eg MAIN_POSTAL_ADDRESS),
  • the type (mail address, phone number, email) and the corresponding data
  • the address usages
  • the start date.

For information, the main postal address is mandatory.

In return, the API provides the address Reference calculated by our system.

GET /issuers/{issuerId}/companies/{customerReference}/addresses/{addressReference}

Retrieve company's address information by address ref

PUT /issuers/{issuerId}/companies/{customerReference}/addresses/{addressReference}

Update company address

The API updates all the attributes of a customer's address identified with the reference of the customer and the reference of the address. All the attributes must be provided even those unchanged. The identifiers stay unchanged.

GET /issuers/{issuerId}/companies/{customerReference}/addresses/external-addresses/{issuerAddressExternalReference}

Retrieve company's address information by externalAddress

PUT /issuers/{issuerId}/companies/{customerReference}/addresses/external-addresses/{issuerAddressExternalReference}

Update company address

The API updates all the attributes of a customer's address identified with the reference of the customer and the reference of the address. All the attributes must be provided even those unchanged. The identifiers stay unchanged.

GET /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses

Retrieve company's Address information list by external reference

POST /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses

Create address for a company

The API creates an address for the customer, identified with his reference. An address includes the following information:

  • the issuer address external reference
  • the label (eg MAIN_POSTAL_ADDRESS),
  • the type (mail address, phone number, email) and the corresponding data
  • the address usages
  • the start date.

For information, the main postal address is mandatory.

In return, the API provides the address Reference calculated by our system.

GET /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses/{addressReference}

Retrieve address information by company external reference and address reference

PUT /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses/{addressReference}

Update company address

The API updates all the attributes of a customer's address identified with the reference of the customer and the reference of the address. All the attributes must be provided even those unchanged. The identifiers stay unchanged.

GET /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses/external-addresses/{issuerAddressExternalReference}

Retrieve address information by company external reference and address external reference

PUT /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses/external-addresses/{issuerAddressExternalReference}

Update company address

The API updates all the attributes of a customer's address identified with the reference of the customer and the reference of the address. All the attributes must be provided even those unchanged. The identifiers stay unchanged.

POST /issuers/{issuerId}/companies/{customerReference}/addresses/{addressReference}/activate

Activate address of a company

POST /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses/{addressReference}/activate

Activate address of a company

POST /issuers/{issuerId}/companies/{customerReference}/addresses/external-addresses/{issuerAddressExternalReference}/activate

Activate address of a company

POST /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses/external-addresses/{issuerAddressExternalReference}/activate

Activate address of a company

POST /issuers/{issuerId}/companies/{customerReference}/addresses/{addressReference}/deactivate

Deactivate address of a company

POST /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses/{addressReference}/deactivate

Deactivate address of a company

POST /issuers/{issuerId}/companies/{customerReference}/addresses/external-addresses/{issuerAddressExternalReference}/deactivate

Deactivate address of a company

POST /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses/external-addresses/{issuerAddressExternalReference}/deactivate

Deactivate address of a company

POST /issuers/{issuerId}/companies/{customerReference}/addresses/{addressReference}/address-usages

Create an address usage for a company

This API allows to link a usage determined by its name (e.g. STATEMENT_SENDING), its entity reference (e.g. card contract reference) and its service code (e.g. ACCOUNT_SERVICE) and the address (identified with its internal reference) of a company (identified with its external reference).

DELETE /issuers/{issuerId}/companies/{customerReference}/addresses/{addressReference}/address-usages

Remove an address usage of a company

The API deletes the address usages linked to one address. These address usages are filtered by the request params : addressUsageName (for definition see the ressource addressUsage), mandatory entityReference (for definition see the ressource addressUsage), optional serviceCode (for definition see the ressource addressUsage), mandatory If the entityReference is empty and the API finds several addresseUsages (for the addressUsageName and serviceCode in request param), then the list of addressUsages will be deleted.

POST /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses/{addressReference}/address-usages

Create an address usage for a company

The address usage describes for which business case the address will be used (e.g., statement sending, card delivery, ...). The complete authorized values list is shared during the product configuration between the issuer and WL. This API allows a usage determined by its name (e.g. STATEMENT_SENDING) to be linked to the entity reference of the address (e.g. card contract reference) and the service code (e.g. ACCOUNT_SERVICE)

DELETE /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses/{addressReference}/address-usages

Remove an address usage of a company

The API deletes the address usages linked to one address. These address usages are filtered by the request params : addressUsageName (for definition see the ressource addressUsage), mandatory entityReference (for definition see the ressource addressUsage), optional serviceCode (for definition see the ressource addressUsage), mandatory If the entityReference is empty and the API finds several addresseUsages (for the addressUsageName and serviceCode in request param), then the list of addressUsages will be deleted.

