A bank's profile on STET 1.6.3

Does the TPP have to register before its first call, and how?

• Direct mappingThe client_id is the authorisation number read from the eIDAS certificate. The bank accepts the OAuth2 request on the fly.
• Manual registrationThe bank assigns a client_id during a prior registration, usually on its portal.
• Automated registrationThe TPP registers through the POST /register API (RFC 7591), then manages its registration with GET, PUT and DELETE (RFC 7592).

Does the bank require a client_secret in addition to the certificate?

• mTLS onlyThe TPP authenticates with its QWAC (RFC 8705). The registration API only accepts the tls_client_auth method.
• mTLS and secretSome authorization servers still ask for a client_secret. The spec considers it of little use.

Can a TPP have more than one client_id at the same bank?

• Only oneOne client_id per TPP.
• One per usage contextThe spec allows several by repeating the registration, in reasonable numbers and for a real need. Each agent of the TPP counts as a separate context.

Which checks does the bank combine to work out the TPP's rights?

• TPP roleRead from the eIDAS certificate: PSP_AI, PSP_PI, PSP_IC.
• TPP-bank agreementAn agreement between the TPP and the bank.
• TPP-PSU agreementCarried by the OAuth2 token.
• PSU contextThe PSU's accounts and rights at the bank.

Are TPP requests signed with http-signature or with JWS?

• http-signatureThe Cavage draft, Signature and Digest headers, RSA-SHA256. It was the only mechanism up to 1.6.2.
• JWSThe Open Banking Europe JWS profile, X-JWS-Signature header, with the algorithm chosen from those of RFC 7518 and ETSI TS 119 312. STET strongly recommends moving to it.

Does the bank sign its responses?

• NoOnly the TPP's requests are signed.
• YesResponse Signature and Digest headers are declared on CBPII and PISP responses.

How does the keyId point to the signing certificate?

• Registration kidThe value assigned by the authorization server during OAuth2 registration.
• Certificate URLA URL that serves the QSealC, whose last segment ends with _ followed by the SHA-256 fingerprint.

Which PSU context headers does the TPP send?

• Those it hasPSU-IP-Address, PSU-IP-Port, PSU-HTTP-Method, PSU-Date, PSU-User-Agent, PSU-Referer, the PSU-Accept* headers, PSU-GEO-Location, PSU-Device-ID.
• NoneWhen the PSU is not connected, for example for AISP access in the background.

How does the bank detect a replayed request or a duplicate?

• Idempotency-KeyMandatory on POST /payment-requests, POST …/confirmation and POST /funds-confirmations, with the uniqueness and expiry rules of the IETF draft.
• paymentInformationIdA hint to avoid a double SCA or a double execution. The bank may also use its own mechanisms.

Which OAuth2 grant does the AISP use to get its token?

• Authorization codeRedirect, optionally enriched with login_hint and ui_locales.
• OpenID ConnectRedirect, with the openid and offline_access scopes added.
• CIBADecoupled, in polling mode only.

Does the authorization server require PKCE?

• Not requiredThe authorization code is enough.
• Requiredcode_challenge and code_verifier become mandatory. The method is plain by default, or S256.

Does the bank implement OpenID Connect, and does it accept a signed request?

• OAuth2 onlyNo IdToken.
• OpenID ConnectAn IdToken on top of the tokens. ui_locales becomes mandatory.
• Signed Request ObjectIf the server accepts it, the parameters go in a signed JWT. Plain parameters can be sent alongside.

Can the TPP pass a PSU identifier to the bank?

• login_hintThe PSU identifier as the bank knows it.
• login_hint_tokenAn opaque token issued by the bank after a first authentication, which the TPP sends back in a new request.
• id_token_hintIf the bank has implemented OpenID Connect.

How long do the authorization code and the access token live?

• Authorization codeTen minutes, as recommended by RFC 6749. The server sets its own value.
• Access tokenexpires_in is optional in every token response.

Does the bank issue a refresh token, and does it rotate it?

• No refresh tokenrefresh_token is optional in authorization code, OpenID Connect and CIBA responses. It never exists with client credentials or for the PISP confirmation.
• Without rotationThe same refresh token works until it is revoked.
• With rotationThe refresh response can contain a new refresh token, which replaces the old one.

When does the bank revoke an AISP's refresh token?

• Regulatory periodWhen the legal period between two SCAs runs out.
• Internal periodWhen a period set by the bank itself runs out, if there is one.
• On requestWhen the PSU revokes access, or when the TPP revokes its own refresh token (RFC 7009).

Does the bank expose token introspection?

• NoThe TPP only knows what the token response gave it.
• YesRFC 7662. The TPP introspects its own tokens, and the response can carry a login_hint_token.

How often does the TPP poll the token endpoint in CIBA?

