post/funds-confirmations

Payment coverage check request (CBPII)

Escopos OAuth2: cbpii, cbpii

Description

The CBPII can ask an ASPSP to check if a given amount can be covered by the liquidity that is available on a PSU cash account or payment card.

Prerequisites

The TPP was registered by the Registration Authority for the CBPII role
The TPP and the PSU have a contract that was registered by the ASPSP
- At this step, the ASPSP has delivered an "Authorization Code", a "Resource Owner Password" or a "Client Credential" OAUTH2 access token to the TPP (cf. paragraph 3.4.2).
- Each ASPSP has to implement either the "Authorization Code"/"Resource Owner Password" or the "Client Credential" OAUTH2 access token model.
- Doing this, it will edit the [security] section on this path in order to specify which model it has chosen
The TPP and the ASPSP have successfully processed a mutual check and authentication
The TPP has presented its OAUTH2 "Authorization Code", "Resource Owner Password" or "Client Credential" access token which allows the ASPSP to identify the relevant PSU.

Business flow

The CBPII requests the ASPSP for a payment coverage check against either a bank account or a card primary identifier. This request cannot handle exchange rate and must be specified with the relevant account currency. The ASPSP answers with a structure embedding the original request and the result as a Boolean.

Parâmetros (19)

Authorizationheaderstringobrigatório
Access token to be passed as a header
paymentCoveragebodyobrigatório
parameters of a payment coverage request
PSU-IP-Addressheaderstring
IP address used by the PSU's terminal when connecting to the TPP
PSU-IP-Portheaderstring
IP port used by the PSU's terminal when connecting to the TPP
PSU-HTTP-Methodheaderstring
Http method for the most relevant PSU's terminal request to the TTP
PSU-Dateheaderstring
Timestamp of the most relevant PSU's terminal request to the TTP
PSU-GEO-Locationheaderstring
Geographical location of the PSU as provided by the PSU mobile terminal if any to the TPP
PSU-User-Agentheaderstring
"User-Agent" header field sent by the PSU terminal when connecting to the TPP
PSU-Refererheaderstring
"Referer" header field sent by the PSU terminal when connecting to the TPP. Notice that an initial typo in RFC 1945 specifies that "referer" (incorrect spelling) is to be used. The correct spelling "referrer" can be used but might not be understood.
PSU-Acceptheaderstring
"Accept" header field sent by the PSU terminal when connecting to the TPP
PSU-Accept-Charsetheaderstring
"Accept-Charset" header field sent by the PSU terminal when connecting to the TPP
PSU-Accept-Encodingheaderstring
"Accept-Encoding" header field sent by the PSU terminal when connecting to the TPP
PSU-Accept-Languageheaderstring
"Accept-Language" header field sent by the PSU terminal when connecting to the TPP
PSU-Device-IDheaderstring
UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of installation identification this ID need to be unaltered until removal from device.
Digestheaderstring
Digest of the body
Signatureheaderstring
http-signature of the request The keyId must specify the way to get the relevant qualified certificate. It is requested that this identifier is an URL aiming to provide the relevant Qualified Certificate.
X-Request-IDheaderstringobrigatório
Correlation header to be set in a request and retrieved in the relevant response
Restrições: maxLength: 70
X-JWS-Signatureheaderstring
JSON WEB signature of the request
Idempotency-Keyheaderstringobrigatório
Key provided by the API client to ensure idempotency in case of retry of a given request

Corpo da requisição

Resourcesobject

PaymentCoverageRequestResource

Payment coverage request structure. The request must rely either on a cash account or a payment card. The [instructedAmount] property is the payment account on wihich the request is processed. This amount must be positive. Amounts must always be set as positive values.