POST /issuers/{issuerId}/companies/{customerReference}/addresses/external-addresses/{issuerAddressExternalReference}/address-usages

Create an address usage for a company

The address usage describes for which business case the address will be used (e.g., statement sending, card delivery, ...). The complete authorized values list is shared during the product configuration between the issuer and WL. This API allows a usage determined by its name (e.g. STATEMENT_SENDING) to be linked to the entity reference of the address (e.g. card contract reference) and the service code (e.g. ACCOUNT_SERVICE)

DELETE /issuers/{issuerId}/companies/{customerReference}/addresses/external-addresses/{issuerAddressExternalReference}/address-usages

Remove an address usage of a company

The API deletes the address usages linked to one address. These address usages are filtered by the request params : addressUsageName (for definition see the ressource addressUsage), mandatory entityReference (for definition see the ressource addressUsage), optional serviceCode (for definition see the ressource addressUsage), mandatory If the entityReference is empty and the API finds several addresseUsages (for the addressUsageName and serviceCode in request param), then the list of addressUsages will be deleted.

POST /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses/external-addresses/{issuerAddressExternalReference}/address-usages

Create an address usage for a company

This API allows to link a usage determined by its name (e.g. STATEMENT_SENDING), its entity reference (e.g. card contract reference) and its service code (e.g. ACCOUNT_SERVICE) and the address (identified with its external reference) of a company (identified with its external reference).

DELETE /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/addresses/external-addresses/{issuerAddressExternalReference}/address-usages

Remove an address usage of a company

The API deletes the address usages linked to one address. These address usages are filtered by the request params : addressUsageName (for definition see the ressource addressUsage), mandatory entityReference (for definition see the ressource addressUsage), optional serviceCode (for definition see the ressource addressUsage), mandatory If the entityReference is empty and the API finds several addresseUsages (for the addressUsageName and serviceCode in request param), then the list of addressUsages will be deleted.

GET /issuers/{issuerId}/corporate-contracts/{contractReference}/corporate-employee-accounts/{accountReference}

Retrieve corporate employee Accounts

This API allows retrieving a particular corporate employee accounts from its reference or its issuer external reference

PATCH /issuers/{issuerId}/corporate-contracts/{contractReference}/corporate-employee-accounts/{accountReference}

Update Corporate employee account

The API allows to update a corporate Employee account

GET /issuers/{issuerId}/corporate-contracts/{contractReference}/corporate-employee-accounts/external-accounts/{issuerAccountExternalReference}

Retrieve corporate employee Accounts With External Account Ref

This API allows retrieving a particular corporate employee accounts from its reference or its issuer external reference

PATCH /issuers/{issuerId}/corporate-contracts/{contractReference}/corporate-employee-accounts/external-accounts/{issuerAccountExternalReference}

Update Corporate employee account by external account

The API allows to update a corporate Employee account

GET /issuers/{issuerId}/corporate-contracts/external-contracts/{issuerContractExternalReference}/corporate-employee-accounts/external-accounts/{issuerAccountExternalReference}

Retrieve corporate employee Accounts With External Contract Ref And External Account Ref

This API allows retrieving a particular corporate employee accounts from its reference or its issuer external reference

PATCH /issuers/{issuerId}/corporate-contracts/external-contracts/{issuerContractExternalReference}/corporate-employee-accounts/external-accounts/{issuerAccountExternalReference}

Update Corporate employee account by external contract and account

The API allows to update a corporate Employee account

GET /issuers/{issuerId}/corporate-contracts/external-contracts/{issuerContractExternalReference}/corporate-employee-accounts/{accountReference}

Retrieve corporate employee Accounts With External Contract Ref

This API allows retrieving a particular corporate employee accounts from its reference or its issuer external reference

PATCH /issuers/{issuerId}/corporate-contracts/external-contracts/{issuerContractExternalReference}/corporate-employee-accounts/{accountReference}

Update Corporate employee account By external contract

The API allows to update a corporate Employee account

GET /issuers/{issuerId}/companies/{customerReference}/corporate-contracts

List corporate contracts for a company

The API returns all the corporate contracts where the company belongs to

GET /issuers/{issuerId}/companies/external-customers/{issuerCustomerExternalReference}/corporate-contracts

List corporate contracts for a company

The API returns all the corporate contracts where the company belongs to

GET /issuers/{issuerId}/corporate-contracts/{contractReference}

Retrieve corporate contract

This API allows retrieving a particular corporate contract from its reference or its issuer external reference. The API response contains contract information such as:

  • contract identifier with the contract reference and the issuer external contract reference if previously provided
  • product change information if any, such as its current status (scheduled, done, cancelled), new product, new contract if it exists
  • embedded fields if requested such as list of all customers or identifiers linked to this contract (e.g. contract owner, root account owner, cardholder(s)), card contracts, cards
POST /issuers/{issuerId}/corporate-contracts/{contractReference}/close

Close Corporate contract

The API allows to close a corporate contract identified by the Contract reference. The contract can be closed immediately or in the future at a date provided by the issuer or at the card expiry date.

As result, For immediate closure : The contract is closed, the cards within the contract are deactivated, the closing is triggered for the accounts.

For scheduled closure : The contract is not changed until the closing date is reached. Once the closing date is reached, the contract is closed, the cards within the contract are deactivated, the closing is triggered for the accounts.

