put/consents
Forwarding the PSU consent (AISP)
OAuth2 scope: aisp
Description
In the mixed detailed consent on accounts
- the AISP captures the consent of the PSU
- then it forwards this consent to the ASPSP This consent replaces any prior consent that was previously sent by the AISP.
Prerequisites
- The TPP was registered by the Registration Authority for the AISP role.
- The TPP and the PSU have a contract that was enrolled by the ASPSP
- At this step, the ASPSP has delivered an OAUTH2 "Authorization Code" or "Resource Owner Password" access token to the TPP (cf. paragraph 3.4.2).
- The TPP and the ASPSP have successfully processed a mutual check and authentication
- The TPP has presented its OAUTH2 "Authorization Code" or "Resource Owner Password" access token which allows the ASPSP to identify the relevant PSU and retrieve the linked PSU context (cf. paragraph 3.4.2) if any.
- The ASPSP takes into account the access token that establishes the link between the PSU and the AISP.
Business Flow
The PSU specifies to the AISP which of his/her accounts will be accessible and which functionalities should be available. The AISP forwards these settings to the ASPSP. The ASPSP answers by HTTP201 return code.
Parameters (18)
- Authorizationheaderstringrequired
Access token to be passed as a header
- accessbodyrequired
List of consents granted to the AISP by the PSU.
- PSU-IP-Addressheaderstring
IP address used by the PSU's terminal when connecting to the TPP
- PSU-IP-Portheaderstring
IP port used by the PSU's terminal when connecting to the TPP
- PSU-HTTP-Methodheaderstring
Http method for the most relevant PSU's terminal request to the TTP
- PSU-Dateheaderstring
Timestamp of the most relevant PSU's terminal request to the TTP
- PSU-GEO-Locationheaderstring
Geographical location of the PSU as provided by the PSU mobile terminal if any to the TPP
- PSU-User-Agentheaderstring
"User-Agent" header field sent by the PSU terminal when connecting to the TPP
- PSU-Refererheaderstring
"Referer" header field sent by the PSU terminal when connecting to the TPP. Notice that an initial typo in RFC 1945 specifies that "referer" (incorrect spelling) is to be used. The correct spelling "referrer" can be used but might not be understood.
- PSU-Acceptheaderstring
"Accept" header field sent by the PSU terminal when connecting to the TPP
- PSU-Accept-Charsetheaderstring
"Accept-Charset" header field sent by the PSU terminal when connecting to the TPP
- PSU-Accept-Encodingheaderstring
"Accept-Encoding" header field sent by the PSU terminal when connecting to the TPP
- PSU-Accept-Languageheaderstring
"Accept-Language" header field sent by the PSU terminal when connecting to the TPP
- PSU-Device-IDheaderstring
UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of installation identification this ID need to be unaltered until removal from device.
- Digestheaderstring
Digest of the body
- Signatureheaderstring
http-signature of the request The keyId must specify the way to get the relevant qualified certificate. It is requested that this identifier is an URL aiming to provide the relevant Qualified Certificate.
- X-Request-IDheaderstringrequired
Correlation header to be set in a request and retrieved in the relevant response
- X-JWS-Signatureheaderstring
Request body
Access
Requested access services.
Fields (7)
- ownersAccessibleAccountsrequired
Schema: AccessibleAccounts
- balancesAccessibleAccountsrequired
Schema: AccessibleAccounts
- transactionsAccessibleAccountsrequired
Schema: AccessibleAccounts
- overdraftsAccessibleAccounts
Schema: AccessibleAccounts
- trustedBeneficiariesboolean
Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU
Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU
- true: the access was granted
- false: the access was not granted
- trustedWorkspaceBeneficiariesarray<AccessibleTrustedBeneficiaries>
Indicator, for each given workspace, that access to the trusted beneficiaries list was granted or not to the AISP by the PSU.
Indicator, for each given workspace, that access to the trusted beneficiaries list was granted or not to the AISP by the PSU.
Item: AccessibleTrustedBeneficiaries
- workspacestring
Identification of the workspace.
Identification of the workspace. If not provided, the default workspace is computed from the authentication that was used for getting the OAuth2 Access Token.
