--- title: "GET /accounts/{accountResourceId}/overdrafts" canonical: "https://openfinanceguide.com/en/stet/1.6.3/endpoints/aisp/accounts-overdrafts-get" edition: "STET PSD2 API 1.6.3.1" source: "https://openfinanceguide.com/docs/stet/1.6.3/pdf/api-dsp2-stet-v1.6.3.2-openapi.yaml" pdf: "https://openfinanceguide.com/docs/stet/1.6.3/pdf/api-dsp2-stet-v1.6.3.1-part-2-functional-model.pdf" section: "4.7" pdf_pages: "46" language: "en" normative: "The normative text is the English PDF and OpenAPI file published by STET. This Markdown reproduces it for reading; where they differ, the PDF prevails." license: "CC BY 3.0 FR (https://creativecommons.org/licenses/by/3.0/fr/), STET. Converted to Markdown by Open Finance Guide." --- # GET /accounts/{accountResourceId}/overdrafts Retrieval of an account overdraft (AISP) Operation: `accountsOverdraftsGet` · Tags: AISP · Scopes: `aisp` · Source: [§ 4.7 Retrieval of an account overdraft (AISP), PDF p. 46](https://openfinanceguide.com/docs/stet/1.6.3/pdf/api-dsp2-stet-v1.6.3.1-part-2-functional-model.pdf#page=46) ### Description This call returns the overdrafts that can be used for a given PSU account that is specified by the AISP through an account resource identification. The request may use some filter parameter in order to restrict the query ### Prerequisites - The TPP was registered by the Registration Authority for the AISP role - The TPP and the PSU have a contract that was enrolled by the ASPSP - At this step, the ASPSP has delivered an OAUTH2 "Authorization Code" or "Resource Owner Password" access token to the TPP (cf. paragraph 3.4.2). - The TPP and the ASPSP have successfully processed a mutual check and authentication - The TPP has presented its OAUTH2 "Authorization Code" or "Resource Owner Password" access token which allows the ASPSP to identify the relevant PSU and retrieve the linked PSU context (cf. paragraph 3.4.2) is any. - The ASPSP takes into account the access token that establishes the link between the PSU and the AISP. - The TPP has previously retrieved the list of available accounts for the PSU ### Business flow The AISP requests the ASPSP on one of the PSU's accounts. The ASPSP answers by the overdraft that can be applied. ## Parameters - `Authorization`, in header, `string`, required — Access token to be passed as a header - `accountResourceId`, in path, `string`, required — Identification of account resource to fetch Constraints: pattern `^([a-zA-Z0-9_ /\-?:\()\.,']{1,100})$`. - `PSU-IP-Address`, in header, `string` — IP address used by the PSU's terminal when connecting to the TPP - `PSU-IP-Port`, in header, `string` — IP port used by the PSU's terminal when connecting to the TPP - `PSU-HTTP-Method`, in header, `string` — Http method for the most relevant PSU's terminal request to the TTP - `PSU-Date`, in header, `string` — Timestamp of the most relevant PSU's terminal request to the TTP - `PSU-GEO-Location`, in header, `string` — Geographical location of the PSU as provided by the PSU mobile terminal if any to the TPP - `PSU-User-Agent`, in header, `string` — "User-Agent" header field sent by the PSU terminal when connecting to the TPP - `PSU-Referer`, in header, `string` — "Referer" header field sent by the PSU terminal when connecting to the TPP. Notice that an initial typo in RFC 1945 specifies that "referer" (incorrect spelling) is to be used. The correct spelling "referrer" can be used but might not be understood. - `PSU-Accept`, in header, `string` — "Accept" header field sent by the PSU terminal when connecting to the TPP - `PSU-Accept-Charset`, in header, `string` — "Accept-Charset" header field sent by the PSU terminal when connecting to the TPP - `PSU-Accept-Encoding`, in header, `string` — "Accept-Encoding" header field sent by the PSU terminal when connecting to the TPP - `PSU-Accept-Language`, in header, `string` — "Accept-Language" header field sent by the PSU terminal when connecting to the TPP - `PSU-Device-ID`, in header, `string` — UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of installation identification this ID need to be unaltered until removal from device. - `Digest`, in header, `string` — Digest of the body - `Signature`, in header, `string` — [http-signature of the request](https://datatracker.ietf.org/doc/draft-cavage-http-signatures/) The keyId must specify the way to get the relevant qualified certificate. It is requested that this identifier is an URL aiming to provide the relevant Qualified Certificate. - `X-Request-ID`, in header, `string`, required — Correlation header to be set in a request and retrieved in the relevant response Constraints: maxLength 