Campos (4)

paymentCoverageRequestIdstringobrigatório
Identification of the payment Coverage Request
Restrições: maxLength: 35
payeestring
The merchant where the card is accepted as information to the PSU.
Restrições: maxLength: 70
instructedAmountAmountType
Structure aiming to embed the amount and the currency to be used.
Esquema: AmountType
Structure aiming to embed the amount and the currency to be used.
- amountnumber (float)obrigatório
  ISO20022: Amount of money to be moved between the debtor and creditor, before deduction of charges, expressed in the currency as ordered by the initiating party.
  ISO20022: Amount of money to be moved between the debtor and creditor, before deduction of charges, expressed in the currency as ordered by the initiating party.
  Restrições: pattern: `^\-{0,1}[0-9]{1,13}(\.[0-9]{0,5}){0,1}$`
- currencyCurrencyCodeISO 4217obrigatório
  Specifies the currency of the amount or of the account.
  Esquema: CurrencyCode
  Specifies the currency of the amount or of the account. A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds".
  Tipo: string
  Restrições: pattern: `^[A-Z]{3,3}$`

accountIdAccountIdentificationobrigatório

Unique and unambiguous identification for the account between the account owner and the account servicer.

Esquema: AccountIdentification

Unique and unambiguous identification for the account between the account owner and the account servicer. Card accounts must provide the identification of the card through the "other" substructure by giving, for instance, the masked PAN (MPAN). The currency used for the account, when needed, can be specified through the [currency] field.

workspacestring
Workspace to which the account is linked.
Workspace to which the account is linked. This workspace might be specified by the AISP when forwarding the consent on accounts. If not provided, the default workspace is computed from the authentication that was used for getting the OAuth2 Access Token.
Restrições: maxLength: 32
ibanstring
ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer.
ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer.

Further specifications of the format and content of the IBAN can be found in the standard ISO 13616 "Banking and related financial services - International Bank Account Number (IBAN)" version 1997-10-01, or later revisions.
Restrições: pattern: `^[A-Z]{2,2}[0-9]{2,2}[a-zA-Z0-9]{1,30}$`

otherGenericIdentification

ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer.

Esquema: GenericIdentification

ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer. API: The ASPSP will document which account reference type it will support.

identificationstringobrigatório
API: Identifier
API: Identifier
Restrições: maxLength: 70

schemeNamestringobrigatório

Name of the identification scheme.

Name of the identification scheme. Possible values for the scheme name, partially based on ISO20022 external code list, are the following:

Code	Name	Description
BANK	BankPartyIdentification	Unique and unambiguous assignment made by a specific bank or similar financial institution to identify a relationship as defined between the bank and its client.
BBAN	BBANIdentifier	Basic Bank Account Number (BBAN) - identifier used nationally by financial institutions, ie, in individual countries, generally as part of a National Account Numbering Scheme(s), to uniquely identify the account of a customer.
COID	CountryIdentificationCode) : Country authority given organisation identification (e.g., corporate registration number)
SREN	SIREN	The SIREN number is a 9 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation in France.
SRET	SIRET	The SIRET number is a 14 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation unit in France. It consists of the SIREN number, followed by a five digit classification number, to identify the local geographical unit of that entity.
NIDN	NationalIdentityNumber	Number assigned by an authority to identify the national identity number of a person.
Other values are also permitted, for instance:
Code	Name	Description
----	----	-----------
OAUT	OAUTH2	OAUTH2 access token that is owned by the PISP being also an AISP and that can be used in order to identify the PSU
CPAN	CardPan	Card PAN
MPAN	MaskedPan	Card PAN where some digits were replaced for security reason
TPAN	TokenizedPan	Token which was provided by a Token Service Provider (TSP) in order to obfuscate a real card PAN. The TSP must be identified in the issuer field
TBAN	TokenizedIBAN	Token which was provided by a Token Service Provider (TSP) in order to obfuscate an IBAN. The TSP must be identified in the issuer field
Each implementation of the STET PSD2 API must specify in its own documentation which schemes can actually been used

Restrições: maxLength: 70

issuerstring
ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties
ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties
Restrições: maxLength: 35

currencyCurrencyCodeISO 4217
Specifies the currency of the amount or of the account.
Esquema: CurrencyCode
Specifies the currency of the amount or of the account. A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds".
Tipo: string
Restrições: pattern: `^[A-Z]{3,3}$`

