OpenFinance
Development Portal

openFinance API Framework XS2A API as PSD2 Interface Implementation Guidelines - Payment Initiation Service (2.3)

The Berlin Group - A European Standards Initiative | info@: info@berlin-group.org | URL: https://www.berlin-group.org/

License: Creative Commons Attribution 4.0 International Public License

The payment initiation flow depends heavily on the SCA approach implemented by the ASPSP. The most complex flow is the flow for the Embedded SCA Approach, which further differs on whether there are various authentication methods available for the PSU. In the following, the different API flows are provided as an overview for these different scenarios. Remark: The flows do not always cover all variances or complexities of the implementation and are exemplary flows.

Create bulk payment

POST /v2/bulk-payments/{payment-product}

Creates a payment initiation request at the ASPSP. See "XS2A API as PSD2 Interface Implementation Guidelines ", sections "Bulk Payment Initiation with JSON encoding of the Payment Instruction" and "Bulk Payment Initiation with XML message as Payment Instruction".

Parameter Type Description
payment-product string , required

The addressed payment product endpoint, e.g. for SEPA Credit Transfers (SCT). The ASPSP will publish which of the payment products/endpoints will be supported. The following payment products are supported: - For request bodies with JSON encoding: -- sepa-credit-transfers -- instant-sepa-credit-transfers -- target-2-payments -- cross-border-credit-transfers - For request bodies with XML encoding (ISO20022 pain.001): -- pain.001-sepa-credit-transfers -- pain.001-instant-sepa-credit-transfers -- pain.001-proprietary-credit-transfers The ASPSP will publish which of the payment products/endpoints will be supported. For definitions of basic non euro generic products see [oFA PFDom]. Further products might be published by the ASPSP within its XS2A documentation. These new product types will end in further endpoints of the XS2A Interface.

Allowed values: sepa-credit-transfers, instant-sepa-credit-transfers, target-2-payments, cross-border-credit-transfers, pain.001-sepa-credit-transfers, pain.001-instant-sepa-credit-transfers, pain.001-proprietary-credit-transfers

Example: sepa-credit-transfers

Header Type Description
PSU-IP-Port string , optional

The forwarded IP Port header field consists of the corresponding HTTP request IP Port field between PSU and TPP, if available.

Example: 1234

PSU-Accept string , optional

The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.

Example: application/json

PSU-Accept-Charset string , optional

The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.

Example: *

PSU-Accept-Encoding string , optional

The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.

Example: *

PSU-Accept-Language string , optional

The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.

Example: en-gb,en;0.8

PSU-User-Agent string , optional

The forwarded Agent header field of the HTTP request between PSU and TPP, if available.

Example: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0

PSU-Http-Method string , optional

HTTP method used at the PSU ? TPP interface, if available. Valid values are: * GET * POST * PUT * PATCH * DELETE

Allowed values: GET, POST, PUT, PATCH, DELETE

Example: GET

PSU-Device-ID string , optional

UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of an installation identification this ID needs to be unaltered until removal from device.

Example: 99435c7e-ad88-49ec-a2ad-99ddcb1f5555

Format: uuid

PSU-Geo-Location string , optional

The forwarded Geo Location of the corresponding http request between PSU and TPP if available.

Example: GEO:52.506931;13.144558

Pattern: ^GEO:-?[0-9]{1,2}\.[0-9]{6};-?[0-9]{1,3}\.[0-9]{6}$

PSU-ID string , optional

Client ID of the PSU in the ASPSP client interface. Might be mandated in the ASPSP's documentation. It might be contained even if an OAuth2 based authentication was performed in a pre-step or an OAuth2 based SCA was performed in an preceding AIS service in the same session. In this case the ASPSP might check whether PSU-ID and token match, according to ASPSP documentation.

Example: PSU-1234

Allowed length: max: 140

PSU-ID-Type string , optional

Type of the PSU-ID, needed in scenarios where PSUs have several PSU-IDs as access possibility. In this case, the mean and use are then defined in the ASPSP's documentation.

Example: PSU-ID-TYPE_C

Allowed length: max: 35

PSU-Corporate-ID string , optional

Might be mandated in the ASPSP's documentation. Only used in a corporate context.

Example: PSU-CORP-ID1234

Allowed length: max: 140

PSU-Corporate-ID-Type string , optional

Might be mandated in the ASPSP's documentation. Only used in a corporate context.

Example: PSU-CORP-ID-TYPE_A

Allowed length: max: 35

Client-SCA-Approach-Preference string , optional

A comma separated list of attributes, where the first entry will have a higher priority than the next or to every SCA Approach which is not indicated at all, e.g. "decoupled, redirect, embedded, signature" or "decoupled" This attribute may be ignored by the ASPSP

Example: decoupled, redirect, embedded

Allowed length: max: 35

Client-Redirect-URI string , optional

URI the transaction flow returns to after a redirect. Required for the redirect SCA approach.

