openapi: 3.2.0
info:
  title: Account and Transaction API Specification Account Access API
  description: OpenAPI for Account and Transaction API Specification
  termsOfService: https://www.openbanking.org.uk/terms
  contact:
    name: Service Desk
    email: ServiceDesk@openbanking.org.uk
  license:
    name: open-licence
    url: https://www.openbanking.org.uk/open-licence
  version: v3.1.0
servers:
- url: https://api.hoaresbank.co.uk/open-banking/v3.1/aisp
  description: Base URL declared by the provider in apis.yml (roadmap#122).
tags:
- name: Account Access
paths:
  /account-access-consents:
    post:
      tags:
      - Account Access
      summary: Create Account Access Consents
      operationId: CreateAccountAccessConsents
      parameters:
      - $ref: '#/components/parameters/x-fapi-financial-id-Param'
      - $ref: '#/components/parameters/x-fapi-customer-last-logged-time-Param'
      - $ref: '#/components/parameters/x-fapi-customer-ip-address-Param'
      - $ref: '#/components/parameters/x-fapi-interaction-id-Param'
      - $ref: '#/components/parameters/AuthorizationParam'
      - $ref: '#/components/parameters/x-customer-user-agent-Param'
      responses:
        '201':
          $ref: '#/components/responses/201AccountAccessConsentsCreated'
        '400':
          $ref: '#/components/responses/400ErrorResponse'
        '401':
          $ref: '#/components/responses/401ErrorResponse'
        '403':
          $ref: '#/components/responses/403ErrorResponse'
        '404':
          $ref: '#/components/responses/404ErrorResponse'
        '405':
          $ref: '#/components/responses/405ErrorResponse'
        '406':
          $ref: '#/components/responses/406ErrorResponse'
        '415':
          $ref: '#/components/responses/415ErrorResponse'
        '429':
          $ref: '#/components/responses/429ErrorResponse'
        '500':
          $ref: '#/components/responses/500ErrorResponse'
      security:
      - TPPOAuth2Security:
        - accounts
      requestBody:
        $ref: '#/components/requestBodies/OBReadConsent1Param'
  /account-access-consents/{ConsentId}:
    get:
      tags:
      - Account Access
      summary: Get Account Access Consents
      operationId: GetAccountAccessConsentsConsentId
      parameters:
      - $ref: '#/components/parameters/ConsentId'
      - $ref: '#/components/parameters/x-fapi-financial-id-Param'
      - $ref: '#/components/parameters/x-fapi-customer-last-logged-time-Param'
      - $ref: '#/components/parameters/x-fapi-customer-ip-address-Param'
      - $ref: '#/components/parameters/x-fapi-interaction-id-Param'
      - $ref: '#/components/parameters/AuthorizationParam'
      - $ref: '#/components/parameters/x-customer-user-agent-Param'
      responses:
        '200':
          $ref: '#/components/responses/200AccountAccessConsentsConsentIdRead'
        '400':
          $ref: '#/components/responses/400ErrorResponse'
        '401':
          $ref: '#/components/responses/401ErrorResponse'
        '403':
          $ref: '#/components/responses/403ErrorResponse'
        '404':
          $ref: '#/components/responses/404ErrorResponse'
        '405':
          $ref: '#/components/responses/405ErrorResponse'
        '406':
          $ref: '#/components/responses/406ErrorResponse'
        '429':
          $ref: '#/components/responses/429ErrorResponse'
        '500':
          $ref: '#/components/responses/500ErrorResponse'
      security:
      - TPPOAuth2Security:
        - accounts
    delete:
      tags:
      - Account Access
      summary: Delete Account Access Consents
      operationId: DeleteAccountAccessConsentsConsentId
      parameters:
      - $ref: '#/components/parameters/ConsentId'
      - $ref: '#/components/parameters/x-fapi-financial-id-Param'
      - $ref: '#/components/parameters/x-fapi-customer-last-logged-time-Param'
      - $ref: '#/components/parameters/x-fapi-customer-ip-address-Param'
      - $ref: '#/components/parameters/x-fapi-interaction-id-Param'
      - $ref: '#/components/parameters/AuthorizationParam'
      - $ref: '#/components/parameters/x-customer-user-agent-Param'
      responses:
        '204':
          $ref: '#/components/responses/204AccountAccessConsentsConsentIdDeleted'
        '400':
          $ref: '#/components/responses/400ErrorResponse'
        '401':
          $ref: '#/components/responses/401ErrorResponse'
        '403':
          $ref: '#/components/responses/403ErrorResponse'
        '404':
          $ref: '#/components/responses/404ErrorResponse'
        '405':
          $ref: '#/components/responses/405ErrorResponse'
        '406':
          $ref: '#/components/responses/406ErrorResponse'
        '429':
          $ref: '#/components/responses/429ErrorResponse'
        '500':
          $ref: '#/components/responses/500ErrorResponse'
      security:
      - TPPOAuth2Security:
        - accounts
components:
  schemas:
    Links:
      type: object
      description: Links relevant to the payload
      properties:
        Self:
          type: string
          format: uri
        First:
