openapi: 3.2.0 info: title: Account and Transaction API Specification Transactions API description: OpenAPI for Account and Transaction API Specification termsOfService: https://www.openbanking.org.uk/terms contact: name: Service Desk email: ServiceDesk@openbanking.org.uk license: name: open-licence url: https://www.openbanking.org.uk/open-licence version: v3.1.0 servers: - url: https://api.hoaresbank.co.uk/open-banking/v3.1/aisp description: Base URL declared by the provider in apis.yml (roadmap#122). tags: - name: Transactions paths: /accounts/{AccountId}/statements/{StatementId}/transactions: get: tags: - Transactions summary: Get Transactions operationId: GetAccountsAccountIdStatementsStatementIdTransactions parameters: - $ref: '#/components/parameters/StatementId' - $ref: '#/components/parameters/AccountId' - $ref: '#/components/parameters/x-fapi-financial-id-Param' - $ref: '#/components/parameters/x-fapi-customer-last-logged-time-Param' - $ref: '#/components/parameters/x-fapi-customer-ip-address-Param' - $ref: '#/components/parameters/x-fapi-interaction-id-Param' - $ref: '#/components/parameters/AuthorizationParam' - $ref: '#/components/parameters/x-customer-user-agent-Param' responses: '200': $ref: '#/components/responses/200AccountsAccountIdStatementsStatementIdTransactionsRead' '400': $ref: '#/components/responses/400ErrorResponse' '401': $ref: '#/components/responses/401ErrorResponse' '403': $ref: '#/components/responses/403ErrorResponse' '404': $ref: '#/components/responses/404ErrorResponse' '405': $ref: '#/components/responses/405ErrorResponse' '406': $ref: '#/components/responses/406ErrorResponse' '429': $ref: '#/components/responses/429ErrorResponse' '500': $ref: '#/components/responses/500ErrorResponse' security: - PSUOAuth2Security: - accounts /accounts/{AccountId}/transactions: get: tags: - Transactions summary: Get Transactions operationId: GetAccountsAccountIdTransactions parameters: - $ref: '#/components/parameters/AccountId' - $ref: '#/components/parameters/x-fapi-financial-id-Param' - $ref: '#/components/parameters/x-fapi-customer-last-logged-time-Param' - $ref: '#/components/parameters/x-fapi-customer-ip-address-Param' - $ref: '#/components/parameters/x-fapi-interaction-id-Param' - $ref: '#/components/parameters/AuthorizationParam' - $ref: '#/components/parameters/FromBookingDateTimeParam' - $ref: '#/components/parameters/ToBookingDateTimeParam' - $ref: '#/components/parameters/x-customer-user-agent-Param' responses: '200': $ref: '#/components/responses/200AccountsAccountIdTransactionsRead' '400': $ref: '#/components/responses/400ErrorResponse' '401': $ref: '#/components/responses/401ErrorResponse' '403': $ref: '#/components/responses/403ErrorResponse' '404': $ref: '#/components/responses/404ErrorResponse' '405': $ref: '#/components/responses/405ErrorResponse' '406': $ref: '#/components/responses/406ErrorResponse' '429': $ref: '#/components/responses/429ErrorResponse' '500': $ref: '#/components/responses/500ErrorResponse' security: - PSUOAuth2Security: - accounts /transactions: get: tags: - Transactions summary: Get Transactions operationId: GetTransactions parameters: - $ref: '#/components/parameters/x-fapi-financial-id-Param' - $ref: '#/components/parameters/x-fapi-customer-last-logged-time-Param' - $ref: '#/components/parameters/x-fapi-customer-ip-address-Param' - $ref: '#/components/parameters/x-fapi-interaction-id-Param' - $ref: '#/components/parameters/AuthorizationParam' - $ref: '#/components/parameters/FromBookingDateTimeParam' - $ref: '#/components/parameters/ToBookingDateTimeParam' - $ref: '#/components/parameters/x-customer-user-agent-Param' responses: '200': $ref: '#/components/responses/200TransactionsRead' '400': $ref: '#/components/responses/400ErrorResponse' '401': $ref: '#/components/responses/401ErrorResponse' '403': $ref: '#/components/responses/403ErrorResponse' '404': $ref: '#/components/responses/404ErrorResponse' '405': $ref: '#/components/responses/405ErrorResponse' '406': $ref: '#/components/responses/406ErrorResponse' '429': $ref: '#/components/responses/429ErrorResponse' '500': $ref: '#/components/responses/500ErrorResponse' security: - PSUOAuth2Security: - accounts components: schemas: AccountId: description: A unique and immutable identifier used to identify the account resource. This identifier has no meaning to the account owner. type: string minLength: 1 maxLength: 40 OBTransactionCashBalance: description: Set of elements used to define the balance as a numerical representation of the net increases and decreases in an account after a transaction entry is applied to the account. type: object properties: CreditDebitIndicator: type: string enum: - Credit - Debit description: "Indicates whether the balance is a credit or a debit balance. \nUsage: A zero balance is considered to be a credit balance." Type: $ref: '#/components/schemas/OBBalanceType1Code' Amount: $ref: '#/components/schemas/OBActiveOrHistoricCurrencyAndAmount' required: - CreditDebitIndicator - Type - Amount additionalProperties: false Links: type: object description: Links relevant to the payload properties: Self: type: string format: uri First: type: string format: uri Prev: type: string format: uri Next: type: string format: uri Last: type: string format: uri additionalProperties: false required: - Self OBSupplementaryData1: description: Additional information that can not be captured in the structured fields and/or any other specific block. type: object properties: {} additionalProperties: false OBBranchAndFinancialInstitutionIdentification6: description: Financial institution servicing an account for the debtor. type: object properties: SchemeName: $ref: '#/components/schemas/OBExternalFinancialInstitutionIdentification4Code' Identification: description: Unique and unambiguous identification of a financial institution or a branch of a financial institution. type: string minLength: 1 maxLength: 35 Name: description: Name by which an agent is known and which is usually used to identify that agent. type: string minLength: 1 maxLength: 140 PostalAddress: $ref: '#/components/schemas/OBPostalAddress6' additionalProperties: false OBCashAccount6: description: Unambiguous identification of the account of the debtor, in the case of a crebit transaction. type: object properties: SchemeName: $ref: '#/components/schemas/OBExternalAccountIdentification4Code' Identification: description: Identification assigned by an institution to identify an account. This identification is known by the account owner. type: string minLength: 1 maxLength: 256 Name: description: 'Name of the account, as assigned by the account servicing institution. Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account.' type: string minLength: 1 maxLength: 70 SecondaryIdentification: description: "This is secondary identification of the account, as assigned by the account servicing institution. \nThis can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination)." type: string minLength: 1 maxLength: 34 additionalProperties: false OBExternalCardAuthorisationType1Code: description: The card authorisation type. type: string enum: - ConsumerDevice - Contactless - None - PIN Meta: title: MetaData type: object description: Meta Data relevant to the payload properties: TotalPages: type: integer format: int32 FirstAvailableDateTime: $ref: '#/components/schemas/ISODateTime' LastAvailableDateTime: $ref: '#/components/schemas/ISODateTime' additionalProperties: false OBBankTransactionCodeStructure1: description: Set of elements used to fully identify the type of underlying transaction resulting in an entry. type: object properties: Code: description: Specifies the family within a domain. type: string SubCode: description: Specifies the sub-product family within a specific family. type: string required: - Code - SubCode additionalProperties: false OBError1: type: object properties: ErrorCode: description: Low level textual error code, e.g., UK.OBIE.Field.Missing type: string minLength: 1 maxLength: 128 Message: description: 'A description of the error that occurred. e.g., ''A mandatory field isn''t supplied'' or ''RequestedExecutionDateTime must be in future'' OBIE doesn''t standardise this field' type: string minLength: 1 maxLength: 500 Path: description: Recommended but optional reference to the JSON Path of the field with error, e.g., Data.Initiation.InstructedAmount.Currency type: string minLength: 1 maxLength: 500 Url: description: URL to help remediate the problem, or provide more information, or to API Reference, or help etc type: string required: - ErrorCode - Message additionalProperties: false minProperties: 1 OBMerchantDetails1: description: Details of the merchant involved in the transaction. type: object properties: MerchantName: description: Name by which the merchant is known. type: string minLength: 