Respostas

200

payment coverage request

Halobject

HalPaymentCoverageReport

HYPERMEDIA structure used for returning the payment coverage report to the CBPII

Campos (3)

requestPaymentCoverageRequestResourceobrigatório
Payment coverage request structure.
Esquema: PaymentCoverageRequestResource
Campos detalhados mais acima: request-body
resultbooleanobrigatório
Result of the coverage check :
Result of the coverage check :
- true: the payment can be covered
- false: the payment cannot be covered
_linksPaymentCoverageReportLinksobrigatório
links that can be used for further navigation to post another coverage request.
Esquema: PaymentCoverageReportLinks
links that can be used for further navigation to post another coverage request.
- selfGenericLinkobrigatório
  hypertext reference
  Esquema: GenericLink
  hypertext reference
  hrefstringobrigatório
  URI to be used. HREF stands for Hypertext REFerence.
  Restrições: maxLength: 2000
  templatedboolean
  This field must be set with "true" when [href] is an URI template, i.e. with parameters that will be set by the client afterwards. Parameter fields must be included by the API server according to RFC6570.
  This field must be set with "true" when [href] is an URI template, i.e. with parameters that will be set by the client afterwards. Parameter fields must be included by the API server according to RFC6570. Otherwise, this property must be absent or set to false default value: false

400

Invalid status value

Technicalobject

ErrorModel

Generic error report structure

Campos (6)

timestampstring (date-time)ISO 8601
current timestamp
statusinteger (int32)obrigatório
HTTP error code
errorstring
HTTP error text
Restrições: maxLength: 140
messagestringobrigatório
HTTP textual reason phrase
Restrições: maxLength: 140
pathstring
Relevant path that was used
Restrições: maxLength: 140
detailsarray<ErrorDetail>
list of detailed errors that were encountered
Item: ErrorDetail
detailed error description
- locationstringenumeração · 2
  Location of the erroneous parameter when not in request body
  Código
  header
  query
- namestring
  Name of the erroneous parameter when not in request body
- pathstring
  JsonPath of the erroneous request body property
- erroneousValuestring
  Erroneous parameter value
- messagestring
  Relevant message for the erroneous parameter
- expectedPatternstring
  Expected pattern, if any, that the erroneous parameter does not match with
- expectedValueRangeobject
  Expected value range, if any, that the erroneous parameter does not match with
  minValueinteger
  maxValueinteger
- expectedValueCountobject
  Expected value count, in the case of an array item, that the erroneous parameter does not match with
  minValueinteger
  maxValueinteger
- expectedEnumerationarray<string>
  Expected enumeration, if any, that the erroneous parameter do not match with

Código
`header`
`query`

Esquemas usados por este endpoint

Todas as estruturas referenciadas por esta operação, listadas uma única vez. As referências cruzadas levam a esta mesma página.

ISO20022object§ 4.1.1 · PDF p. 2

AccountIdentification

Campos (4)

Campos detalhados mais acima: request-body.accountId

ISO20022object§ 4.1.2 · PDF p. 2

AmountType

Structure aiming to embed the amount and the currency to be used.

Campos (2)

Campos detalhados mais acima: request-body.instructedAmount

ISO20022string

CurrencyCode

Specifies the currency of the amount or of the account. A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds".

Technicalobject

ErrorDetail

detailed error description

Campos (9)

Campos detalhados mais acima: responses.400.details

Technicalobject

ErrorModel

Generic error report structure

Campos (6)

Campos detalhados mais acima: responses.400

ISO20022object§ 4.1.6 · PDF p. 14

GenericIdentification

ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer. API: The ASPSP will document which account reference type it will support.

