OpenFinance
Development Portal

openFinance API Framework XS2A API as PSD2 Interface Implementation Guidelines - Extended Payment Initiation Service (2.1)

The Berlin Group - A European Standards Initiative | info@: info@berlin-group.org | URL: https://www.berlin-group.org/

License: Creative Commons Attribution 4.0 International Public License

The specific function in the Extended Payment Initiation Services is to make the initiation phase more flexible, i.e. * separate authorisation and actual initiation processes as well as * unbundle risk management functionality from the actual payment initiation, but already apply e.g. limit and balance checks during the authorisation and hence * potentially secure the future payment initiation in addition.

Update debtor account

PUT /v2/{resource-path}/{resourceId}

The following method is used to update a payment related resource by an account which is associated to a PSU, and which needs to be received from the ASPSP first in the response of the "Update PSU Data with Authentication Request". Remark: This procedure might be offered by the ASPSP in decoupled or embedded SCA channels to support "noManualIbanEntry" requirements from regulators for payment initiation.

Parameter Type Description
resource-path string , required

This resource path can be a one-level parameter {service} or a two-level parameter {service}/{product-type}, where * {service} stands for the service type of the related business transaction, e.g. /payments or /consents source. * {product-type} stands for the product-type of the related business transaction where applicable, e.g. sepa-credit-transfers in the case of payments or account-access in case of consents.

Example: consents/account-access

resourceId string , required

Resource identification of the related payment initiation, signing basket, consent, subscription or other related business transaction resource.

Example: 1234-resource-567

Allowed length: max: 70

Header Type Description
PSU-IP-Address string , optional

IP address of the PSU's device as forwarded by the TPP. If unavailable, use the IP address the TPP used for this request.

Example: 192.168.8.78

Format: ipv4

PSU-IP-Port string , optional

The forwarded IP Port header field consists of the corresponding HTTP request IP Port field between PSU and TPP, if available.

Example: 1234

PSU-Accept string , optional

The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.

Example: application/json

PSU-Accept-Charset string , optional

The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.

Example: *

PSU-Accept-Encoding string , optional

The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.

Example: *

PSU-Accept-Language string , optional

The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.

Example: en-gb,en;0.8

PSU-User-Agent string , optional

The forwarded Agent header field of the HTTP request between PSU and TPP, if available.

Example: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0

PSU-Http-Method string , optional

HTTP method used at the PSU ? TPP interface, if available. Valid values are: * GET * POST * PUT * PATCH * DELETE

Allowed values: GET, POST, PUT, PATCH, DELETE

Example: GET

PSU-Device-ID string , optional

UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of an installation identification this ID needs to be unaltered until removal from device.

Example: 99435c7e-ad88-49ec-a2ad-99ddcb1f5555

Format: uuid

PSU-Geo-Location string , optional

The forwarded Geo Location of the corresponding http request between PSU and TPP if available.

Example: GEO:52.506931;13.144558

Pattern: GEO:-?[0-9]{1,2}\.[0-9]{6};-?[0-9]{1,3}\.[0-9]{6}

Digest string , optional

Integrity hash of the request body in the form SHA-256=<base64>. For an empty body, use the hash of an empty string. See Signing requests for how the Digest and signature are built.

Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A=

x-jws-signature string , optional

Detached JSON Web Signature over the signed request headers and body. See Signing requests for how it is constructed.

X-Request-ID string , required

Unique ID of the request, set by the initiating party and echoed back in the response.

Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721

Format: uuid

Body-Sig-Profile string , optional

Indicates the signature profile used for signing (parts of) the body. Shall be used if the body is signed.

Allowed values: JAdES_JS, XAdES, EMV_AC, EUDIW

Example: XAdES

Body-Enc-Profile string , optional

Indicates the encryption profile used for the encryption of (parts of) the body.

Allowed values: JWE_CS, XML_ENC

Example: JWE_CS

Body-Enc-List string , optional

Contains a List of names of data elements/ attributes of the body which contain encrypted information

Example: BODY

Field Type Description
debtorAccount object , required

The resourceId of the account as provided in the "Update PSU Data with Authentication Request" response shall be used as the technical account reference.

Select a status code to see the structure and an example of the response.

Field Type Description
psuMessage string , optional

Text to be displayed to the PSU.

scaMethods array[object] , optional

Might be contained, if several authentication methods are available. (name, type)

challengeData object , optional

Challenge data might be contained, if only one authentication method is available, and if the Embedded SCA approach is chosen by the ASPSP.

chosenScaMethod object , optional

A definition of the provided SCA method is contained, if only one authentication method is available, and if the Embedded SCA approach is chosen by the ASPSP.

_links object , optional

A list of hyperlinks to be recognised by the TPP. The actual hyperlinks used in the response depend on the dynamical decisions of the ASPSP when processing the request. Remark: All links can be relative or full links, to be decided by the ASPSP.