1 maxLength: 350 MerchantCategoryCode: description: Category code conform to ISO 18245, related to the type of services or goods the merchant provides for the transaction. type: string minLength: 3 maxLength: 4 additionalProperties: false OBCurrencyExchange5: description: Set of elements used to provide details on the currency exchange. type: object properties: SourceCurrency: description: Currency from which an amount is to be converted in a currency conversion. type: string pattern: ^[A-Z]{3,3}$ TargetCurrency: description: Currency from which an amount is to be converted in a currency conversion. type: string pattern: ^[A-Z]{3,3}$ UnitCurrency: description: Currency from which an amount is to be converted in a currency conversion. type: string pattern: ^[A-Z]{3,3}$ ExchangeRate: description: 'Factor used to convert an amount from one currency into another. This reflects the price at which one currency was bought with another currency. Usage: ExchangeRate expresses the ratio between UnitCurrency and QuotedCurrency (ExchangeRate = UnitCurrency/QuotedCurrency).' type: number ContractIdentification: description: Unique identification to unambiguously identify the foreign exchange contract. type: string minLength: 1 maxLength: 35 QuotationDate: description: "Date and time at which an exchange rate is quoted.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00" type: string format: date-time InstructedAmount: $ref: '#/components/schemas/OBActiveOrHistoricCurrencyAndAmount' required: - SourceCurrency - ExchangeRate additionalProperties: false TransactionInformation: description: "Further details of the transaction. \nThis is the transaction narrative, which is unstructured text." type: string minLength: 1 maxLength: 500 OBErrorResponse1: description: An array of detail error codes, and messages, and URLs to documentation to help remediation. type: object properties: Code: description: High level textual error code, to help categorize the errors. type: string minLength: 1 maxLength: 40 Id: description: A unique reference for the error instance, for audit purposes, in case of unknown/unclassified errors. type: string minLength: 1 maxLength: 40 Message: description: Brief Error message, e.g., 'There is something wrong with the request parameters provided' type: string minLength: 1 maxLength: 500 Errors: items: $ref: '#/components/schemas/OBError1' type: array minItems: 1 required: - Code - Message - Errors additionalProperties: false OBTransaction4Basic: description: Provides further details on an entry in the report. type: object properties: AccountId: $ref: '#/components/schemas/AccountId' TransactionId: description: Unique identifier for the transaction within an servicing institution. This identifier is both unique and immutable. type: string minLength: 1 maxLength: 40 TransactionReference: description: Unique reference for the transaction. This reference is optionally populated, and may as an example be the FPID in the Faster Payments context. type: string minLength: 1 maxLength: 35 StatementReference: items: type: string minLength: 1 maxLength: 35 type: array description: Unique reference for the statement. This reference may be optionally populated if available. CreditDebitIndicator: type: string enum: - Credit - Debit description: Indicates whether the transaction is a credit or a debit entry. Status: $ref: '#/components/schemas/OBEntryStatus1Code' BookingDateTime: description: "Date and time when a transaction entry is posted to an account on the account servicer's books.\nUsage: Booking date is the expected booking date, unless the status is booked, in which case it is the actual booking date.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00" type: string format: date-time ValueDateTime: description: "Date and time at which assets become available to the account owner in case of a credit entry, or cease to be available to the account owner in case of a debit transaction entry.\nUsage: If transaction entry status is pending and value date is present, then the value date refers to an expected/requested value date.\nFor transaction entries subject to availability/float and for which availability information is provided, the value date must not be used. In this case the availability component identifies the number of availability days.