Example: https://exampleclient.com/redirectUri?clientEvent=11111111

Format: uri

Client-Nok-Redirect-URI string , optional

If this URI is contained, the TPP is asking to redirect the transaction flow to this address instead of the Client-Redirect-URI in case of a negative result of the redirect SCA method. This might be ignored by the ASPSP.

Example: https://exampleclient.com/NokUri?clientEvent=11111111

Format: uri

Client-Explicit-Authorisation-Preferred boolean , optional

If it equals "true", the API Client prefers to start the authorisation process separately, e.g. because of the usage of a signing basket or because of asynchronous authorisation. This preference might be ignored by the ASPSP, if a signing basket is not supported as functionality or if asynchronous authorisation is not supported. If it equals "false" or if the parameter is not used, there is no preference of the API Client. This especially indicates that the API Client assumes a direct authorisation of the transaction in the next step, without using a signing basket.

Example: true

Client-Notification-URI string , optional

URI for the Endpoint of the Client API to which the status of the resource should be sent. This header field may by ignored by the ASPSP if the resource status push function is not supported for the related API client.

Example: https://exampleclient.com/NotificationUri?clientEvent=11111111

Client-Notification-Content-Preferred string , optional

The string has the form status=X1, ..., Xn where Xi is one of the constants SCA, PROCESS, LAST and where constants are not repeated. The usage of the constants supports the of following semantics: SCA: A notification on every change of the scaStatus attribute for all related authorisation processes is preferred by the API Client. PROCESS: A notification on all changes of consentStatus or transactionStatus attributes is preferred by the API Client. LAST: Only a notification on the last consentStatus or transactionStatus as available in the XS2A interface is preferred by the API Client. This header field may be ignored, if the ASPSP does not support resource notification services for the related API Client.

Example: status=SCA

Client-VOP-Requested boolean , optional

true: The client requests the ASPSP to perform a VOP check, where applicable. false: The API Client requests the ASPSP not to perform a VOP check. Reasons for this are e.g. that the API client has already performed the VOP check in a TPP scenario or is requiring an opt out in a direct access scenario. The related VOP check could have been performed up front via the dedicated VOP API, if provided by the ASPSP. not used: The API Client does not request to perform a VOP request. An ASPSP may ignore this header

Client-VOP-Request-ID string , optional

This attribute contains the X-Request-ID of the related request on the dedicated VOP API. This attribute might be ignored by the ASPSP. If the ASPSP offers the dedicated VOP API, it might mandate the usage of this attribute via the ASPSP documentation and then make the usage of this attribute mandatory, if applicable to the related payment product and if VOP has not been opted out.

Example: 99435c7e-ad88-49ec-a2ad-99ddcb1f5555

Format: uuid

Client-Brand-Logging-Information string , optional

This header might be used by API Clients to inform the ASPSP about the brand used by the API Client towards the PSU. This information is meant for logging entries to enhance communication between ASPSP and PSU or ASPSP and API Client. This header might be ignored by the ASPSP.

Example: ClientBrandB

Allowed length: max: 140

Digest string , optional

Integrity hash of the request body in the form SHA-256=<base64>. For an empty body, use the hash of an empty string. See Signing requests for how the Digest and signature are built.

Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A=

x-jws-signature string , optional

Detached JSON Web Signature over the signed request headers and body. See Signing requests for how it is constructed.

X-Request-ID string , required

Unique ID of the request, set by the initiating party and echoed back in the response.

Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721

Format: uuid

Body-Sig-Profile string , optional

Indicates the signature profile used for signing (parts of) the body. Shall be used if the body is signed.

Allowed values: JAdES_JS, XAdES, EMV_AC, EUDIW

Example: XAdES

Body-Enc-Profile string , optional

Indicates the encryption profile used for the encryption of (parts of) the body.

Allowed values: JWE_CS, XML_ENC

Example: JWE_CS

Body-Enc-List string , optional

Contains a List of names of data elements/ attributes of the body which contain encrypted information

Example: BODY

Content-Type string , required

Example: application/json

Consent-ID string , optional

Identifier of the consent that authorises this access, as returned when the consent was created.

Example: 123cons456

Allowed length: max: 70

PSU-IP-Address string , required

IP address of the PSU's device as forwarded by the TPP. If unavailable, use the IP address the TPP used for this request.