POST /issuers/{issuerId}/corporate-contracts/external-contracts/{issuerContractExternalReference}/close

Close Corporate contract

The API allows to close a Corporate contract identified by the Issuer Contract external reference or the Contract reference. The contract can be closed immediately or in the future at a date provided by the issuer or at the card expiry date.

As result, For immediate closure : The contract is closed, the cards within the contract are deactivated, the closing is triggered for the accounts.

For scheduled closure : The contract is not changed until the closing date is reached. Once the closing date is reached, the contract is closed, the cards within the contract are deactivated, the closing is triggered for the accounts.

POST /issuers/{issuerId}/cards/declare-counterfeit-card

Declare counterfeit card

What's Changed


POST /issuers/{issuerId}/cards/pin-state
Response:
  • Changed property data (object CardStates)
    • Added property expiryDate (string)
    • Added property status (string)
    • Added property blockingReason (string)
POST /issuers/{issuerId}/contracts/{contractReference}/force-product-change
Response:
  • Changed property data (object ForceProductChangeResponse)
    • Added property originalContract (object)
    • Added property changedContract (object)
    • Added property productChangeInformation (object)
    • Deleted property oldContract (object)
    • Deleted property newContract (object)
POST /issuers/{issuerId}/contracts/external-contracts/{issuerContractExternalReference}/force-product-change
Response:
  • Changed property data (object ForceProductChangeResponse)
    • Added property originalContract (object)
    • Added property changedContract (object)
    • Added property productChangeInformation (object)
    • Deleted property oldContract (object)
    • Deleted property newContract (object)
GET /issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}
Response:
  • Changed property data (object Card)
    • Added property logoReference (string)
    • Added property dispatchCode (string)
    • Added property automaticDeactivationDate (string)
    • Deleted property replacementForAutomaticDeactivationDate (string)
    • Changed property cardContract (object CardContract)
      • Changed property cards (array)
        • Changed items (object Card)
          • Added property logoReference (string)
          • Added property dispatchCode (string)
          • Added property automaticDeactivationDate (string)
          • Deleted property replacementForAutomaticDeactivationDate (string)
POST /issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/block-and-replace
Request body:
  • Changed property replaceCardRequest (object ReplaceCardRequest)
    • Added property forceNewPIN (boolean)
Response:
  • Changed property data (object BlockAndReplaceCardResponse)
    • Changed property replaceCardResponse (object ReplaceCardResponse)
      • Added property originalContract (object)
      • Added property changedContract (object)
      • Added property productChangeInformation (object)
      • Changed property card (object ReplaceCardResponse.Card)
        • Added property automaticDeactivationDate (string)
        • Deleted property replacementForAutomaticDeactivationDate (string)
      • Changed property newRelatedCardList (array)
        • Changed items (object ReplaceCardResponse)
          • Added property originalContract (object)
          • Added property changedContract (object)
          • Added property productChangeInformation (object)
          • Changed property card (object ReplaceCardResponse.Card)
            • Added property automaticDeactivationDate (string)
            • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/orders/{orderReference}
Response:
  • Changed property data (object Order)
    • Changed property card (object Card)
      • Added property logoReference (string)
      • Added property dispatchCode (string)
      • Added property automaticDeactivationDate (string)
      • Deleted property replacementForAutomaticDeactivationDate (string)
      • Changed property cardContract (object CardContract)
        • Changed property cards (array)
          • Changed items (object Card)
            • Added property logoReference (string)
            • Added property dispatchCode (string)
            • Added property automaticDeactivationDate (string)
            • Deleted property replacementForAutomaticDeactivationDate (string)
POST /issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/replace
Request body:
  • Added property forceNewPIN (boolean)
Response:
  • Changed property data (object ReplaceCardResponse)
    • Added property originalContract (object)
    • Added property changedContract (object)
    • Added property productChangeInformation (object)
    • Changed property card (object ReplaceCardResponse.Card)
      • Added property automaticDeactivationDate (string)
      • Deleted property replacementForAutomaticDeactivationDate (string)
    • Changed property newRelatedCardList (array)
      • Changed items (object ReplaceCardResponse)
        • Added property originalContract (object)
        • Added property changedContract (object)
        • Added property productChangeInformation (object)
        • Changed property card (object ReplaceCardResponse.Card)
          • Added property automaticDeactivationDate (string)
          • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/cards/{cardReference}
Response:
  • Changed property data (object Card)
    • Added property logoReference (string)
    • Added property dispatchCode (string)
    • Added property automaticDeactivationDate (string)
    • Deleted property replacementForAutomaticDeactivationDate (string)
    • Changed property cardContract (object CardContract)
      • Changed property cards (array)
        • Changed items (object Card)
          • Added property logoReference (string)
          • Added property dispatchCode (string)
          • Added property automaticDeactivationDate (string)
          • Deleted property replacementForAutomaticDeactivationDate (string)
POST /issuers/{issuerId}/cards/{cardReference}/block-and-replace
Request body:
  • Changed property replaceCardRequest (object ReplaceCardRequest)
    • Added property forceNewPIN (boolean)
Response:
  • Changed property data (object BlockAndReplaceCardResponse)
    • Changed property replaceCardResponse (object ReplaceCardResponse)
      • Added property originalContract (object)
      • Added property changedContract (object)
      • Added property productChangeInformation (object)
      • Changed property card (object ReplaceCardResponse.Card)
        • Added property automaticDeactivationDate (string)
        • Deleted property replacementForAutomaticDeactivationDate (string)
      • Changed property newRelatedCardList (array)
        • Changed items (object ReplaceCardResponse)
          • Added property originalContract (object)
          • Added property changedContract (object)