Constraints: maxLength: 32
- accessboolean
Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU for the default workspace
Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU for the default workspace
- true: the access was granted
- false: the access was not granted
- psuIdentitybooleanrequired
Indicator that access to the PSU identity, first name and last name, was granted or not to the AISP by the PSU
Indicator that access to the PSU identity, first name and last name, was granted or not to the AISP by the PSU
- true: the access was granted
- false: the access was not granted
Responses
201
Created
400
Invalid status value
ErrorModel
Generic error report structure
Fields (6)
- timestampstring (date-time)
current timestamp
- statusinteger (int32)required
HTTP error code
- errorstring
HTTP error text
Constraints: maxLength: 140
- messagestringrequired
HTTP textual reason phrase
Constraints: maxLength: 140
- pathstring
Relevant path that was used
Constraints: maxLength: 140
- detailsarray<ErrorDetail>
list of detailed errors that were encountered
Item: ErrorDetail
- locationstringenum · 2
Location of the erroneous parameter when not in request body
Code Name Description header— — query— — - namestring
Name of the erroneous parameter when not in request body
- pathstring
JsonPath of the erroneous request body property
- erroneousValuestring
Erroneous parameter value
- messagestring
Relevant message for the erroneous parameter
- expectedPatternstring
Expected pattern, if any, that the erroneous parameter does not match with
- expectedValueRangeobject
Expected value range, if any, that the erroneous parameter does not match with
- expectedValueCountobject
Expected value count, in the case of an array item, that the erroneous parameter does not match with
- expectedEnumerationarray<string>
Expected enumeration, if any, that the erroneous parameter do not match with
401
Unauthorized, authentication failure.
ErrorModel
Generic error report structure
Fields (6)
- timestampstring (date-time)
current timestamp
- statusinteger (int32)required
HTTP error code
- errorstring
HTTP error text
Constraints: maxLength: 140
- messagestringrequired
HTTP textual reason phrase
Constraints: maxLength: 140
- pathstring
Relevant path that was used
Constraints: maxLength: 140
- detailsarray<ErrorDetail>
list of detailed errors that were encountered
Item: ErrorDetail
- locationstringenum · 2
Location of the erroneous parameter when not in request body
Code Name Description header— — query— — - namestring
Name of the erroneous parameter when not in request body
- pathstring
JsonPath of the erroneous request body property
- erroneousValuestring
Erroneous parameter value
- messagestring
Relevant message for the erroneous parameter
- expectedPatternstring
Expected pattern, if any, that the erroneous parameter does not match with
- expectedValueRangeobject
Expected value range, if any, that the erroneous parameter does not match with
- expectedValueCountobject
Expected value count, in the case of an array item, that the erroneous parameter does not match with
- expectedEnumerationarray<string>
Expected enumeration, if any, that the erroneous parameter do not match with
403
Forbidden, authentication successful but access to resource is not allowed.
ErrorModel
Generic error report structure
Fields (6)
- timestampstring (date-time)
current timestamp
- statusinteger (int32)required
HTTP error code
- errorstring
HTTP error text
Constraints: maxLength: 140
- messagestringrequired
HTTP textual reason phrase
Constraints: maxLength: 140
- pathstring
Relevant path that was used
Constraints: maxLength: 140
- detailsarray<ErrorDetail>
list of detailed errors that were encountered
Item: ErrorDetail
- locationstringenum · 2
Location of the erroneous parameter when not in request body
Code Name Description header— — query— — - namestring
Name of the erroneous parameter when not in request body
- pathstring
JsonPath of the erroneous request body property
- erroneousValuestring
Erroneous parameter value
- messagestring
Relevant message for the erroneous parameter
- expectedPatternstring
Expected pattern, if any, that the erroneous parameter does not match with
- expectedValueRangeobject
Expected value range, if any, that the erroneous parameter does not match with
- expectedValueCountobject
Expected value count, in the case of an array item, that the erroneous parameter does not match with
- expectedEnumerationarray<string>
Expected enumeration, if any, that the erroneous parameter do not match with
405
Method Not Allowed.
ErrorModel
Generic error report structure
Fields (6)
- timestampstring (date-time)
current timestamp
- statusinteger (int32)required
HTTP error code
- errorstring
HTTP error text
Constraints: maxLength: 140
- messagestringrequired
HTTP textual reason phrase
Constraints: maxLength: 140
- pathstring
Relevant path that was used
Constraints: maxLength: 140
- detailsarray<ErrorDetail>
list of detailed errors that were encountered
Item: ErrorDetail
- locationstringenum · 2
Location of the erroneous parameter when not in request body
Code Name Description header— — query— — - namestring
Name of the erroneous parameter when not in request body
- pathstring
JsonPath of the erroneous request body property
- erroneousValuestring
Erroneous parameter value
- messagestring
Relevant message for the erroneous parameter
- expectedPatternstring
Expected pattern, if any, that the erroneous parameter does not match with
- expectedValueRangeobject
Expected value range, if any, that the erroneous parameter does not match with
- expectedValueCountobject
Expected value count, in the case of an array item, that the erroneous parameter does not match with
- expectedEnumerationarray<string>
Expected enumeration, if any, that the erroneous parameter do not match with
406
Not Acceptable.