Campos (3)

Campos detalhados mais acima: request-body.accountId.other

Halobject§ 4.1.7 · PDF p. 15

GenericLink

hypertext reference

Campos (2)

Campos detalhados mais acima: responses.200._links.self

Halobject

HalPaymentCoverageReport

HYPERMEDIA structure used for returning the payment coverage report to the CBPII

Campos (3)

Campos detalhados mais acima: responses.200

Halobject

PaymentCoverageReportLinks

links that can be used for further navigation to post another coverage request.

Campos (1)

Campos detalhados mais acima: responses.200._links

Resourcesobject

PaymentCoverageRequestResource

Campos (4)

Campos detalhados mais acima: request-body

Cabeçalhos

Campos

post/v1/funds-confirmations

curl -X POST 'https://api.aspsp.example/v1/funds-confirmations' \
  -H 'Authorization: Bearer {access_token}' \
  -H 'X-Request-ID: a1b2c3d4-e5f6-4a3b-8c2d-1e2f3a4b5c6d' \
  -H 'Idempotency-Key: {Idempotency-Key}' \
  -H 'Content-Type: application/json' \
  -d '{
  "paymentCoverageRequestId": "MyCoverage123456",
  "accountId": {}
}'

curl -X POST 'https://api.aspsp.example/v1/funds-confirmations' \
  -H 'Authorization: Bearer {access_token}' \
  -H 'X-Request-ID: a1b2c3d4-e5f6-4a3b-8c2d-1e2f3a4b5c6d' \
  -H 'Idempotency-Key: {Idempotency-Key}' \
  -H 'Content-Type: application/json' \
  -d '{
  "paymentCoverageRequestId": "MyCoverage123456",
  "instructedAmount": {
    "amount": 12345,
    "currency": "EUR"
  },
  "accountId": {
    "iban": "YY13RDHN98392489481620896668799742"
  }
}'

curl -X POST 'https://api.aspsp.example/v1/funds-confirmations' \
  -H 'Authorization: Bearer {access_token}' \
  -H 'PSU-IP-Address: 192.0.2.1' \
  -H 'PSU-IP-Port: 443' \
  -H 'PSU-HTTP-Method: GET' \
  -H 'PSU-Date: Tue, 03 Oct 2022 10:15:30 GMT' \
  -H 'PSU-GEO-Location: {PSU-GEO-Location}' \
  -H 'PSU-User-Agent: {PSU-User-Agent}' \
  -H 'PSU-Referer: {PSU-Referer}' \
  -H 'PSU-Accept: {PSU-Accept}' \
  -H 'PSU-Accept-Charset: {PSU-Accept-Charset}' \
  -H 'PSU-Accept-Encoding: {PSU-Accept-Encoding}' \
  -H 'PSU-Accept-Language: {PSU-Accept-Language}' \
  -H 'PSU-Device-ID: {PSU-Device-ID}' \
  -H 'Digest: SHA-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=' \
  -H 'Signature: keyId="...",algorithm="rsa-sha256",headers="(request-target) date digest",signature="..."' \
  -H 'X-Request-ID: a1b2c3d4-e5f6-4a3b-8c2d-1e2f3a4b5c6d' \
  -H 'X-JWS-Signature: {X-JWS-Signature}' \
  -H 'Idempotency-Key: {Idempotency-Key}' \
  -H 'Content-Type: application/json' \
  -d '{
  "paymentCoverageRequestId": "MyCoverage123456",
  "accountId": {}
}'