• interval providedThe bank gives the polling interval in its response.
• interval missingThe spec gives no default value. CIBA Core sets a default of five seconds.

Are redirect URLs declared in advance?

• DeclaredThe bank compares the URL it receives with those declared at registration, character for character.
• Not declaredredirect_uri is optional in the /authorize request.

On mobile, does the redirect open the bank's app?

• BrowserThe PSU authenticates on the bank's mobile website.
• App-to-appUniversal Link on iOS, App Link on Android, declared by the bank's app for its OAuth2 server and by the TPP's app for its return URL.

Which authentication approaches does the bank offer?

• RedirectThe PSU is redirected to the bank, which authenticates them.
• DecoupledThe bank authenticates the PSU on another channel, usually its app.
• BothThe bank chooses for each request.

Which PSU identifier does the bank recognise?

• National identifierA public identifier of the person.
• Customer identifierThe identifier the bank assigns to its customer.

Can the PISP signal that a payment falls under an exemption?

• No hintThe bank decides alone.
• scaHintnoScaExemption or scaExemption, set by the PISP in supplementaryData.

Can the AISP get more than 90 days of transactions?

• aispThe standard scope.
• aisp extended_transaction_historyOnly valid with the very first access token. The bank narrows it to aisp at the first refresh.

Does the bank need to know the details of the consent given to the AISP?

• A1, full-AISPThe bank does not know the details of the consent. It answers every AISP request, with no way to check that the request respects the PSU's choices.
• A2, mixedThe AISP passes the PSU's choices through PUT /consents. GET /accounts returns all eligible accounts, but HAL links and identifiers only for the accounts covered by consent.

Does the PSU have several spaces at the bank?

• One spaceThe default space is the one tied to the authentication used to obtain the token.
• Several workspacesThe AISP lists them through the workspaces link and targets one of them with the workspace parameter.

How does the bank expose deferred debit cards?

• No card accountCard transactions only appear when they are debited from the current account.
• One CARD account per cardAn account of type CARD, linked to the current account.
• Several per cardOne account per debit date.

Which balances does the bank return?

• One balanceAt least one, normally the booked balance for a current account.
• SeveralCLBD, XPCD, VALU, OTHR, PRCD, ITAV, each with its label.
• In the account listThe bank may include balances directly in GET /accounts.

What does GET /transactions return without a filter, and based on which date?

• Default setTo be documented by the bank.
• Date filtersdateFrom inclusive, dateTo exclusive, dateType set to transactionDate or bookingDate.
• Reference filtersentryReferenceFrom, strictly greater than, and entryReferenceto, less than or equal to.

Does the bank paginate lists?

• No paginationThe whole result in one response.
• HAL linksfirst, last, next, prev, with no page size parameter.

Which identifier does the TPP use to reconcile transactions?

• resourceIdThe identifier of the transaction resource.
• entryReferenceThe technical reference of the entry.
• NoneThe spec then suggests not changing remittanceInformation once it is set.

Which transaction statuses does the bank return?

• BOOKBooked transactions.
• PDNGTransactions not yet booked that already affect the instant balance.
• FUTR and INFOUpcoming transactions, and those provided for information with no entry.

How does the bank code the transaction type?

• ISO 20022ISO domain, family and sub-family.
• National codesFR domain, CFONB family and operation code.
• Proprietary codeTo be documented, with its issuer.

Does the bank provide the details of a transaction?

• NoNo details link.
• For some transactionsA details link on the transaction signals that details exist.

Does the bank expose the holders of an account?

• NoNo owners link.
• IndividualsAn identities list, with a mandatory fullName.
• CompanyA company block.

Does the bank expose the identity of the connected PSU?

• NoNo endUserIdentity link.
• YesGET /end-user-identity, with a mandatory fullName, and optional first name, last name and title.

Does the bank expose the authorised overdraft?

• NoNo overdrafts link.
• YesGET /accounts/{id}/overdrafts, which only returns allowedAmount.

Does the bank expose the list of trusted beneficiaries?

• NoA 501 response, and the isTrusted flag must never appear.
• YesGET /trusted-beneficiaries, and isTrusted on each beneficiary.

How many accesses per day does the bank accept without the PSU?

• Four in 24 hoursThe regulatory minimum.
• MoreIf the AISP and the bank agree, with the PSU's consent.

Which token does the CBPII use to check that funds are available?

• With the PSUAuthorization code, OpenID Connect or CIBA, after an SCA.
• Client credentialsWhen the PSU has enrolled the CBPII with their bank beforehand.

Does the check apply to an account or to a card?

• AccountIdentified by its IBAN.
• CardIdentified by other, with CPAN, MPAN or TPAN.

How does the PSU confirm a payment?