70. - `workspace`, in query, `string` — Workspace to be used for processing an AISP request. If not provided, the default workspace is computed from the authentication that was used for getting the OAuth2 Access Token. Constraints: maxLength 32. - `X-JWS-Signature`, in header, `string` — [JSON WEB signature of the request](https://www.openbankingeurope.eu/media/2095/obe-json-web-signature-profile-for-open-banking.pdf) ## Responses ### 200 Overdraft response Body: [`HalOverdrafts`](#haloverdrafts) Headers: - `X-Request-ID`, `string` — Correlation header to be set in a request and retrieved in the relevant response - `Warning`, `string` — Warning header. This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message. ### 204 No content. Headers: - `X-Request-ID`, `string` — Correlation header to be set in a request and retrieved in the relevant response - `Warning`, `string` — Warning header. This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message. ### 400 Invalid status value Body: [`ErrorModel`](#errormodel) Headers: - `X-Request-ID`, `string` — Correlation header to be set in a request and retrieved in the relevant response - `Warning`, `string` — Warning header. This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message. ### 401 Unauthorized, authentication failure. Body: [`ErrorModel`](#errormodel) Headers: - `X-Request-ID`, `string` — Correlation header to be set in a request and retrieved in the relevant response - `Warning`, `string` — Warning header. This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message. ### 403 Forbidden, authentication successful but access to resource is not allowed. Body: [`ErrorModel`](#errormodel) Headers: - `X-Request-ID`, `string` — Correlation header to be set in a request and retrieved in the relevant response - `Warning`, `string` — Warning header. This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message. ### 404 Not found, no request available. Body: [`ErrorModel`](#errormodel) Headers: - `X-Request-ID`, `string` — Correlation header to be set in a request and retrieved in the relevant response - `Warning`, `string` — Warning header. This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message. ### 405 Method Not Allowed. Body: [`ErrorModel`](#errormodel) Headers: - `X-Request-ID`, `string` — Correlation header to be set in a request and retrieved in the relevant response - `Warning`, `string` — Warning header. This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message. ### 406 Not Acceptable. Body: [`ErrorModel`](#errormodel) Headers: - `X-Request-ID`, `string` — Correlation header to be set in a request and retrieved in the relevant response - `Warning`, `string` — Warning header. This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message. ### 408 Request Timeout. Body: [`ErrorModel`](#errormodel) Headers: - `X-Request-ID`, `string` — Correlation header to be set in a request and retrieved in the relevant response - `Warning`, `string` — Warning header. This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message. ### 429 Too many requests. Body: [`ErrorModel`](#errormodel) Headers: - `X-Request-ID`, `string` — Correlation header to be set in a request and retrieved in the relevant response - `Warning`, `string` — Warning header. This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message. ### 500 Internal server error. Body: [`ErrorModel`](#errormodel) Headers: - `X-Request-ID`, `string` — Correlation header to be set in a request and retrieved in the relevant response ### 503 Service unavailable. Body: [`ErrorModel`](#errormodel) Headers: - `X-Request-ID`, `string` — Correlation header to be set in a request and retrieved in the relevant response ## Example Built from the specification: every documented header and field. ```bash curl -X GET 'https://api.aspsp.example/v1/accounts/{accountResourceId}/overdrafts' \ -H 'Authorization: Bearer {access_token}' \ -H 'PSU-IP-Address: 192.0.2.1' \ -H 'PSU-IP-Port: 443' \ -H 'PSU-HTTP-Method: GET' \ -H 'PSU-Date: Tue, 03 Oct 2022 10:15:30 GMT' \ -H 'PSU-GEO-Location: {PSU-GEO-Location}' \ -H 'PSU-User-Agent: {PSU-User-Agent}' \ -H 'PSU-Referer: {PSU-Referer}' \ -H 'PSU-Accept: {PSU-Accept}' \ -H 'PSU-Accept-Charset: {PSU-Accept-Charset}' \ -H 'PSU-Accept-Encoding: {PSU-Accept-Encoding}' \ -H 'PSU-Accept-Language: {PSU-Accept-Language}' \ -H 'PSU-Device-ID: {PSU-Device-ID}' \ -H 'Digest: SHA-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=' \ -H 'Signature: keyId="...",algorithm="rsa-sha256",headers="(request-target) date digest",signature="..."' \ -H 'X-Request-ID: a1b2c3d4-e5f6-4a3b-8c2d-1e2f3a4b5c6d' \ -H 'X-JWS-Signature: {X-JWS-Signature}' ``` Response 200: ```json { "overdrafts": { "allowedAmount": { "amount": 30000, "currency": "EUR" } }, "_links": { "self": { "href": "/v1/accounts/Alias1/overdrafts" }, "parent-list": { "href": "/v1/accounts" }, "balances": { "href": "/v1/accounts/Alias1/balances" }, "transactions": { "href": "/v1/accounts/Alias1/transactions" } } } ``` ## Schemas Every schema this endpoint uses, each once; fields name the schema they hold. ### AmountType Type: `object` · Kind: ISO20022 · Source: [§ 4.1.2, PDF p. 2](https://openfinanceguide.com/docs/stet/1.6.3/pdf/api-dsp2-stet-v1.6.3.1-part-2-functional-model.pdf#page=2) Structure aiming to embed the amount and the currency to be used. Fields: - `amount`, `number (float)`, required — ISO20022: Amount of money to be moved between the debtor and creditor, before deduction of charges, expressed in the currency as ordered by the initiating party. Constraints: pattern `^\-{0,1}[0-9]{1,13}(\.[0-9]{0,5}){0,1}$`. - `currency`, [`CurrencyCode`](#currencycode), required ### CurrencyCode Type: `string` · Kind: ISO20022 · Constraints: pattern `^[A-Z]{3,3}$` Specifies the currency of the amount or of the account. A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". ### ErrorDetail Type: `object` · Kind: Technical detailed error description Fields: - `location`, `string` — Location of the erroneous parameter when not in request body Values: - `header` - `query` - `name`, `string` — Name of the erroneous parameter when not in request body - `path`, `string` — JsonPath of the erroneous request body property - `erroneousValue`, `string` — Erroneous parameter value - `message`, `string` — Relevant message for the erroneous parameter - `expectedPattern`, `string` — Expected pattern, if any, that the erroneous parameter does not match with - `expectedValueRange`, `object` — Expected value range, if any, that the erroneous parameter does not match with - `minValue`, `integer` - `maxValue`, `integer` - `expectedValueCount`, `object` — Expected value count, in the case of an array item, that the erroneous parameter does not match with - `minValue`, `integer` - `maxValue`, `integer` - `expectedEnumeration`, array of `string` — Expected enumeration, if any, that the erroneous parameter do not match with ### ErrorModel Type: `object` · Kind: Technical Generic error report structure Fields: - `timestamp`, `string (date-time)` — current timestamp - `status`, `integer (int32)`, required — HTTP error code - `error`, `string` — HTTP error text Constraints: maxLength 140. - `message`, `string`, required — HTTP textual reason phrase Constraints: maxLength 140. - `path`, `string` — Relevant path that was used Constraints: maxLength 140. - `details`, array of [`ErrorDetail`](#errordetail) — list of detailed errors that were encountered ### GenericLink Type: `object` · Kind: Hal · Source: [§ 4.1.7, PDF p. 15](https://openfinanceguide.com/docs/stet/1.6.3/pdf/api-dsp2-stet-v1.6.3.1-part-2-functional-model.pdf#page=15) hypertext reference Fields: - `href`, `string`, required — URI to be used. HREF stands for Hypertext REFerence. Constraints: maxLength 2000. - `templated`, `boolean` — This field must be set with "true" when [href] is an URI template, i.e. with parameters that will be set by the client afterwards. Parameter fields must be included by the API server according to RFC6570. Otherwise, this property must be absent or set to false default value: false ### HalOverdrafts Type: `object` · Kind: Hal HYPERMEDIA structure used for returning the list of the overdrafts that can apply on a given account to the AISP Fields: - `overdrafts`, [`Overdraft`](#overdraft), required - `_links`, [`OverdraftsLinks`](#overdraftslinks), required ### Overdraft Type: `object` · Kind: ISO20022 ISO20022: Overdraft characteristics API: Amounts must always be set as positive values. Fields: - `allowedAmount`, [`AmountType`](#amounttype), required ### OverdraftsLinks Type: `object` · Kind: Hal links that can be used for further navigation when browsing overdrafts Information at one account level | Link | Description | | ---- | ----------- | | self | link to the overdrafts of a given account | | parent-list | link to the list of all available accounts | | owners | link to the owners identities for a given account | | balances | link to the balances of a given account | | transactions | link to the transactions of a given account | Fields: - `self`, [`GenericLink`](#genericlink), required - `parent-list`, [`GenericLink`](#genericlink) - `owners`, [`GenericLink`](#genericlink) - `balances`, [`GenericLink`](#genericlink) - `transactions`, [`GenericLink`](#genericlink)