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00" type: string format: date-time AddressLine: description: Information that locates and identifies a specific address for a transaction entry, that is presented in free format text. type: string minLength: 1 maxLength: 70 Amount: $ref: '#/components/schemas/OBActiveOrHistoricCurrencyAndAmount' ChargeAmount: $ref: '#/components/schemas/OBActiveOrHistoricCurrencyAndAmount' CurrencyExchange: $ref: '#/components/schemas/OBCurrencyExchange5' BankTransactionCode: $ref: '#/components/schemas/OBBankTransactionCodeStructure1' ProprietaryBankTransactionCode: description: Set of elements to fully identify a proprietary bank transaction code. type: object properties: Code: description: Proprietary bank transaction code to identify the underlying transaction. type: string minLength: 1 maxLength: 35 Issuer: description: Identification of the issuer of the proprietary bank transaction code. type: string minLength: 1 maxLength: 35 required: - Code additionalProperties: false CardInstrument: $ref: '#/components/schemas/OBTransactionCardInstrument1' SupplementaryData: $ref: '#/components/schemas/OBSupplementaryData1' required: - AccountId - CreditDebitIndicator - Status - BookingDateTime - Amount additionalProperties: false OBActiveOrHistoricCurrencyAndAmount: description: Amount of money of the cash balance after a transaction entry is applied to the account.. type: object properties: Amount: $ref: '#/components/schemas/OBActiveCurrencyAndAmount_SimpleType' Currency: description: A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". type: string pattern: ^[A-Z]{3,3}$ required: - Amount - Currency additionalProperties: false OBAddressTypeCode: description: Identifies the nature of the postal address. type: string enum: - Business - Correspondence - DeliveryTo - MailTo - POBox - Postal - Residential - Statement OBTransaction4Detail: description: Provides further details on an entry in the report. type: object properties: AccountId: $ref: '#/components/schemas/AccountId' TransactionId: description: Unique identifier for the transaction within an servicing institution. This identifier is both unique and immutable. type: string minLength: 1 maxLength: 40 TransactionReference: description: Unique reference for the transaction. This reference is optionally populated, and may as an example be the FPID in the Faster Payments context. type: string minLength: 1 maxLength: 35 StatementReference: items: type: string minLength: 1 maxLength: 35 type: array description: Unique reference for the statement. This reference may be optionally populated if available. CreditDebitIndicator: type: string enum: - Credit - Debit description: Indicates whether the transaction is a credit or a debit entry. Status: $ref: '#/components/schemas/OBEntryStatus1Code' BookingDateTime: description: "Date and time when a transaction entry is posted to an account on the account servicer's books.\nUsage: Booking date is the expected booking date, unless the status is booked, in which case it is the actual booking date.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00" type: string format: date-time ValueDateTime: description: "Date and time at which assets become available to the account owner in case of a credit entry, or cease to be available to the account owner in case of a debit transaction entry.\nUsage: If transaction entry status is pending and value date is present, then the value date refers to an expected/requested value date.\nFor transaction entries subject to availability/float and for which availability information is provided, the value date must not be used. In this case the availability component identifies the number of availability days.\nAll dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00" type: string format: date-time AddressLine: description: Information that locates and identifies a specific address for a transaction entry, that is presented in free format text. type: string minLength: 1 maxLength: 70 Amount: $ref: '#/components/schemas/OBActiveOrHistoricCurrencyAndAmount' ChargeAmount: $ref: '#/components/schemas/OBActiveOrHistoricCurrencyAndAmount' CurrencyExchange: $ref: '#/components/schemas/OBCurrencyExchange5' BankTransactionCode: $ref: '#/components/schemas/OBBankTransactionCodeStructure1' ProprietaryBankTransactionCode: description: Set of elements to fully identify a proprietary bank transaction code. type: object properties: Code: description: Proprietary bank transaction code to identify the