          • Added property productChangeInformation (object)
          • Changed property card (object ReplaceCardResponse.Card)
            • Added property automaticDeactivationDate (string)
            • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/cards/{cardReference}/orders/{orderReference}
Response:
  • Changed property data (object Order)
    • Changed property card (object Card)
      • Added property logoReference (string)
      • Added property dispatchCode (string)
      • Added property automaticDeactivationDate (string)
      • Deleted property replacementForAutomaticDeactivationDate (string)
      • Changed property cardContract (object CardContract)
        • Changed property cards (array)
          • Changed items (object Card)
            • Added property logoReference (string)
            • Added property dispatchCode (string)
            • Added property automaticDeactivationDate (string)
            • Deleted property replacementForAutomaticDeactivationDate (string)
POST /issuers/{issuerId}/cards/{cardReference}/replace
Request body:
  • Added property forceNewPIN (boolean)
Response:
  • Changed property data (object ReplaceCardResponse)
    • Added property originalContract (object)
    • Added property changedContract (object)
    • Added property productChangeInformation (object)
    • Changed property card (object ReplaceCardResponse.Card)
      • Added property automaticDeactivationDate (string)
      • Deleted property replacementForAutomaticDeactivationDate (string)
    • Changed property newRelatedCardList (array)
      • Changed items (object ReplaceCardResponse)
        • Added property originalContract (object)
        • Added property changedContract (object)
        • Added property productChangeInformation (object)
        • Changed property card (object ReplaceCardResponse.Card)
          • Added property automaticDeactivationDate (string)
          • Deleted property replacementForAutomaticDeactivationDate (string)
POST /issuers/{issuerId}/contracts/{contractReference}/change-product
Response:
  • Changed property data (object ChangeProductResponse)
    • Added property originalContract (object)
    • Added property changedContract (object)
    • Added property productChangeInformation (object)
    • Deleted property oldContract (object)
    • Deleted property newContract (object)
POST /issuers/{issuerId}/contracts/external-contracts/{issuerContractExternalReference}/change-product
Response:
  • Changed property data (object ChangeProductResponse)
    • Added property originalContract (object)
    • Added property changedContract (object)
    • Added property productChangeInformation (object)
    • Deleted property oldContract (object)
    • Deleted property newContract (object)
GET /issuers/{issuerId}/credit-transfers/{endToEndId}
Response:
  • Changed property data (object CreditTransfer)
    • Added property cancellationDate (string)
GET /issuers/{issuerId}/direct-debits/{endToEndId}
Response:
  • Changed property data (object DirectDebit)
    • Added property cancellationDate (string)
GET /issuers/{issuerId}/accounts/external-accounts/{issuerAccountExternalReference}
Response:
  • Changed property data (object Account)
    • Added property companyEntityExternalReference (string)
    • Deleted property companyAccountExternalReference (string)
GET /issuers/{issuerId}/accounts/external-accounts/{issuerAccountExternalReference}/authorizations/{authorizationId}
Response:
  • Changed property data (object GetAuthorizationResponse)
    • Changed property velocityLimitChecks (array)
      • Changed items (object VelocityLimitCheck)
        • Deleted property name (string)
GET /issuers/{issuerId}/accounts/external-accounts/{issuerAccountExternalReference}/credit-transfers
Response:
  • Changed property data (array)
    • Changed items (object CreditTransfer)
      • Added property cancellationDate (string)
GET /issuers/{issuerId}/accounts/external-accounts/{issuerAccountExternalReference}/direct-debits
Response:
  • Changed property data (array)
    • Changed items (object DirectDebit)
      • Added property cancellationDate (string)
GET /issuers/{issuerId}/accounts/{accountReference}
Response:
  • Changed property data (object Account)
    • Added property companyEntityExternalReference (string)
    • Deleted property companyAccountExternalReference (string)
GET /issuers/{issuerId}/accounts/{accountReference}/authorizations/{authorizationId}
Response:
  • Changed property data (object GetAuthorizationResponse)
    • Changed property velocityLimitChecks (array)
      • Changed items (object VelocityLimitCheck)
        • Deleted property name (string)
GET /issuers/{issuerId}/accounts/{accountReference}/credit-transfers
Response:
  • Changed property data (array)
    • Changed items (object CreditTransfer)
      • Added property cancellationDate (string)
GET /issuers/{issuerId}/accounts/{accountReference}/direct-debits
Response:
  • Changed property data (array)
    • Changed items (object DirectDebit)
      • Added property cancellationDate (string)
GET /issuers/{issuerId}/card-contracts/external-card-contracts/{issuerCardContractExternalReference}
Response:
  • Changed property data (object CardContract)
    • Changed property cards (array)
      • Changed items (object Card)
        • Added property logoReference (string)
        • Added property dispatchCode (string)
        • Added property automaticDeactivationDate (string)
        • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/card-contracts/external-card-contracts/{issuerCardContractExternalReference}/cards
Response:
  • Changed property data (array)
    • Changed items (object Card)
      • Added property logoReference (string)
      • Added property dispatchCode (string)
      • Added property automaticDeactivationDate (string)
      • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/card-contracts/{cardContractReference}
Response:
  • Changed property data (object CardContract)
    • Changed property cards (array)
      • Changed items (object Card)
        • Added property logoReference (string)
        • Added property dispatchCode (string)
        • Added property automaticDeactivationDate (string)
        • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/card-contracts/{cardContractReference}/cards
Response:
  • Changed property data (array)
    • Changed items (object Card)
      • Added property logoReference (string)
      • Added property dispatchCode (string)
      • Added property automaticDeactivationDate (string)
      • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/card-contract
Response:
  • Changed property data (object CardContract)
    • Changed property cards (array)
      • Changed items (object Card)
        • Added property logoReference (string)
        • Added property dispatchCode (string)
        • Added property automaticDeactivationDate (string)
        • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/orders
Response:
  • Changed property data (array)
    • Changed items (object Order)
