ofOpen Finance Guide
GlosarioSTETBlogContacto
AISP

put/consents

Forwarding the PSU consent (AISP)

OAuth2 scopes: aisp, aisp

Description

In the mixed detailed consent on accounts

  • the AISP captures the consent of the PSU
  • then it forwards this consent to the ASPSP This consent replaces any prior consent that was previously sent by the AISP.

Prerequisites

  • The TPP has been registered by the Registration Authority for the AISP role.
  • The TPP and the PSU have a contract that has been enrolled by the ASPSP
    • At this step, the ASPSP has delivered an OAUTH2 "Authorization Code" or "Resource Owner Password" access token to the TPP (cf. § 3.4.2).
  • The TPP and the ASPSP have successfully processed a mutual check and authentication
  • The TPP has presented its OAUTH2 "Authorization Code" or "Resource Owner Password" access token which allows the ASPSP to identify the relevant PSU and retrieve the linked PSU context (cf. § 3.4.2) if any.
  • The ASPSP takes into account the access token that establishes the link between the PSU and the AISP.

Business Flow

The PSU specifies to the AISP which of his/her accounts will be accessible and which functionalities should be available. The AISP forwards these settings to the ASPSP. The ASPSP answers by HTTP201 return code.

Parameters (17)

  • Authorizationheaderstringrequired

    Access token to be passed as a header

  • accessbodyrequired

    List of consents granted to the AISP by the PSU.

  • PSU-IP-Addressheaderstring

    IP address used by the PSU's terminal when connecting to the TPP

  • PSU-IP-Portheaderstring

    IP port used by the PSU's terminal when connecting to the TPP

  • PSU-HTTP-Methodheaderstring

    Http method for the most relevant PSU’s terminal request to the TTP

  • PSU-Dateheaderstring

    Timestamp of the most relevant PSU’s terminal request to the TTP

  • PSU-GEO-Locationheaderstring

    Geographical location of the PSU as provided by the PSU mobile terminal if any to the TPP

  • PSU-User-Agentheaderstring

    "User-Agent" header field sent by the PSU terminal when connecting to the TPP

  • PSU-Refererheaderstring

    "Referer" header field sent by the PSU terminal when connecting to the TPP. Notice that an initial typo in RFC 1945 specifies that "referer" (incorrect spelling) is to be used. The correct spelling "referrer" can be used but might not be understood.

  • PSU-Acceptheaderstring

    "Accept" header field sent by the PSU terminal when connecting to the TPP

  • PSU-Accept-Charsetheaderstring

    "Accept-Charset" header field sent by the PSU terminal when connecting to the TPP

  • PSU-Accept-Encodingheaderstring

    "Accept-Encoding" header field sent by the PSU terminal when connecting to the TPP

  • PSU-Accept-Languageheaderstring

    "Accept-Language" header field sent by the PSU terminal when connecting to the TPP

  • PSU-Device-IDheaderstring

    UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of installation identification this ID need to be unaltered until removal from device.

  • Digestheaderstring

    Digest of the body

  • Signatureheaderstringrequired

    http-signature of the request The keyId must specify the way to get the relevant qualified certificate. It is requested that this identifier is an URL aiming to provide the relevant Qualified Certificate.

  • X-Request-IDheaderstringrequired

    Correlation header to be set in a request and retrieved in the relevant response

    Constraints: maxLength: 70

Request body

object

Access

Requested access services.

Fields (4)

  • balancesAccessibleAccountsrequired

    List of accessible accounts for one given functionality

    Item: AccountIdentification

    Unique and unambiguous identification for the account between the account owner and the account servicer.

    • ibanstring

      ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer.

      ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer.

      Further specifications of the format and content of the IBAN can be found in the standard ISO 13616 "Banking and related financial services - International Bank Account Number (IBAN)" version 1997-10-01, or later revisions.

      Constraints: pattern: `^[A-Z]{2,2}[0-9]{2,2}[a-zA-Z0-9]{1,30}$`

    • otherGenericIdentification

      ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer.

      Schema: GenericIdentification

      ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer. API: The ASPSP will document which account reference type it will support.