          type: string
          format: uri
        Prev:
          type: string
          format: uri
        Next:
          type: string
          format: uri
        Last:
          type: string
          format: uri
      additionalProperties: false
      required:
      - Self
    Meta:
      title: MetaData
      type: object
      description: Meta Data relevant to the payload
      properties:
        TotalPages:
          type: integer
          format: int32
        FirstAvailableDateTime:
          $ref: '#/components/schemas/ISODateTime'
        LastAvailableDateTime:
          $ref: '#/components/schemas/ISODateTime'
      additionalProperties: false
    OBReadConsent1:
      type: object
      properties:
        Data:
          $ref: '#/components/schemas/OBReadData1'
        Risk:
          $ref: '#/components/schemas/OBRisk2'
      required:
      - Data
      - Risk
      additionalProperties: false
    OBError1:
      type: object
      properties:
        ErrorCode:
          description: Low level textual error code, e.g., UK.OBIE.Field.Missing
          type: string
          minLength: 1
          maxLength: 128
        Message:
          description: 'A description of the error that occurred. e.g., ''A mandatory field isn''t supplied'' or ''RequestedExecutionDateTime must be in future''

            OBIE doesn''t standardise this field'
          type: string
          minLength: 1
          maxLength: 500
        Path:
          description: Recommended but optional reference to the JSON Path of the field with error, e.g., Data.Initiation.InstructedAmount.Currency
          type: string
          minLength: 1
          maxLength: 500
        Url:
          description: URL to help remediate the problem, or provide more information, or to API Reference, or help etc
          type: string
      required:
      - ErrorCode
      - Message
      additionalProperties: false
      minProperties: 1
    OBErrorResponse1:
      description: An array of detail error codes, and messages, and URLs to documentation to help remediation.
      type: object
      properties:
        Code:
          description: High level textual error code, to help categorize the errors.
          type: string
          minLength: 1
          maxLength: 40
        Id:
          description: A unique reference for the error instance, for audit purposes, in case of unknown/unclassified errors.
          type: string
          minLength: 1
          maxLength: 40
        Message:
          description: Brief Error message, e.g., 'There is something wrong with the request parameters provided'
          type: string
          minLength: 1
          maxLength: 500
        Errors:
          items:
            $ref: '#/components/schemas/OBError1'
          type: array
          minItems: 1
      required:
      - Code
      - Message
      - Errors
      additionalProperties: false
    ISODateTime:
      description: "All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
      type: string
      format: date-time
    OBExternalPermissions1Code:
      description: Specifies the Open Banking account access data types. This is a list of the data clusters being consented by the PSU, and requested for authorisation with the ASPSP.
      type: string
      enum:
      - ReadAccountsBasic
      - ReadAccountsDetail
      - ReadBalances
      - ReadBeneficiariesBasic
      - ReadBeneficiariesDetail
      - ReadDirectDebits
      - ReadOffers
      - ReadPAN
      - ReadParty
      - ReadPartyPSU
      - ReadProducts
      - ReadScheduledPaymentsBasic
      - ReadScheduledPaymentsDetail
      - ReadStandingOrdersBasic
      - ReadStandingOrdersDetail
      - ReadStatementsBasic
      - ReadStatementsDetail
      - ReadTransactionsBasic
      - ReadTransactionsCredits
      - ReadTransactionsDebits
      - ReadTransactionsDetail
    OBReadConsentResponse1:
      type: object
      properties:
        Data:
          type: object
          properties:
            ConsentId:
              description: Unique identification as assigned to identify the account access consent resource.
              type: string
              minLength: 1
              maxLength: 128
            CreationDateTime:
              description: "Date and time at which the resource was created.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
              type: string
              format: date-time
            Status:
              $ref: '#/components/schemas/OBExternalRequestStatus1Code'
            StatusUpdateDateTime:
              description: "Date and time at which the resource status was updated.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
              type: string
              format: date-time
            Permissions:
              items:
                $ref: '#/components/schemas/OBExternalPermissions1Code'
              type: array
              description: Specifies the Open Banking account access data types. This is a list of the data clusters being consented by the PSU, and requested for authorisation with the ASPSP.