      • Changed property card (object Card)
        • Added property logoReference (string)
        • Added property dispatchCode (string)
        • Added property automaticDeactivationDate (string)
        • Deleted property replacementForAutomaticDeactivationDate (string)
        • Changed property cardContract (object CardContract)
          • Changed property cards (array)
            • Changed items (object Card)
              • Added property logoReference (string)
              • Added property dispatchCode (string)
              • Added property automaticDeactivationDate (string)
              • Deleted property replacementForAutomaticDeactivationDate (string)
POST /issuers/{issuerId}/cards/search
Response:
  • Changed property data (array)
    • Changed items (object Card)
      • Added property logoReference (string)
      • Added property dispatchCode (string)
      • Added property automaticDeactivationDate (string)
      • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/cards/{cardReference}/card-contract
Response:
  • Changed property data (object CardContract)
    • Changed property cards (array)
      • Changed items (object Card)
        • Added property logoReference (string)
        • Added property dispatchCode (string)
        • Added property automaticDeactivationDate (string)
        • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/cards/{cardReference}/orders
Response:
  • Changed property data (array)
    • Changed items (object Order)
      • Changed property card (object Card)
        • Added property logoReference (string)
        • Added property dispatchCode (string)
        • Added property automaticDeactivationDate (string)
        • Deleted property replacementForAutomaticDeactivationDate (string)
        • Changed property cardContract (object CardContract)
          • Changed property cards (array)
            • Changed items (object Card)
              • Added property logoReference (string)
              • Added property dispatchCode (string)
              • Added property automaticDeactivationDate (string)
              • Deleted property replacementForAutomaticDeactivationDate (string)
POST /issuers/{issuerId}/cards/update-all-blocking-information
Response:
  • Changed property data (array)
    • Changed items (object Card)
      • Added property logoReference (string)
      • Added property dispatchCode (string)
      • Added property automaticDeactivationDate (string)
      • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/accounts/external-accounts/{issuerAccountExternalReference}/authorizations
Response:
  • Changed property data (array)
    • Changed items (object Authorization)
      • Changed property velocityLimitChecks (array)
        • Changed items (object VelocityLimitCheck)
          • Deleted property name (string)
GET /issuers/{issuerId}/accounts/external-accounts/{issuerAccountExternalReference}/contract
Response:
  • Changed property data (object Contract)
    • Added property contractClosedByProductChange (object)
    • Added property contractCreatedFromProductChange (object)
    • Deleted property productChangeInformation (object)
    • Changed property accounts (array)
      • Changed items (object Account)
        • Added property companyEntityExternalReference (string)
        • Deleted property companyAccountExternalReference (string)
    • Changed property cardContracts (array)
      • Changed items (object CardContract)
        • Changed property cards (array)
          • Changed items (object Card)
            • Added property logoReference (string)
            • Added property dispatchCode (string)
            • Added property automaticDeactivationDate (string)
            • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/accounts/{accountReference}/authorizations
Response:
  • Changed property data (array)
    • Changed items (object Authorization)
      • Changed property velocityLimitChecks (array)
        • Changed items (object VelocityLimitCheck)
          • Deleted property name (string)
GET /issuers/{issuerId}/accounts/{accountReference}/contract
Response:
  • Changed property data (object Contract)
    • Added property contractClosedByProductChange (object)
    • Added property contractCreatedFromProductChange (object)
    • Deleted property productChangeInformation (object)
    • Changed property accounts (array)
      • Changed items (object Account)
        • Added property companyEntityExternalReference (string)
        • Deleted property companyAccountExternalReference (string)
    • Changed property cardContracts (array)
      • Changed items (object CardContract)
        • Changed property cards (array)
          • Changed items (object Card)
            • Added property logoReference (string)
            • Added property dispatchCode (string)
            • Added property automaticDeactivationDate (string)
            • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/card-contracts/external-card-contracts/{issuerCardContractExternalReference}/contract
Response:
  • Changed property data (object Contract)
    • Added property contractClosedByProductChange (object)
    • Added property contractCreatedFromProductChange (object)
    • Deleted property productChangeInformation (object)
    • Changed property accounts (array)
      • Changed items (object Account)
        • Added property companyEntityExternalReference (string)
        • Deleted property companyAccountExternalReference (string)
    • Changed property cardContracts (array)
      • Changed items (object CardContract)
        • Changed property cards (array)
          • Changed items (object Card)
            • Added property logoReference (string)
            • Added property dispatchCode (string)
            • Added property automaticDeactivationDate (string)
            • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/card-contracts/{cardContractReference}/contract
Response:
  • Changed property data (object Contract)
    • Added property contractClosedByProductChange (object)
    • Added property contractCreatedFromProductChange (object)
    • Deleted property productChangeInformation (object)
    • Changed property accounts (array)
      • Changed items (object Account)
        • Added property companyEntityExternalReference (string)
        • Deleted property companyAccountExternalReference (string)
    • Changed property cardContracts (array)
      • Changed items (object CardContract)
        • Changed property cards (array)
          • Changed items (object Card)
            • Added property logoReference (string)
            • Added property dispatchCode (string)
            • Added property automaticDeactivationDate (string)
            • Deleted property replacementForAutomaticDeactivationDate (string)
POST /issuers/{issuerId}/contracts/{contractReference}/sign
Response:
  • Changed property data (object SignContractResponse)
    • Changed property contract (object SignContractResponse.Contract)
      • New optional properties:

