OpenFinance
Development Portal

openFinance API Framework XS2A API as PSD2 Interface Implementation Guidelines - Account Information Service (2.3)

The Berlin Group - A European Standards Initiative | info@: info@berlin-group.org | URL: https://www.berlin-group.org/

License: Creative Commons Attribution 4.0 International Public License

This specification foresees different types of account information services: * Transaction lists for a given account with transactions with booking status booked or pending including balances if applicable, * List of standing orders of a given account, reported as transactions with booking status information, * Balances of a given account, * A list of addressable accounts, * Account details of a given account or of the list of all accessible accounts relative to a granted consent, and * Account details might include the account owner name, where specific requirements on the consent process might apply, see below. Hereby the definition of the list of addressable and accessible accounts is as follows: Definition: The list of addressable accounts of an ASPSP related to a PSU is the list of accounts of a PSU which are open for access through the XS2A API according to the definition of payment accounts provided by [PSD2]. Definition: The list of accessible accounts of an ASPSP related to a PSU's consent is the list of accounts, where the consent of the PSU has been granted to at least one of the defined account information types. Note: The Read Data Request for the list of addressable accounts and for account details of a given account is syntactically identical. The difference is only in the underlying consent resource, referred to through the HTTP header parameter "Consent-ID". Example: An ASPSP is providing IBAN1 and IBAN2 to a PSU. The PSU has granted the TPP the consent to access transactions and balances of IBAN1 only. In this case, the addressable accounts are IBAN1 and IBAN2, the list of accessible accounts consists only of IBAN1.

List transactions

GET /v2/card-accounts/{account-id}/transactions

Reads account data from a given card reconciliation account addressed by "account-id". See "XS2A API as PSD2 Interface Implementation Guidelines ", section "Read Card Account Transaction List".

Parameter Type Description
account-id string , required

This identification is denoting the addressed (card) account. The account-id is retrieved by using a "Read Account List" or "Read Card Account list" call. The account-id is the "resourceId" attribute of the account structure. Its value is constant at least throughout the lifecycle of a given consent.

Example: Text, maximum of 70 characters.

Allowed length: max: 70

Parameter Type Description
dateFrom string , optional

Conditional: Starting date (inclusive the date dateFrom) of the transaction list, mandated if no delta access is required and if bookingStatus does not equal "information". For booked transactions, the relevant date is the booking date. For pending transactions, the relevant date is the entry date, which may not be transparent neither in this API nor other channels of the ASPSP.

Example: 2020-01-01

Format: date

dateTo string , optional

End date (inclusive the data dateTo) of the transaction list, default is "now" if not given. Might be ignored if a delta function is used. For booked transactions, the relevant date is the booking date. For pending transactions, the relevant date is the entry date, which may not be transparent neither in this API nor other channels of the ASPSP.

Example: 2020-01-01

Format: date

bookingStatus string , required

Permitted codes are * "booked", * "pending", * "both", "booked" shall be supported by the ASPSP. To support the "pending" and "both" feature is optional for the ASPSP, Error code if not supported in the online banking frontend. If supported, "both" means to request transaction reports of transaction of bookingStatus either "pending" or "booked".

Allowed values: booked, pending, both

Example: booked

deltaList boolean , optional

This data attribute is indicating that the AISP is in favour to get all transactions after the last report access for this PSU on the addressed account. This is another implementation of a delta access-report. This delta indicator might be rejected by the ASPSP if this function is not supported. Optional if supported by API provider

Example: true

cardBrand string , optional

This attribute filters transactions according to their corresponding card brand. Only to be supported in a scenario, where this is used as statements e.g. of card acquirers towards merchants..

Example: Text, maximum of 35 characters.

Allowed length: max: 35

Header Type Description
Digest string , optional

Integrity hash of the request body in the form SHA-256=<base64>. For an empty body, use the hash of an empty string. See Signing requests for how the Digest and signature are built.

Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A=

x-jws-signature string , optional

Detached JSON Web Signature over the signed request headers and body. See Signing requests for how it is constructed.

X-Request-ID string , required

Unique ID of the request, set by the initiating party and echoed back in the response.

Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721

Format: uuid

PSU-IP-Address string , optional

IP address of the PSU's device as forwarded by the TPP. If unavailable, use the IP address the TPP used for this request.

Example: 192.168.8.78

Format: ipv4

Consent-ID string , required

Identifier of the consent that authorises this access, as returned when the consent was created.

Example: 123cons456

Allowed length: max: 70

Select a status code to see the structure and an example of the response.

Field Type Description
balances array[object] , optional

A list of balances regarding this account, which might be restricted to the current balance.

cardAccount object , required

Identifier of the addressed card account.

debitAccounting boolean , optional

If true, the amounts of debits on the reports are quoted positive with the related consequence for balances. If false, the amount of debits on the reports are quoted negative.

cardTransactions object , optional

JSON based account report.

_links object , optional

A list of hyperlinks to be recognised by the TPP.Type of links admitted in this response: "download": a link to a resource, where the transaction list might be downloaded from in case where transaction lists have a huge size.