The options of the STET 1.6.3 API

Does the TPP have to register before its first call, and how?

Direct mapping · Manual registration · Automated registration

Does the bank require a client_secret in addition to the certificate?

mTLS only · mTLS and secret

Can a TPP have more than one client_id at the same bank?

Only one · One per usage context

Which checks does the bank combine to work out the TPP's rights?

TPP role · TPP-bank agreement · TPP-PSU agreement · PSU context

Are TPP requests signed with http-signature or with JWS?

http-signature · JWS

Does the bank sign its responses?

No · Yes

How does the keyId point to the signing certificate?

Registration kid · Certificate URL

Which PSU context headers does the TPP send?

Those it has · None

How does the bank detect a replayed request or a duplicate?

Idempotency-Key · paymentInformationId

Which OAuth2 grant does the AISP use to get its token?

Authorization code · OpenID Connect · CIBA

Does the authorization server require PKCE?

Not required · Required

Does the bank implement OpenID Connect, and does it accept a signed request?

OAuth2 only · OpenID Connect · Signed Request Object

Can the TPP pass a PSU identifier to the bank?

login_hint · login_hint_token · id_token_hint

How long do the authorization code and the access token live?

Authorization code · Access token

Does the bank issue a refresh token, and does it rotate it?

No refresh token · Without rotation · With rotation

When does the bank revoke an AISP's refresh token?

Regulatory period · Internal period · On request

Does the bank expose token introspection?

No · Yes

How often does the TPP poll the token endpoint in CIBA?

interval provided · interval missing

Are redirect URLs declared in advance?

Declared · Not declared

On mobile, does the redirect open the bank's app?

Browser · App-to-app

Which authentication approaches does the bank offer?

Redirect · Decoupled · Both

Which PSU identifier does the bank recognise?

National identifier · Customer identifier

Can the PISP signal that a payment falls under an exemption?

No hint · scaHint

Can the AISP get more than 90 days of transactions?

aisp · aisp extended_transaction_history

Does the bank need to know the details of the consent given to the AISP?

A1, full-AISP · A2, mixed

Does the PSU have several spaces at the bank?

One space · Several workspaces

How does the bank expose deferred debit cards?

No card account · One CARD account per card · Several per card

Which balances does the bank return?

One balance · Several · In the account list

What does GET /transactions return without a filter, and based on which date?

Default set · Date filters · Reference filters

Does the bank paginate lists?

No pagination · HAL links

Which identifier does the TPP use to reconcile transactions?

resourceId · entryReference · None

Which transaction statuses does the bank return?

BOOK · PDNG · FUTR and INFO

How does the bank code the transaction type?

ISO 20022 · National codes · Proprietary code

Does the bank provide the details of a transaction?

No · For some transactions

Does the bank expose the holders of an account?

No · Individuals · Company

Does the bank expose the identity of the connected PSU?

No · Yes

Does the bank expose the authorised overdraft?

No · Yes

Does the bank expose the list of trusted beneficiaries?

No · Yes

How many accesses per day does the bank accept without the PSU?

Four in 24 hours · More

Which token does the CBPII use to check that funds are available?

With the PSU · Client credentials

Does the check apply to an account or to a card?

Account · Card

How does the PSU confirm a payment?

Enforced redirect · Decoupled

Does the bank require SCA to cancel a payment?

No · Simple redirect · Decoupled

Which types of payment request does the bank accept?

Single transfer · Several beneficiaries · Several dates · Standing order

Which payment instruments does the bank accept?

SCT · SCT Inst · Non-euro domestic · International

What does the bank do when an instant payment cannot go out as instant?

Rejection · Downgrade

Does the PISP provide the debtor account, and can the bank change it?

Provided by the PISP · Chosen at the bank · Changeable

Who bears the charges, and can the bank change that choice?

chargeBearer · acceptChargeHandlingChange

When does the transfer go out, and what does the bank do if the date is not possible?

As soon as possible · Requested date · Shifted date

Which frequencies and execution rules does the bank accept for a standing order?

Frequencies · Execution rule · End

How many instructions can a request contain, and are they booked as a batch?

Cap · Batch booking

Which remittance information does the bank accept?

Unstructured · Structured · Both

Does the PISP provide a separate return URL for failure?

A single URL · Two URLs

For how long and in what form can a payment's status be retrieved?

30 days · More · Transactions endpoint

What does the bank tell the PISP about an immediate transfer that is not instant?

Booked · Funds available or not

Does the bank explain why it rejects a payment?

Specific reason · No reason

How does the bank publish its implementation of the spec?

Adapted STET file · Marked deviations

How does the bank respond to a call to a feature it does not offer?

400 · 501 · 405 and 406

Which kinds of account reference does the bank accept?

IBAN · Other schemes

Which transport and format rules apply beyond the minimum?

TLS 1.2 minimum · HTTP 1.1 minimum · Dates

Does the bank provide a contingency mechanism if the dedicated interface goes down?

Contingency mechanism · Exemption

What does the bank's test environment cover?

Connection and certificates · Functional flows · Authentication