        • contractOwnerIdentifier
        • creationDate
        • productIdentifier
      • Deleted property creationDate (string)

      • Deleted property signatureDate (string)

      • Deleted property issuerBranchCode (string)

      • Deleted property cardReleaseOrder (string)

      • Deleted property productIdentifier (object)

      • Deleted property contractOwnerIdentifier (object)

      • Changed property accounts (array)

        • Changed items (object SignContractResponse.Account)
          • New optional properties:

            • accountGuarantorIdentifier
            • accountOwnerIdentifier
          • Deleted property accountOwnerIdentifier (object)

          • Deleted property accountGuarantorIdentifier (object)

      • Changed property cardContracts (array)

        • Changed items (object SignContractResponse.CardContract)
          • New required properties:

            • cardContractIdentifier
            • cards
            • status
          • New optional properties:

            • principalSupplementaryCardIndicator
            • relatedAccounts
          • Added property cards (array)

          • Deleted property cardHolderIdentifier (object)

          • Deleted property principalSupplementaryCardIndicator (string)

          • Deleted property card (object)

          • Deleted property relatedAccounts (array)

          • Deleted property externalCobadgedCardNumber (string)

          • Deleted property externalCobadgedSequenceNumber (string)

          • Deleted property externalCobadgedExpiryDate (string)

POST /issuers/{issuerId}/contracts/external-contracts/{issuerContractExternalReference}/sign
Response:
  • Changed property data (object SignContractResponse)
    • Changed property contract (object SignContractResponse.Contract)
      • New optional properties:

        • contractOwnerIdentifier
        • creationDate
        • productIdentifier
      • Deleted property creationDate (string)

      • Deleted property signatureDate (string)

      • Deleted property issuerBranchCode (string)

      • Deleted property cardReleaseOrder (string)

      • Deleted property productIdentifier (object)

      • Deleted property contractOwnerIdentifier (object)

      • Changed property accounts (array)

        • Changed items (object SignContractResponse.Account)
          • New optional properties:

            • accountGuarantorIdentifier
            • accountOwnerIdentifier
          • Deleted property accountOwnerIdentifier (object)

          • Deleted property accountGuarantorIdentifier (object)

      • Changed property cardContracts (array)

        • Changed items (object SignContractResponse.CardContract)
          • New required properties:

            • cardContractIdentifier
            • cards
            • status
          • New optional properties:

            • principalSupplementaryCardIndicator
            • relatedAccounts
          • Added property cards (array)

          • Deleted property cardHolderIdentifier (object)

          • Deleted property principalSupplementaryCardIndicator (string)

          • Deleted property card (object)

          • Deleted property relatedAccounts (array)

          • Deleted property externalCobadgedCardNumber (string)

          • Deleted property externalCobadgedSequenceNumber (string)

          • Deleted property externalCobadgedExpiryDate (string)