      • identificationstringrequired

        API: Identifier

        API: Identifier

        Constraints: maxLength: 70

      • schemeNamestringrequired

        Name of the identification scheme.

        Name of the identification scheme. Possible values for the scheme name, partially based on ISO20022 external code list, are the following:

        CodeNameDescription
        BANKBankPartyIdentificationUnique and unambiguous assignment made by a specific bank or similar financial institution to identify a relationship as defined between the bank and its client.
        COIDCountryIdentificationCode) : Country authority given organisation identification (e.g., corporate registration number)
        SRENSIRENThe SIREN number is a 9 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation in France.
        SRETSIRETThe SIRET number is a 14 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation unit in France. It consists of the SIREN number, followed by a five digit classification number, to identify the local geographical unit of that entity.
        NIDNNationalIdentityNumberNumber assigned by an authority to identify the national identity number of a person.
        Other values are also permitted, for instance:
        CodeNameDescription
        -------------------
        OAUTOAUTH2OAUTH2 access token that is owned by the PISP being also an AISP and that can be used in order to identify the PSU
        CPANCardPanCard PAN
        Each implementation of the STET PSD2 API must specify in its own documentation which schemes can actually been used

        Constraints: maxLength: 70

      • issuerstring

        ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties

        ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties

        Constraints: maxLength: 35

    • currencyCurrencyCodeISO 4217

      Currency used for the account

      Schema: CurrencyCode

      Specifies the currency of the amount or of the account. A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds".

      Type: string

      Constraints: pattern: `^[A-Z]{3,3}$`

  • transactionsAccessibleAccountsrequired

    List of accessible accounts for one given functionality

    Item: AccountIdentification

    Unique and unambiguous identification for the account between the account owner and the account servicer.

    • ibanstring

      ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer.

      ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer.

      Further specifications of the format and content of the IBAN can be found in the standard ISO 13616 "Banking and related financial services - International Bank Account Number (IBAN)" version 1997-10-01, or later revisions.

      Constraints: pattern: `^[A-Z]{2,2}[0-9]{2,2}[a-zA-Z0-9]{1,30}$`

    • otherGenericIdentification

      ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer.

      Schema: GenericIdentification

      ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer. API: The ASPSP will document which account reference type it will support.

      • identificationstringrequired

        API: Identifier

        API: Identifier

        Constraints: maxLength: 70

      • schemeNamestringrequired

        Name of the identification scheme.

        Name of the identification scheme. Possible values for the scheme name, partially based on ISO20022 external code list, are the following:

        CodeNameDescription
        BANKBankPartyIdentificationUnique and unambiguous assignment made by a specific bank or similar financial institution to identify a relationship as defined between the bank and its client.
        COIDCountryIdentificationCode) : Country authority given organisation identification (e.g., corporate registration number)
        SRENSIRENThe SIREN number is a 9 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation in France.
        SRETSIRETThe SIRET number is a 14 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation unit in France. It consists of the SIREN number, followed by a five digit classification number, to identify the local geographical unit of that entity.
        NIDNNationalIdentityNumberNumber assigned by an authority to identify the national identity number of a person.
        Other values are also permitted, for instance:
        CodeNameDescription
        -------------------
        OAUTOAUTH2OAUTH2 access token that is owned by the PISP being also an AISP and that can be used in order to identify the PSU
        CPANCardPanCard PAN
        Each implementation of the STET PSD2 API must specify in its own documentation which schemes can actually been used

        Constraints: maxLength: 70

      • issuerstring

        ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties

        ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties

        Constraints: maxLength: 35

    • currencyCurrencyCodeISO 4217

      Currency used for the account

      Schema: CurrencyCode

      Specifies the currency of the amount or of the account. A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds".