curl -X POST 'https://api.aspsp.example/v1/funds-confirmations' \
  -H 'Authorization: Bearer {access_token}' \
  -H 'PSU-IP-Address: 192.0.2.1' \
  -H 'PSU-IP-Port: 443' \
  -H 'PSU-HTTP-Method: GET' \
  -H 'PSU-Date: Tue, 03 Oct 2022 10:15:30 GMT' \
  -H 'PSU-GEO-Location: {PSU-GEO-Location}' \
  -H 'PSU-User-Agent: {PSU-User-Agent}' \
  -H 'PSU-Referer: {PSU-Referer}' \
  -H 'PSU-Accept: {PSU-Accept}' \
  -H 'PSU-Accept-Charset: {PSU-Accept-Charset}' \
  -H 'PSU-Accept-Encoding: {PSU-Accept-Encoding}' \
  -H 'PSU-Accept-Language: {PSU-Accept-Language}' \
  -H 'PSU-Device-ID: {PSU-Device-ID}' \
  -H 'Digest: SHA-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=' \
  -H 'Signature: keyId="...",algorithm="rsa-sha256",headers="(request-target) date digest",signature="..."' \
  -H 'X-Request-ID: a1b2c3d4-e5f6-4a3b-8c2d-1e2f3a4b5c6d' \
  -H 'X-JWS-Signature: {X-JWS-Signature}' \
  -H 'Idempotency-Key: {Idempotency-Key}' \
  -H 'Content-Type: application/json' \
  -d '{
  "paymentCoverageRequestId": "MyCoverage123456",
  "instructedAmount": {
    "amount": 12345,
    "currency": "EUR"
  },
  "accountId": {
    "iban": "YY13RDHN98392489481620896668799742"
  }
}'

Resposta

payment coverage request

{
  "request": {
    "paymentCoverageRequestId": "MyCoverage123456",
    "instructedAmount": {
      "amount": 12345,
      "currency": "EUR"
    },
    "accountId": {
      "iban": "YY13RDHN98392489481620896668799742"
    }
  },
  "result": true,
  "_links": {
    "self": {
      "href": "v1/funds-confirmations"
    }
  }
}

{
  "request": {
    "paymentCoverageRequestId": "MyCoverage123456",
    "accountId": {}
  },
  "result": true,
  "_links": {
    "self": {
      "href": "v1/funds-confirmations"
    }
  }
}

Invalid status value

{
  "timestamp": "2021-03-17T16:47:00.187248+01:00",
  "status": 400,
  "error": "Bad Request",
  "message": "This Authentication Approach is not available",
  "details": [
    {
      "path": "$.supplementaryData.acceptedAuthenticationApproach",
      "erroneousValue": "EMBEDDED",
      "expectedEnumeration": [
        "REDIRECT",
        "DECOUPLED"
      ]
    }
  ]
}

Unauthorized, authentication failure.

{
  "timestamp": "2021-03-17T16:47:00.187248+01:00",
  "status": 401,
  "error": "Unauthorized",
  "message": "Authentication failed; the access token is missing, invalid or expired."
}

Forbidden, authentication successful but access to resource is not allowed.

{
  "timestamp": "2021-03-17T16:47:00.187248+01:00",
  "status": 403,
  "error": "Forbidden",
  "message": "Authentication succeeded but access to the requested resource is not allowed."
}

Method Not Allowed.

{
  "timestamp": "2021-03-17T16:47:00.187248+01:00",
  "status": 405,
  "error": "Method Not Allowed",
  "message": "The HTTP method is not supported for this resource."
}

Not Acceptable.

{
  "timestamp": "2021-03-17T16:47:00.187248+01:00",
  "status": 406,
  "error": "Not Acceptable",
  "message": "The requested representation is not available for this resource."
}

Request Timeout.

{
  "timestamp": "2021-03-17T16:47:00.187248+01:00",
  "status": 408,
  "error": "Request Timeout",
  "message": "The server timed out waiting for the request."
}

Too many requests.

{
  "timestamp": "2021-03-17T16:47:00.187248+01:00",
  "status": 429,
  "error": "Too Many Requests",
  "message": "The rate limit has been exceeded. Please retry later."
}

Internal server error.

{
  "timestamp": "2021-03-17T16:47:00.187248+01:00",
  "status": 500,
  "error": "Internal Server Error",
  "message": "An unexpected error occurred while processing the request."
}

Service unavailable.

{
  "timestamp": "2021-03-17T16:47:00.187248+01:00",
  "status": 503,
  "error": "Service Unavailable",
  "message": "The service is temporarily unavailable. Please retry later."
}