GET /issuers/{issuerId}/contracts/external-contracts/{issuerContractExternalReference}
Response:
  • Changed property data (object Contract)
    • Added property contractClosedByProductChange (object)
    • Added property contractCreatedFromProductChange (object)
    • Deleted property productChangeInformation (object)
    • Changed property accounts (array)
      • Changed items (object Account)
        • Added property companyEntityExternalReference (string)
        • Deleted property companyAccountExternalReference (string)
    • Changed property cardContracts (array)
      • Changed items (object CardContract)
        • Changed property cards (array)
          • Changed items (object Card)
            • Added property logoReference (string)
            • Added property dispatchCode (string)
            • Added property automaticDeactivationDate (string)
            • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/contracts/external-contracts/{issuerContractExternalReference}/accounts
Response:
  • Changed property data (array)
    • Changed items (object Account)
      • Added property companyEntityExternalReference (string)
      • Deleted property companyAccountExternalReference (string)
GET /issuers/{issuerId}/contracts/external-contracts/{issuerContractExternalReference}/card-contracts
Response:
  • Changed property data (array)
    • Changed items (object CardContract)
      • Changed property cards (array)
        • Changed items (object Card)
          • Added property logoReference (string)
          • Added property dispatchCode (string)
          • Added property automaticDeactivationDate (string)
          • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/contracts/{contractReference}
Response:
  • Changed property data (object Contract)
    • Added property contractClosedByProductChange (object)
    • Added property contractCreatedFromProductChange (object)
    • Deleted property productChangeInformation (object)
    • Changed property accounts (array)
      • Changed items (object Account)
        • Added property companyEntityExternalReference (string)
        • Deleted property companyAccountExternalReference (string)
    • Changed property cardContracts (array)
      • Changed items (object CardContract)
        • Changed property cards (array)
          • Changed items (object Card)
            • Added property logoReference (string)
            • Added property dispatchCode (string)
            • Added property automaticDeactivationDate (string)
            • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/contracts/{contractReference}/accounts
Response:
  • Changed property data (array)
    • Changed items (object Account)
      • Added property companyEntityExternalReference (string)
      • Deleted property companyAccountExternalReference (string)
GET /issuers/{issuerId}/contracts/{contractReference}/card-contracts
Response:
  • Changed property data (array)
    • Changed items (object CardContract)
      • Changed property cards (array)
        • Changed items (object Card)
          • Added property logoReference (string)
          • Added property dispatchCode (string)
          • Added property automaticDeactivationDate (string)
          • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/customers/external-customers/{issuerCustomerExternalReference}/accounts
Response:
  • Changed property data (array)
    • Changed items (object Account)
      • Added property companyEntityExternalReference (string)
      • Deleted property companyAccountExternalReference (string)
GET /issuers/{issuerId}/customers/external-customers/{issuerCustomerExternalReference}/card-contracts
Response:
  • Changed property data (array)
    • Changed items (object CardContract)
      • Changed property cards (array)
        • Changed items (object Card)
          • Added property logoReference (string)
          • Added property dispatchCode (string)
          • Added property automaticDeactivationDate (string)
          • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/customers/{customerReference}/accounts
Response:
  • Changed property data (array)
    • Changed items (object Account)
      • Added property companyEntityExternalReference (string)
      • Deleted property companyAccountExternalReference (string)
GET /issuers/{issuerId}/customers/{customerReference}/card-contracts
Response:
  • Changed property data (array)
    • Changed items (object CardContract)
      • Changed property cards (array)
        • Changed items (object Card)
          • Added property logoReference (string)
          • Added property dispatchCode (string)
          • Added property automaticDeactivationDate (string)
          • Deleted property replacementForAutomaticDeactivationDate (string)
POST /issuers/{issuerId}/contracts/search
Response:
  • Changed property data (array)
    • Changed items (object Contract)
      • Added property contractClosedByProductChange (object)
      • Added property contractCreatedFromProductChange (object)
      • Deleted property productChangeInformation (object)
      • Changed property accounts (array)
        • Changed items (object Account)
          • Added property companyEntityExternalReference (string)
          • Deleted property companyAccountExternalReference (string)
      • Changed property cardContracts (array)
        • Changed items (object CardContract)
          • Changed property cards (array)
            • Changed items (object Card)
              • Added property logoReference (string)
              • Added property dispatchCode (string)
              • Added property automaticDeactivationDate (string)
              • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/customers/external-customers/{issuerCustomerExternalReference}/contracts
Response:
  • Changed property data (array)
    • Changed items (object Contract)
      • Added property contractClosedByProductChange (object)
      • Added property contractCreatedFromProductChange (object)
      • Deleted property productChangeInformation (object)
      • Changed property accounts (array)
        • Changed items (object Account)
          • Added property companyEntityExternalReference (string)
          • Deleted property companyAccountExternalReference (string)
      • Changed property cardContracts (array)
        • Changed items (object CardContract)
          • Changed property cards (array)
            • Changed items (object Card)
              • Added property logoReference (string)
              • Added property dispatchCode (string)
              • Added property automaticDeactivationDate (string)
              • Deleted property replacementForAutomaticDeactivationDate (string)
GET /issuers/{issuerId}/customers/{customerReference}/contracts
Response:
  • Changed property data (array)
    • Changed items (object Contract)
      • Added property contractClosedByProductChange (object)
      • Added property contractCreatedFromProductChange (object)
      • Deleted property productChangeInformation (object)
      • Changed property accounts (array)
        • Changed items (object Account)
          • Added property companyEntityExternalReference (string)
          • Deleted property companyAccountExternalReference (string)
      • Changed property cardContracts (array)
        • Changed items (object CardContract)
          • Changed property cards (array)
            • Changed items (object Card)
              • Added property logoReference (string)
              • Added property dispatchCode (string)
              • Added property automaticDeactivationDate (string)
              • Deleted property replacementForAutomaticDeactivationDate (string)
POST /issuers/{issuerId}/contracts/create-consumer-contract
Request body:
  • Changed property addCardsAccounts (object CreateConsumerContractRequest.AddCardsAccounts)
    • Changed property cardContracts (array)
      • Changed items (object CreateConsumerContractRequest.CardContract)
        • Added property techAndAppModelReference (string)
  • Changed property contract (object CreateConsumerContractRequest.Contract)
    • Changed property cardContracts (array)
      • Changed items (object CreateConsumerContractRequest.CardContract)
        • Added property techAndAppModelReference (string)
Response:
  • Changed property data (object CreateConsumerContractResponse)
    • Changed property contract (object CreateConsumerContractResponse.Contract)
      • Changed property cardContracts (array)
        • Changed items (object CreateConsumerContractResponse.CardContract)
          • Added property originalCardContractIdentifier (object)
          • Added property changedCardContractIdentifier (object)
POST /issuers/{issuerId}/contracts/external-contracts/{issuerContractExternalReference}/add-cards-accounts
Request body:
  • Changed property cardContracts (array)
    • Changed items (object CreateConsumerContractRequest.CardContract)
      • Added property techAndAppModelReference (string)
Response:
  • Changed property data (object AddCardsAccountsResponse)
    • Changed property contract (object CreateConsumerContractResponse.Contract)
      • Changed property cardContracts (array)
        • Changed items (object CreateConsumerContractResponse.CardContract)
          • Added property originalCardContractIdentifier (object)
          • Added property changedCardContractIdentifier (object)
POST /issuers/{issuerId}/contracts/{contractReference}/add-cards-accounts
Request body:
  • Changed property cardContracts (array)
    • Changed items (object CreateConsumerContractRequest.CardContract)
      • Added property techAndAppModelReference (string)
Response:
  • Changed property data (object AddCardsAccountsResponse)
    • Changed property contract (object CreateConsumerContractResponse.Contract)
      • Changed property cardContracts (array)
        • Changed items (object CreateConsumerContractResponse.CardContract)
          • Added property originalCardContractIdentifier (object)
          • Added property changedCardContractIdentifier (object)