Example: 192.168.8.78

Format: ipv4

TPP-Rejection-NoFunds-Preferred boolean , optional

If it equals "true" then the TPP prefers a rejection of the payment initiation in case the ASPSP is providing an integrated confirmation of funds request an the result of this is that not sufficient funds are available. If it equals "false" then the TPP prefers that the ASPSP is dealing with the payment initiation like in the ASPSPs online channel, potentially waiting for a certain time period for funds to arrive to initiate the payment. This parameter might be ignored by the ASPSP.

Example: true

Field Type Description
controlSum string , required

Total of all individual amounts included in the group, irrespective of currencies.

batchBooking boolean , optional

If this element equals true, the PSU pre-fers only one booking entry. If this element equals false, the PSU prefers individual booking of all contained individual transactions. The ASPSP will follow this preference according to contracts agreed on with the PSU.

debtorAccount object , required

Unambiguous identification of the account of the debtor to which a debit entry will be made as a result of the transaction.

paymentMethod string , optional

Specifies the means of payment that will be used to move the amount of money. Usage: Only used for cross-border transactions. If no paymentMethod is explicitly indicated, paymentMethod will be interpreted as "TRF" (Credit Transfer).

Allowed values: TRF, CHK

creditTransfers array[object] , required

The Credit Transfer Bulk Entry is a type which follows the JSON formats for the supported products for single payments, excluding the data elements * debtorAccount, * debtor * debtorAgent * requestedExecutionDate, * requestedExecutionDateTime. These data elements may not be contained in any bulk entry. In addition, the following entries will be allowed for every single entry, if not used already on bulk level: * chargeBearer * chargesAccount * categoryPurposeCode * categoryPurposeProprietary * serviceLevelCode * localnstrumentCode * localInstrumentProprietary * ultimateDebtor In addition, the attributes * purposeCode * remittanceInformationStructured are always available on entry level if sup-ported by the related payment product.

numberOfTransactions integer , required

Number of individual transactions con-tained in the related bulk.

paymentInformationId string , required

Unique identification as assigned by the sending party to unambiguously identify this bulk payment. This attribute may be used by ASPSPs or communities as an optional field.

Select a status code to see the structure and an example of the response.

Field Type Description
paymentId string , required

resource identification of the generated payment initiation resource.

psuMessage string , optional

Text to be displayed to the PSU.

scaMethods array[object] , optional

This data element might be contained, if SCA is required and if the PSU has a choice between different authentication methods. Depending on the risk management of the ASPSP this choice might be offered before or after the PSU has been identified with the first relevant factor, or if an access token is transported. If this data element is contained, then there is also a hyperlink of type "startAuthorisationWithAuthenticationMethodSelection" contained in the response body. These methods shall be presented towards the PSU for selection by the TPP.

challengeData object , optional

It is contained in addition to the data element "chosenScaMethod" if challenge data is needed for SCA. In rare cases this attribute is also used in the context of the "startAuthorisationWithPsuAuthentication" or "startAuthorisactionWithEncryptedPsuAuthentication" link.

chosenScaMethod object , optional

This data element is only contained in the response if the ASPSP has chosen the Embedded SCA Approach, if the PSU is already identified e.g. with the first relevant factor or alternatively an access token, if SCA is required and if the authentication method is implicitly selected.

transactionFees object , optional

Might be used by the ASPSP to transport the total transaction fees relevant for the underlying payments. This field includes the entry of the "currencyConversionFees" if applicable.

apiClientMessages array[object] , optional

Errors and warnings describing why the request failed. See Errors for the message format.

transactionStatus string , required

Payment transaction status.

Allowed values: ACCC, ACCP, ACSC, ACSP, ACTC, ACWC, ACWP, RCVD, PDNG, RJCT, CANC, ACFC, PATC, PART, PRES, RVCM, RVNC, RCVC

estimatedTotalAmount object , optional

The amount which is estimated to be debted from the debtor account. Note: This amount includes fees.

currencyConversionFee object , optional

Might be used by the ASPSP to transport specific currency conversion fees related to the initiated credit transfer.

transactionFeeIndicator boolean , optional

If equals "true", the transaction will involve specific transaction cost as shown by the ASPSP in their public price list or as agreed between ASPSP and PSU. If equals "false", the transaction will not involve additional specific transaction costs to the PSU unless the fee amount is given specifically in the data elements transactionFees and/or currencyConversionFees. If this data element is not used, there is no information about transaction fees unless the fee amount is given explicitly in the data element transactionFees and/or currencyConversionFees.

estimatedInterbankSettlementAmount object , optional

The estimated amount to be transferred to the payee.

_links object , required

A list of hyperlinks to be recognised by the API Client. The actual hyperlinks used in the response depend on the dynamical decisions of the ASPSP when processing the request. The potential links for this response message are generically defined in [oFA SMPF] for all Transaction Initiation Response messages. These links will also be contained in the related Open API files. Remark: All links can be relative or full links, to be decided by the ASPSP.