• Enforced redirectThe PSU is redirected to the bank. After SCA, the PISP gets an access token through authorization code and uses it for its own confirmation.
• DecoupledThe bank authenticates the PSU on another channel and calls the PISP's return URL directly, then the PISP confirms with its client credentials token.

Does the bank require SCA to cancel a payment?

• NoappliedAuthenticationApproach is NONE and the cancellation takes effect immediately.
• Simple redirectThe PSU is redirected to the bank to confirm the cancellation.
• DecoupledThe bank has the cancellation confirmed on another channel.

Which types of payment request does the bank accept?

• Single transferOne instruction, one beneficiary.
• Several beneficiariesOn the same execution date.
• Several datesFor the same beneficiary.
• Standing orderOne instruction, one beneficiary, one frequency.

Which payment instruments does the bank accept?

• SCTSEPA credit transfer.
• SCT InstlocalInstrument set to INST.
• Non-euro domesticWith regulatory reporting codes.
• InternationalWith the creditor's date and place of birth.

What does the bank do when an instant payment cannot go out as instant?

• RejectionacceptInstantPaymentDowngrade set to false, the default value.
• DowngradeIf the PISP accepts it, the bank falls back to a regular SCT and removes INST from localInstrument.

Does the PISP provide the debtor account, and can the bank change it?

• Provided by the PISPdebtorAccount filled in.
• Chosen at the bankdebtorAccount absent. The spec does not describe this choice, which normally happens during authentication.
• ChangeableacceptDebtorAccountChange, true by default, allows the bank to change it.

Who bears the charges, and can the bank change that choice?

• chargeBearerSLEV, SHAR, CRED or DEBT depending on the instrument.
• acceptChargeHandlingChangetrue by default, allows the bank to change the allocation.

When does the transfer go out, and what does the bank do if the date is not possible?

• As soon as possiblerequestedExecutionDate absent.
• Requested dateThe desired debit date.
• Shifted dateFor a payment that is not a standing order, the bank can move to the next possible date.

Which frequencies and execution rules does the bank accept for a standing order?

• FrequenciesDAIL, WEEK, TOWK, MNTH, TOMN, QUTR, SEMI, YEAR, or a subset.
• Execution ruleFWNG or PREC, if online banking supports it.
• EndWithout endDate, the order has no end.

How many instructions can a request contain, and are they booked as a batch?

• CapEach bank sets the maximum for numberOfTransactions.
• Batch bookingThe bank has its own default value, and the PISP can set it.

Which remittance information does the bank accept?

• UnstructuredOne occurrence at most.
• StructuredOne occurrence at most.
• BothThey can coexist.

Does the PISP provide a separate return URL for failure?

• A single URLsuccessfulReportUrl, also used on failure.
• Two URLssuccessfulReportUrl and unsuccessfulReportUrl.

For how long and in what form can a payment's status be retrieved?

• 30 daysThe minimum set by the spec.
• MoreAccording to the bank's rules.
• Transactions endpointGET /payment-requests/{id}/transactions, optional, signalled by a transactions link.

What does the bank tell the PISP about an immediate transfer that is not instant?

• Bookedbooking set to true.
• Funds available or notIf the system cannot book right away, booking is set to false and fundsAvailability is filled in.

Does the bank explain why it rejects a payment?

• Specific reasonA code from AC01, AC04, AC06, AG01, AM02, AM04, AM18, FF01, FRAD, NOAS, among others.
• No reasonMS03, “No reason specified by the ASPSP”.

How does the bank publish its implementation of the spec?

• Adapted STET filehost must be customised, basePath and the authorization and token URLs can be customised.
• Marked deviationsReference version in x-stet-psd2-api-reference-version, derived definitions marked with x-original-definition.

How does the bank respond to a call to a feature it does not offer?

• 400The endpoint is not implemented at all.
• 501It is implemented but cannot respond in this context.
• 405 and 406Method not supported, or response format not offered.

Which kinds of account reference does the bank accept?

• IBANThe common case.
• Other schemesBANK, BBAN, COID, SREN, SRET, NIDN, and also OAUT, CPAN, MPAN, TPAN, TBAN.

Which transport and format rules apply beyond the minimum?

• TLS 1.2 minimumHSTS or PFS can be added.
• HTTP 1.1 minimumA more recent version is allowed.
• DatesThe creator chooses the time zone, with UTC recommended, and the precision.

Does the bank provide a contingency mechanism if the dedicated interface goes down?

• Contingency mechanismTPPs use the bank's customer interface, identifying themselves, until the dedicated interface is restored (Article 33(4) of the RTS).
• ExemptionGranted by the competent authority, after consulting the EBA (Article 33(6)).

What does the bank's test environment cover?

• Connection and certificatesSet up mTLS, exchange certificates, receive error messages.
• Functional flowsAIS, PIS and funds confirmation, with dummy PSU data.
• AuthenticationEvery authentication procedure offered to customers.