Ria Money Transfer

Consent API for V2.x (2.1)

The Berlin Group - A European Standards Initiative | info@: info@berlin-group.org | URL: https://www.berlin-group.org/

License: Creative Commons Attribution 4.0 International Public License

Create, retrieve, and cancel the consents a PSU grants for account information and confirmation of funds. A consent records which data the TPP may access, how long the access lasts, and how often it can be used, and it moves through a defined set of statuses over its lifecycle.

Create funds consent

POST /v2/consents/funds-confirmations

Creates a consent resource at the ASPSP regarding confirmation of funds access to an account specified in this request.

Header Type Description
PSU-User-Agent string , optional

The forwarded Agent header field of the HTTP request between PSU and TPP, if available.

Example: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0

PSU-Device-ID string , optional

UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of an installation identification this ID needs to be unaltered until removal from device.

Example: 99435c7e-ad88-49ec-a2ad-99ddcb1f5555

Format: uuid

PSU-Geo-Location string , optional

The forwarded Geo Location of the corresponding http request between PSU and TPP if available.

Example: GEO:52.506931;13.144558

Pattern: ^GEO:-?[0-9]{1,2}\.[0-9]{6};-?[0-9]{1,3}\.[0-9]{6}$

PSU-ID string , optional

Client ID of the PSU in the ASPSP client interface. Might be mandated in the ASPSP's documentation. It might be contained even if an OAuth2 based authentication was performed in a pre-step or an OAuth2 based SCA was performed in an preceding AIS service in the same session. In this case the ASPSP might check whether PSU-ID and token match, according to ASPSP documentation.

Example: PSU-1234

Allowed length: max: 140

PSU-Corporate-ID string , optional

Might be mandated in the ASPSP's documentation. Only used in a corporate context.

Example: PSU-CORP-ID1234

Allowed length: max: 140

Client-Redirect-URI string , optional

URI the transaction flow returns to after a redirect. Required for the redirect SCA approach.

Example: https://exampleclient.com/redirectUri?clientEvent=11111111

Format: uri

Digest string , optional

Integrity hash of the request body in the form SHA-256=<base64>. For an empty body, use the hash of an empty string. See Signing requests for how the Digest and signature are built.

Example: SHA-256=hl1/Eps8BEQW58FJhDApwJXjGY4nr1ArGDHIT25vq6A=

x-jws-signature string , optional

Detached JSON Web Signature over the signed request headers and body. See Signing requests for how it is constructed.

X-Request-ID string , required

Unique ID of the request, set by the initiating party and echoed back in the response.

Example: 99391c7e-ad88-49ec-a2ad-99ddcb1f7721

Format: uuid

PSU-IP-Address string , required

IP address of the PSU's device as forwarded by the TPP. If unavailable, use the IP address the TPP used for this request.

Example: 192.168.8.78

Format: ipv4

Field Type Description
access oneOf , required

The payment accounts the consent grants access to. See Consent types for how consent types differ. Exactly one of the consent-type-specific access schemas must apply, matching the request's consentType.

validTo string , required

This parameter is defining a valid until date (including the mentioned date) for the requested consent. The content is the local ASPSP date in ISODate Format, e.g. 2024-10-30. Future dates might get adjusted by ASPSP. If a maximum available date is requested, a date in far future is to be used: "9999-12-31". In both cases, the consent object to be retrieved by the GET Consent Request will contain the adjusted date. The support of this adaption of the maximum available date is mandatory for the ASPSP.

Format: date

cardNumber string , optional

Card Number of the card issued by the PIISP. Should be delivered if available.

consentType string , required

Only the consentTypes "detailed" and "aspspManaged" may be supported.

Allowed values: global, detailed, aspspManaged, accountList

cardExpiryDate string , optional

Expiry date of the card issued by the PIISP

Format: date

cardInformation string , optional

Additional explanation for the card product.

recurringIndicator boolean , required

true for recurring access to the account data, false for one-off access.

registrationInformation string , optional

Additional information about the registration process for the PSU, e.g. a reference to the TPP / PSU contract

Select a status code to see the structure and an example of the response.

Field Type Description
consentId string , required

Identification of the consent resource as it is used in the API structure

psuMessage string , optional

Text to be displayed to the PSU.

consentStatus string , required

Status of the consent. Statuses are described in Consent statuses.

Allowed values: received, rejected, partiallyAuthorised, valid, revokedByPsu, expired, terminatedByTpp, replacedByTpp

_links object , required

A list of hyperlinks to be recognised by the API Client. The actual hyperlinks used in the response depend on the dynamical decisions of the ASPSP when processing the request. The potential links for this response message are generically defined in [oFA SMPF] for all Transaction Initiation Response messages. These links will also be contained in the related Open API files. Remark: All links can be relative or full links, to be decided by the ASPSP.