ErrorModel
Generic error report structure
Fields (6)
- timestampstring (date-time)
current timestamp
- statusinteger (int32)required
HTTP error code
- errorstring
HTTP error text
Constraints: maxLength: 140
- messagestringrequired
HTTP textual reason phrase
Constraints: maxLength: 140
- pathstring
Relevant path that was used
Constraints: maxLength: 140
- detailsarray<ErrorDetail>
list of detailed errors that were encountered
Item: ErrorDetail
- locationstringenum · 2
Location of the erroneous parameter when not in request body
Code Name Description header— — query— — - namestring
Name of the erroneous parameter when not in request body
- pathstring
JsonPath of the erroneous request body property
- erroneousValuestring
Erroneous parameter value
- messagestring
Relevant message for the erroneous parameter
- expectedPatternstring
Expected pattern, if any, that the erroneous parameter does not match with
- expectedValueRangeobject
Expected value range, if any, that the erroneous parameter does not match with
- expectedValueCountobject
Expected value count, in the case of an array item, that the erroneous parameter does not match with
- expectedEnumerationarray<string>
Expected enumeration, if any, that the erroneous parameter do not match with
408
Request Timeout.
ErrorModel
Generic error report structure
Fields (6)
- timestampstring (date-time)
current timestamp
- statusinteger (int32)required
HTTP error code
- errorstring
HTTP error text
Constraints: maxLength: 140
- messagestringrequired
HTTP textual reason phrase
Constraints: maxLength: 140
- pathstring
Relevant path that was used
Constraints: maxLength: 140
- detailsarray<ErrorDetail>
list of detailed errors that were encountered
Item: ErrorDetail
- locationstringenum · 2
Location of the erroneous parameter when not in request body
Code Name Description header— — query— — - namestring
Name of the erroneous parameter when not in request body
- pathstring
JsonPath of the erroneous request body property
- erroneousValuestring
Erroneous parameter value
- messagestring
Relevant message for the erroneous parameter
- expectedPatternstring
Expected pattern, if any, that the erroneous parameter does not match with
- expectedValueRangeobject
Expected value range, if any, that the erroneous parameter does not match with
- expectedValueCountobject
Expected value count, in the case of an array item, that the erroneous parameter does not match with
- expectedEnumerationarray<string>
Expected enumeration, if any, that the erroneous parameter do not match with
429
Too many requests.
ErrorModel
Generic error report structure
Fields (6)
- timestampstring (date-time)
current timestamp
- statusinteger (int32)required
HTTP error code
- errorstring
HTTP error text
Constraints: maxLength: 140
- messagestringrequired
HTTP textual reason phrase
Constraints: maxLength: 140
- pathstring
Relevant path that was used
Constraints: maxLength: 140
- detailsarray<ErrorDetail>
list of detailed errors that were encountered
Item: ErrorDetail
- locationstringenum · 2
Location of the erroneous parameter when not in request body
Code Name Description header— — query— — - namestring
Name of the erroneous parameter when not in request body
- pathstring
JsonPath of the erroneous request body property
- erroneousValuestring
Erroneous parameter value
- messagestring
Relevant message for the erroneous parameter
- expectedPatternstring
Expected pattern, if any, that the erroneous parameter does not match with
- expectedValueRangeobject
Expected value range, if any, that the erroneous parameter does not match with
- expectedValueCountobject
Expected value count, in the case of an array item, that the erroneous parameter does not match with
- expectedEnumerationarray<string>
Expected enumeration, if any, that the erroneous parameter do not match with
500
Internal server error.