      Type: string

      Constraints: pattern: `^[A-Z]{3,3}$`

  • trustedBeneficiariesbooleanrequired

    Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU

    Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU

    • true: the access was granted
    • false: the access was not granted
  • psuIdentitybooleanrequired

    Indicator that access to the PSU identity, first name and last name, was granted or not to the AISP by the PSU

    Indicator that access to the PSU identity, first name and last name, was granted or not to the AISP by the PSU

    • true: the access was granted
    • false: the access was not granted

Responses

201

Created

400

Invalid status value

object

ErrorModel

Generic error report structure

Fields (5)

  • timestampstring (date-time)ISO 8601

    current timestamp

  • statusinteger (int32)required

    HTTP error code

  • errorstring

    HTTP error text

    Constraints: maxLength: 140

  • messagestringrequired

    HTTP textual reason phrase

    Constraints: maxLength: 140

  • pathstring

    Relevant path that was used

    Constraints: maxLength: 140

401

Unauthorized, authentication failure.

object

ErrorModel

Generic error report structure

Fields (5)

  • timestampstring (date-time)ISO 8601

    current timestamp

  • statusinteger (int32)required

    HTTP error code

  • errorstring

    HTTP error text

    Constraints: maxLength: 140

  • messagestringrequired

    HTTP textual reason phrase

    Constraints: maxLength: 140

  • pathstring

    Relevant path that was used

    Constraints: maxLength: 140

403

Forbidden, authentication successful but access to resource is not allowed.

object

ErrorModel

Generic error report structure

Fields (5)

  • timestampstring (date-time)ISO 8601

    current timestamp

  • statusinteger (int32)required

    HTTP error code

  • errorstring

    HTTP error text

    Constraints: maxLength: 140

  • messagestringrequired

    HTTP textual reason phrase

    Constraints: maxLength: 140

  • pathstring

    Relevant path that was used

    Constraints: maxLength: 140

405

Method Not Allowed.

object

ErrorModel

Generic error report structure

Fields (5)

  • timestampstring (date-time)ISO 8601

    current timestamp

  • statusinteger (int32)required

    HTTP error code

  • errorstring

    HTTP error text

    Constraints: maxLength: 140

  • messagestringrequired

    HTTP textual reason phrase

    Constraints: maxLength: 140

  • pathstring

    Relevant path that was used

    Constraints: maxLength: 140

406

Not Acceptable.

object

ErrorModel

Generic error report structure

Fields (5)

  • timestampstring (date-time)ISO 8601

    current timestamp

  • statusinteger (int32)required

    HTTP error code

  • errorstring

    HTTP error text

    Constraints: maxLength: 140

  • messagestringrequired

    HTTP textual reason phrase

    Constraints: maxLength: 140

  • pathstring

    Relevant path that was used

    Constraints: maxLength: 140

408

Request Timeout.

object

ErrorModel

Generic error report structure

Fields (5)

  • timestampstring (date-time)ISO 8601

    current timestamp

  • statusinteger (int32)required

    HTTP error code

  • errorstring

    HTTP error text

    Constraints: maxLength: 140

  • messagestringrequired

    HTTP textual reason phrase

    Constraints: maxLength: 140

  • pathstring

    Relevant path that was used

    Constraints: maxLength: 140

429

Too many requests.

object

ErrorModel

Generic error report structure

Fields (5)

  • timestampstring (date-time)ISO 8601

    current timestamp

  • statusinteger (int32)required

    HTTP error code

  • errorstring

    HTTP error text

    Constraints: maxLength: 140

  • messagestringrequired

    HTTP textual reason phrase

    Constraints: maxLength: 140

  • pathstring

    Relevant path that was used

    Constraints: maxLength: 140

500

Internal server error.

object

ErrorModel

Generic error report structure

Fields (5)

  • timestampstring (date-time)ISO 8601

    current timestamp

  • statusinteger (int32)required

    HTTP error code

  • errorstring

    HTTP error text

    Constraints: maxLength: 140

  • messagestringrequired

    HTTP textual reason phrase

    Constraints: maxLength: 140

  • pathstring

    Relevant path that was used

    Constraints: maxLength: 140

501

Not Implemented. This code should be used when the entry point is implemented but cannot provide a result, given the context. When the entry point is not implemented at all, HTTP400 will be returned.

object

ErrorModel

Generic error report structure

Fields (5)