underlying transaction. type: string minLength: 1 maxLength: 35 Issuer: description: Identification of the issuer of the proprietary bank transaction code. type: string minLength: 1 maxLength: 35 required: - Code additionalProperties: false CardInstrument: $ref: '#/components/schemas/OBTransactionCardInstrument1' SupplementaryData: $ref: '#/components/schemas/OBSupplementaryData1' TransactionInformation: $ref: '#/components/schemas/TransactionInformation' Balance: $ref: '#/components/schemas/OBTransactionCashBalance' MerchantDetails: $ref: '#/components/schemas/OBMerchantDetails1' CreditorAgent: $ref: '#/components/schemas/OBBranchAndFinancialInstitutionIdentification6' CreditorAccount: $ref: '#/components/schemas/OBCashAccount6' DebtorAgent: $ref: '#/components/schemas/OBBranchAndFinancialInstitutionIdentification6' DebtorAccount: $ref: '#/components/schemas/OBCashAccount6' required: - AccountId - CreditDebitIndicator - Status - BookingDateTime - Amount additionalProperties: false OBExternalCardSchemeType1Code: description: Name of the card scheme. type: string enum: - AmericanExpress - Diners - Discover - MasterCard - VISA ISODateTime: description: "All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00" type: string format: date-time OBReadTransaction4: type: object properties: Data: type: object properties: Transaction: items: $ref: '#/components/schemas/OBTransaction4' type: array description: Provides further details on an entry in the report. additionalProperties: false Links: $ref: '#/components/schemas/Links' Meta: $ref: '#/components/schemas/Meta' required: - Data - Links - Meta additionalProperties: false OBExternalFinancialInstitutionIdentification4Code: description: Name of the identification scheme, in a coded form as published in an external list. type: string example: - UK.OBIE.BICFI minLength: 1 maxLength: 40 OBBalanceType1Code: description: Balance type, in a coded form. type: string enum: - ClosingAvailable - ClosingBooked - ClosingCleared - Expected - ForwardAvailable - Information - InterimAvailable - InterimBooked - InterimCleared - OpeningAvailable - OpeningBooked - OpeningCleared - PreviouslyClosedBooked OBExternalAccountIdentification4Code: description: Name of the identification scheme, in a coded form as published in an external list. type: string example: - UK.OBIE.BBAN - UK.OBIE.IBAN - UK.OBIE.PAN - UK.OBIE.Paym - UK.OBIE.SortCodeAccountNumber minLength: 1 maxLength: 40 OBPostalAddress6: description: Information that locates and identifies a specific address, as defined by postal services. type: object properties: AddressType: $ref: '#/components/schemas/OBAddressTypeCode' Department: description: Identification of a division of a large organisation or building. type: string minLength: 1 maxLength: 70 SubDepartment: description: Identification of a sub-division of a large organisation or building. type: string minLength: 1 maxLength: 70 StreetName: description: Name of a street or thoroughfare. type: string minLength: 1 maxLength: 70 BuildingNumber: description: Number that identifies the position of a building on a street. type: string minLength: 1 maxLength: 16 PostCode: description: Identifier consisting of a group of letters and/or numbers that is added to a postal address to assist the sorting of mail. type: string minLength: 1 maxLength: 16 TownName: description: Name of a built-up area, with defined boundaries, and a local government. type: string minLength: 1 maxLength: 35 CountrySubDivision: description: Identifies a subdivision of a country such as state, region, county. type: string minLength: 1 maxLength: 35 Country: description: Nation with its own government. type: string pattern: ^[A-Z]{2,2}$ AddressLine: items: type: string minLength: 1 maxLength: 70 type: array description: Information that locates and identifies a specific address, as defined by postal services, presented in free format text. minItems: 0 maxItems: 7 additionalProperties: false OBTransaction4: oneOf: - $ref: '#/components/schemas/OBTransaction4Basic' - $ref: '#/components/schemas/OBTransaction4Detail' OBActiveCurrencyAndAmount_SimpleType: description: A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217. type: string pattern: ^\d{1,13}\.