ErrorModel
Generic error report structure
Fields (6)
- timestampstring (date-time)
current timestamp
- statusinteger (int32)required
HTTP error code
- errorstring
HTTP error text
Constraints: maxLength: 140
- messagestringrequired
HTTP textual reason phrase
Constraints: maxLength: 140
- pathstring
Relevant path that was used
Constraints: maxLength: 140
- detailsarray<ErrorDetail>
list of detailed errors that were encountered
Item: ErrorDetail
- locationstringenum · 2
Location of the erroneous parameter when not in request body
Code Name Description header— — query— — - namestring
Name of the erroneous parameter when not in request body
- pathstring
JsonPath of the erroneous request body property
- erroneousValuestring
Erroneous parameter value
- messagestring
Relevant message for the erroneous parameter
- expectedPatternstring
Expected pattern, if any, that the erroneous parameter does not match with
- expectedValueRangeobject
Expected value range, if any, that the erroneous parameter does not match with
- expectedValueCountobject
Expected value count, in the case of an array item, that the erroneous parameter does not match with
- expectedEnumerationarray<string>
Expected enumeration, if any, that the erroneous parameter do not match with
501
Not Implemented. This code should be used when the entry point is implemented but cannot provide a result, given the context. When the entry point is not implemented at all, HTTP400 will be returned.
ErrorModel
Generic error report structure
Fields (6)
- timestampstring (date-time)
current timestamp
- statusinteger (int32)required
HTTP error code
- errorstring
HTTP error text
Constraints: maxLength: 140
- messagestringrequired
HTTP textual reason phrase
Constraints: maxLength: 140
- pathstring
Relevant path that was used
Constraints: maxLength: 140
- detailsarray<ErrorDetail>
list of detailed errors that were encountered
Item: ErrorDetail
- locationstringenum · 2
Location of the erroneous parameter when not in request body
Code Name Description header— — query— — - namestring
Name of the erroneous parameter when not in request body
- pathstring
JsonPath of the erroneous request body property
- erroneousValuestring
Erroneous parameter value
- messagestring
Relevant message for the erroneous parameter
- expectedPatternstring
Expected pattern, if any, that the erroneous parameter does not match with
- expectedValueRangeobject
Expected value range, if any, that the erroneous parameter does not match with
- expectedValueCountobject
Expected value count, in the case of an array item, that the erroneous parameter does not match with
- expectedEnumerationarray<string>
Expected enumeration, if any, that the erroneous parameter do not match with
503
Service unavailable.
ErrorModel
Generic error report structure
Fields (6)
- timestampstring (date-time)
current timestamp
- statusinteger (int32)required
HTTP error code
- errorstring
HTTP error text
Constraints: maxLength: 140
- messagestringrequired
HTTP textual reason phrase
Constraints: maxLength: 140
- pathstring
Relevant path that was used
Constraints: maxLength: 140
- detailsarray<ErrorDetail>
list of detailed errors that were encountered
Item: ErrorDetail
- locationstringenum · 2
Location of the erroneous parameter when not in request body
Code Name Description header— — query— — - namestring
Name of the erroneous parameter when not in request body
- pathstring
JsonPath of the erroneous request body property
- erroneousValuestring
Erroneous parameter value
- messagestring
Relevant message for the erroneous parameter
- expectedPatternstring
Expected pattern, if any, that the erroneous parameter does not match with
- expectedValueRangeobject
Expected value range, if any, that the erroneous parameter does not match with
- expectedValueCountobject
Expected value count, in the case of an array item, that the erroneous parameter does not match with
- expectedEnumerationarray<string>
Expected enumeration, if any, that the erroneous parameter do not match with
Schemas used by this endpoint
Every structure referenced by this operation, listed once. Cross-references resolve to anchors on this page.
Access
Requested access services.
Fields (7)
- ownersAccessibleAccountsrequired
Schema: AccessibleAccounts
- balancesAccessibleAccountsrequired
Schema: AccessibleAccounts
- transactionsAccessibleAccountsrequired
Schema: AccessibleAccounts
- overdraftsAccessibleAccounts
Schema: AccessibleAccounts
- trustedBeneficiariesboolean
Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU
Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU
- true: the access was granted
- false: the access was not granted
- trustedWorkspaceBeneficiariesarray<AccessibleTrustedBeneficiaries>
Indicator, for each given workspace, that access to the trusted beneficiaries list was granted or not to the AISP by the PSU.
Indicator, for each given workspace, that access to the trusted beneficiaries list was granted or not to the AISP by the PSU.
Item schema: AccessibleTrustedBeneficiaries
- psuIdentitybooleanrequired
Indicator that access to the PSU identity, first name and last name, was granted or not to the AISP by the PSU
Indicator that access to the PSU identity, first name and last name, was granted or not to the AISP by the PSU
- true: the access was granted
- false: the access was not granted
AccessibleAccounts
List of accessible accounts for one given functionality
Items: AccountIdentification
AccessibleTrustedBeneficiaries
list of workspaces for which the PSU has given consent to the access by the AISP
Fields (2)
- workspacestring
Identification of the workspace.