  • timestampstring (date-time)ISO 8601

    current timestamp

  • statusinteger (int32)required

    HTTP error code

  • errorstring

    HTTP error text

    Constraints: maxLength: 140

  • messagestringrequired

    HTTP textual reason phrase

    Constraints: maxLength: 140

  • pathstring

    Relevant path that was used

    Constraints: maxLength: 140

503

Service unavailable.

object

ErrorModel

Generic error report structure

Fields (5)

  • timestampstring (date-time)ISO 8601

    current timestamp

  • statusinteger (int32)required

    HTTP error code

  • errorstring

    HTTP error text

    Constraints: maxLength: 140

  • messagestringrequired

    HTTP textual reason phrase

    Constraints: maxLength: 140

  • pathstring

    Relevant path that was used

    Constraints: maxLength: 140

Schemas used by this endpoint

Every structure referenced by this operation, listed once. Cross-references resolve to anchors on this page.

object

Access

Requested access services.

Fields (4)

  • balancesAccessibleAccountsrequired

    Schema: AccessibleAccounts

  • transactionsAccessibleAccountsrequired

    Schema: AccessibleAccounts

  • trustedBeneficiariesbooleanrequired

    Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU

    Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU

    • true: the access was granted
    • false: the access was not granted
  • psuIdentitybooleanrequired

    Indicator that access to the PSU identity, first name and last name, was granted or not to the AISP by the PSU

    Indicator that access to the PSU identity, first name and last name, was granted or not to the AISP by the PSU

    • true: the access was granted
    • false: the access was not granted
array of AccountIdentification

AccessibleAccounts

List of accessible accounts for one given functionality

Items: AccountIdentification

object§ 4.1.1 · PDF p. 7

AccountIdentification

Unique and unambiguous identification for the account between the account owner and the account servicer.

Fields (3)

  • ibanstring

    ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer.

    ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer.

    Further specifications of the format and content of the IBAN can be found in the standard ISO 13616 "Banking and related financial services - International Bank Account Number (IBAN)" version 1997-10-01, or later revisions.

    Constraints: pattern: `^[A-Z]{2,2}[0-9]{2,2}[a-zA-Z0-9]{1,30}$`

  • otherGenericIdentification

    Schema: GenericIdentification

  • currencyCurrencyCodeISO 4217

    Currency used for the account

    Schema: CurrencyCode

string

CurrencyCode

Specifies the currency of the amount or of the account. A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds".

object

ErrorModel

Generic error report structure

Fields (5)

  • timestampstring (date-time)ISO 8601

    current timestamp

  • statusinteger (int32)required

    HTTP error code

  • errorstring

    HTTP error text

    Constraints: maxLength: 140

  • messagestringrequired

    HTTP textual reason phrase

    Constraints: maxLength: 140

  • pathstring

    Relevant path that was used

    Constraints: maxLength: 140

object§ 4.1.3 · PDF p. 9

GenericIdentification

ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer. API: The ASPSP will document which account reference type it will support.

Fields (3)

  • identificationstringrequired

    API: Identifier

    API: Identifier

    Constraints: maxLength: 70

  • schemeNamestringrequired

    Name of the identification scheme.

    Name of the identification scheme. Possible values for the scheme name, partially based on ISO20022 external code list, are the following:

    CodeNameDescription
    BANKBankPartyIdentificationUnique and unambiguous assignment made by a specific bank or similar financial institution to identify a relationship as defined between the bank and its client.
    COIDCountryIdentificationCode) : Country authority given organisation identification (e.g., corporate registration number)
    SRENSIRENThe SIREN number is a 9 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation in France.
    SRETSIRETThe SIRET number is a 14 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation unit in France. It consists of the SIREN number, followed by a five digit classification number, to identify the local geographical unit of that entity.
    NIDNNationalIdentityNumberNumber assigned by an authority to identify the national identity number of a person.
    Other values are also permitted, for instance:
    CodeNameDescription
    -------------------
    OAUTOAUTH2OAUTH2 access token that is owned by the PISP being also an AISP and that can be used in order to identify the PSU
    CPANCardPanCard PAN
    Each implementation of the STET PSD2 API must specify in its own documentation which schemes can actually been used

    Constraints: maxLength: 70

  • issuerstring

    ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties

    ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties

    Constraints: maxLength: 35