              minItems: 1
            ExpirationDateTime:
              description: "Specified date and time the permissions will expire.\nIf this is not populated, the permissions will be open ended.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
              type: string
              format: date-time
            TransactionFromDateTime:
              description: "Specified start date and time for the transaction query period.\nIf this is not populated, the start date will be open ended, and data will be returned from the earliest available transaction.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
              type: string
              format: date-time
            TransactionToDateTime:
              description: "Specified end date and time for the transaction query period.\nIf this is not populated, the end date will be open ended, and data will be returned to the latest available transaction.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
              type: string
              format: date-time
          required:
          - ConsentId
          - CreationDateTime
          - Status
          - StatusUpdateDateTime
          - Permissions
          additionalProperties: false
        Risk:
          $ref: '#/components/schemas/OBRisk2'
        Links:
          $ref: '#/components/schemas/Links'
        Meta:
          $ref: '#/components/schemas/Meta'
      required:
      - Data
      - Risk
      - Links
      - Meta
      additionalProperties: false
    OBReadData1:
      type: object
      properties:
        Permissions:
          items:
            $ref: '#/components/schemas/OBExternalPermissions1Code'
          type: array
          description: Specifies the Open Banking account access data types. This is a list of the data clusters being consented by the PSU, and requested for authorisation with the ASPSP.
          minItems: 1
        ExpirationDateTime:
          description: "Specified date and time the permissions will expire.\nIf this is not populated, the permissions will be open ended.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
          type: string
          format: date-time
        TransactionFromDateTime:
          description: "Specified start date and time for the transaction query period.\nIf this is not populated, the start date will be open ended, and data will be returned from the earliest available transaction.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
          type: string
          format: date-time
        TransactionToDateTime:
          description: "Specified end date and time for the transaction query period.\nIf this is not populated, the end date will be open ended, and data will be returned to the latest available transaction.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
          type: string
          format: date-time
      required:
      - Permissions
      additionalProperties: false
    OBRisk2:
      description: The Risk section is sent by the initiating party to the ASPSP. It is used to specify additional details for risk scoring for Account Info.
      type: object
      properties: {}
      additionalProperties: false
    OBExternalRequestStatus1Code:
      description: Specifies the status of consent resource in code form.
      type: string
      enum:
      - Authorised
      - AwaitingAuthorisation
      - Rejected
      - Revoked
  requestBodies:
    OBReadConsent1Param:
      description: Default
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/OBReadConsent1'
      required: true
  responses:
    401ErrorResponse:
      description: Unauthorized
    204AccountAccessConsentsConsentIdDeleted:
      description: Account Access Consents Deleted
      headers:
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
    415ErrorResponse:
      description: Unsupported Media Type
    429ErrorResponse:
      description: Too Many Requests
      headers:
        Retry-After:
          description: Number in seconds to wait
          schema:
            type: integer
    500ErrorResponse:
      description: Internal Server Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
    405ErrorResponse:
      description: Method Not Allowed
    400ErrorResponse:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
    406ErrorResponse:
      description: Not Acceptable
    201AccountAccessConsentsCreated:
      description: Account Access Consents Created
      headers:
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/OBReadConsentResponse1'
    200AccountAccessConsentsConsentIdRead:
      description: Account Access Consents Read
      headers:
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/OBReadConsentResponse1'
    404ErrorResponse:
      description: Not found
    403ErrorResponse:
      description: Forbidden
  parameters:
    x-fapi-customer-ip-address-Param:
      in: header
      name: x-fapi-customer-ip-address
      required: false
      description: The PSU's IP address if the PSU is currently logged in with the TPP.
      schema:
        type: string
    ConsentId:
      name: ConsentId
      in: path
      description: ConsentId
      required: true
      schema:
        type: string
    x-fapi-interaction-id-Param:
      in: header
      name: x-fapi-interaction-id
      required: false
      description: An RFC4122 UID used as a correlation id.
      schema:
        type: string
    x-fapi-financial-id-Param:
      in: header
      name: x-fapi-financial-id
      required: true
      description: The unique id of the ASPSP to which the request is issued. The unique id will be issued by OB.
      schema:
        type: string
    AuthorizationParam:
      in: header
      name: Authorization
      required: true
      description: An Authorisation Token as per https://tools.ietf.org/html/rfc6750
      schema:
        type: string
    x-fapi-customer-last-logged-time-Param:
      in: header
      name: x-fapi-customer-last-logged-time
      required: false
      description: "The time when the PSU last logged in with the TPP. \nAll dates in the HTTP headers are represented as RFC 7231 Full Dates. An example is below: \nSun, 10 Sep 2017 19:43:31 UTC"
      schema:
        type: string
        pattern: ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} (GMT|UTC)$
    x-customer-user-agent-Param:
      in: header
      name: x-customer-user-agent
      description: Indicates the user-agent that the PSU is using.
      required: false
      schema:
        type: string
  securitySchemes:
    PSUOAuth2Security:
      type: oauth2
      description: OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when a TPP wants to access an ASPSP resource owned by the PSU
      flows:
        authorizationCode:
          authorizationUrl: https://authserver.example/authorization
          tokenUrl: https://authserver.example/token
          scopes:
            accounts: Ability to read Accounts information
    TPPOAuth2Security:
      type: oauth2
      description: TPP client credential authorisation flow with the ASPSP
      flows:
        clientCredentials:
          tokenUrl: https://authserver.example/token
          scopes:
            accounts: Ability to read Accounts information