Identification of the workspace. If not provided, the default workspace is computed from the authentication that was used for getting the OAuth2 Access Token.
Constraints: maxLength: 32
- accessboolean
Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU for the default workspace
Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU for the default workspace
- true: the access was granted
- false: the access was not granted
AccountIdentification
Unique and unambiguous identification for the account between the account owner and the account servicer. Card accounts must provide the identification of the card through the "other" substructure by giving, for instance, the masked PAN (MPAN). The currency used for the account, when needed, can be specified through the [currency] field.
Fields (4)
- workspacestring
Workspace to which the account is linked.
Workspace to which the account is linked. This workspace might be specified by the AISP when forwarding the consent on accounts. If not provided, the default workspace is computed from the authentication that was used for getting the OAuth2 Access Token.
Constraints: maxLength: 32
- ibanstring
ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer.
ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer.
Further specifications of the format and content of the IBAN can be found in the standard ISO 13616 "Banking and related financial services - International Bank Account Number (IBAN)" version 1997-10-01, or later revisions.
Constraints: pattern: `^[A-Z]{2,2}[0-9]{2,2}[a-zA-Z0-9]{1,30}$`
- otherGenericIdentification
Schema: GenericIdentification
- currencyCurrencyCode
Schema: CurrencyCode
CurrencyCode
Specifies the currency of the amount or of the account. A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds".
ErrorDetail
detailed error description
Fields (9)
- locationstringenum · 2
Location of the erroneous parameter when not in request body
Code Name Description header— — query— — - namestring
Name of the erroneous parameter when not in request body
- pathstring
JsonPath of the erroneous request body property
- erroneousValuestring
Erroneous parameter value
- messagestring
Relevant message for the erroneous parameter
- expectedPatternstring
Expected pattern, if any, that the erroneous parameter does not match with
- expectedValueRangeobject
Expected value range, if any, that the erroneous parameter does not match with
- expectedValueCountobject
Expected value count, in the case of an array item, that the erroneous parameter does not match with
- expectedEnumerationarray<string>
Expected enumeration, if any, that the erroneous parameter do not match with
ErrorModel
Generic error report structure
Fields (6)
- timestampstring (date-time)
current timestamp
- statusinteger (int32)required
HTTP error code
- errorstring
HTTP error text
Constraints: maxLength: 140
- messagestringrequired
HTTP textual reason phrase
Constraints: maxLength: 140
- pathstring
Relevant path that was used
Constraints: maxLength: 140
- detailsarray<ErrorDetail>
list of detailed errors that were encountered
Item schema: ErrorDetail
GenericIdentification
ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer. API: The ASPSP will document which account reference type it will support.
Fields (3)
- identificationstringrequired
API: Identifier
API: Identifier
Constraints: maxLength: 70
- schemeNamestringrequired
Name of the identification scheme.
Name of the identification scheme. Possible values for the scheme name, partially based on ISO20022 external code list, are the following:
Code Name Description BANK BankPartyIdentification Unique and unambiguous assignment made by a specific bank or similar financial institution to identify a relationship as defined between the bank and its client. BBAN BBANIdentifier Basic Bank Account Number (BBAN) - identifier used nationally by financial institutions, ie, in individual countries, generally as part of a National Account Numbering Scheme(s), to uniquely identify the account of a customer. COID CountryIdentificationCode) : Country authority given organisation identification (e.g., corporate registration number) SREN SIREN The SIREN number is a 9 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation in France. SRET SIRET The SIRET number is a 14 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation unit in France. It consists of the SIREN number, followed by a five digit classification number, to identify the local geographical unit of that entity. NIDN NationalIdentityNumber Number assigned by an authority to identify the national identity number of a person. Other values are also permitted, for instance: Code Name Description ---- ---- ----------- OAUT OAUTH2 OAUTH2 access token that is owned by the PISP being also an AISP and that can be used in order to identify the PSU CPAN CardPan Card PAN MPAN MaskedPan Card PAN where some digits were replaced for security reason TPAN TokenizedPan Token which was provided by a Token Service Provider (TSP) in order to obfuscate a real card PAN. The TSP must be identified in the issuer field TBAN TokenizedIBAN Token which was provided by a Token Service Provider (TSP) in order to obfuscate an IBAN. The TSP must be identified in the issuer field Each implementation of the STET PSD2 API must specify in its own documentation which schemes can actually been used Constraints: maxLength: 70
- issuerstring
ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties
ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties
Constraints: maxLength: 35