  

 

Enable "on this page" menu on doc section
On

ob-p-a2a-s1

Payment with Redirect Authorisation

Step – 1 : Get the reach details :

Reach details provides list of APIs needs to be used for this scenario and mandatory fields needs to be passed for successful API call towards ASPSP mock.

Call the reach API – GET /aspsp. Get the ASPSP details with Name = Payment Redirect and the ASPSP ID = “20100”, which has to be used to initiate the payment with redirect mode of authorisation and other further payment related requests.

Remark : Details of reach information provided in developer portal are limited and informational purpose to give initiating party (user) an idea about how reach information looks like. Initiating party (user) can skip this step and use specified ASPSP ID for the scenario to try out.

 

Step – 2 : Initiate the payment :

Call the POST /payments API with mandatory fields in request header and body. In response of POST /payments, initiating party (user) will receive payment ID, ASPSP redirect link to authorise the initiated payment and link to call GET /payments/status API to get the status of the initiated payment.

If GET /payments/status endpoint has been called before user provides his / her approval, initiating party (user) will receive payment status = “Open” from the ASPSP Mock in response.

 

Step – 3 : Authorise or Cancel the payment at ASPSP Mock :

With ASPSP redirect link received in response of POST /payments, customer (PSU) will get redirect to ASPSP Mock GUI login page. On this login page, customer (user) can provide dummy credential details as this is example purpose only. Once customer (PSU) provides his / her dummy credentials, he / she will be redirected to ASPSP Mock GUI page with “Approve” & “Deny” buttons to authorise or cancel the payment.

If customer (PSU) “Approve” the payment, payment will get initiated with the ASPSP Mock and customer (PSU) will redirect back to initiating party (user).

If customer (PSU) “Deny” the payment, ASPSP Mock will reject the initiated payment and customer (PSU) will redirect back to initiating party (user).

Remark : GUI page of ASPSP Mock to approve or deny the payment is just a demo purpose. Actual ASPSP GUI page to approve or deny the payment may vary based on ASPSP.

 

Step – 4 : Get the payment status :

Call the GET /payments/status API to get the latest payment status from ASPSP Mock.

If payment is authorised by customer (PSU), initiating party (user) will receive payment status = “Settlement Completed” as final payment status.

If payment is deny by customer (PSU), initiating party (user) will receive payment status = “Cancelled” as final payment status.

Remark : Payment status provided for this scenario is just to guide initiating party (user) for payment initiation process. Actual payment status may vary based on scenario from actual ASPSP.

 

Sequence Diagram :

Payment with Redirect Authorisation

 

Enable "on this page" menu on doc section
On