\d{1,5}$ OBEntryStatus1Code: description: Status of a transaction entry on the books of the account servicer. type: string enum: - Booked - Pending OBTransactionCardInstrument1: description: Set of elements to describe the card instrument used in the transaction. type: object properties: CardSchemeName: $ref: '#/components/schemas/OBExternalCardSchemeType1Code' AuthorisationType: $ref: '#/components/schemas/OBExternalCardAuthorisationType1Code' Name: description: Name of the cardholder using the card instrument. type: string minLength: 1 maxLength: 70 Identification: description: Identification assigned by an institution to identify the card instrument used in the transaction. This identification is known by the account owner, and may be masked. type: string minLength: 1 maxLength: 34 required: - CardSchemeName additionalProperties: false responses: 403ErrorResponse: description: Forbidden 401ErrorResponse: description: Unauthorized 429ErrorResponse: description: Too Many Requests headers: Retry-After: description: Number in seconds to wait schema: type: integer 500ErrorResponse: description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/OBErrorResponse1' 200TransactionsRead: description: Transactions Read headers: x-fapi-interaction-id: description: An RFC4122 UID used as a correlation id. schema: type: string content: application/json: schema: $ref: '#/components/schemas/OBReadTransaction4' 200AccountsAccountIdStatementsStatementIdTransactionsRead: description: Transactions Read headers: x-fapi-interaction-id: description: An RFC4122 UID used as a correlation id. schema: type: string content: application/json: schema: $ref: '#/components/schemas/OBReadTransaction4' 405ErrorResponse: description: Method Not Allowed 400ErrorResponse: description: Bad request content: application/json: schema: $ref: '#/components/schemas/OBErrorResponse1' 406ErrorResponse: description: Not Acceptable 200AccountsAccountIdTransactionsRead: description: Transactions Read headers: x-fapi-interaction-id: description: An RFC4122 UID used as a correlation id. schema: type: string content: application/json: schema: $ref: '#/components/schemas/OBReadTransaction4' 404ErrorResponse: description: Not found parameters: x-fapi-customer-ip-address-Param: in: header name: x-fapi-customer-ip-address required: false description: The PSU's IP address if the PSU is currently logged in with the TPP. schema: type: string AccountId: name: AccountId in: path description: AccountId required: true schema: type: string x-fapi-interaction-id-Param: in: header name: x-fapi-interaction-id required: false description: An RFC4122 UID used as a correlation id. schema: type: string x-fapi-financial-id-Param: in: header name: x-fapi-financial-id required: true description: The unique id of the ASPSP to which the request is issued. The unique id will be issued by OB. schema: type: string AuthorizationParam: in: header name: Authorization required: true description: An Authorisation Token as per https://tools.ietf.org/html/rfc6750 schema: type: string x-fapi-customer-last-logged-time-Param: in: header name: x-fapi-customer-last-logged-time required: false description: "The time when the PSU last logged in with the TPP. \nAll dates in the HTTP headers are represented as RFC 7231 Full Dates. An example is below: \nSun, 10 Sep 2017 19:43:31 UTC" schema: type: string pattern: ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} (GMT|UTC)$ FromBookingDateTimeParam: in: query name: fromBookingDateTime description: 'The UTC ISO 8601 Date Time to filter transactions FROM NB Time component is optional - set to 00:00:00 for just Date. If the Date Time contains a timezone, the ASPSP must ignore the timezone component.' schema: type: string format: date-time StatementId: name: StatementId in: path description: StatementId required: true schema: type: string x-customer-user-agent-Param: in: header name: x-customer-user-agent description: Indicates the user-agent that the PSU is using. required: false schema: type: string ToBookingDateTimeParam: in: query name: toBookingDateTime description: 'The UTC ISO 8601 Date Time to filter transactions TO NB Time component is optional - set to 00:00:00 for just Date. If the Date Time contains a timezone, the ASPSP must ignore the timezone component.' schema: type: string format: date-time securitySchemes: PSUOAuth2Security: type: oauth2 description: OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when a TPP wants to access an ASPSP resource owned by the PSU flows: authorizationCode: authorizationUrl: https://authserver.example/authorization tokenUrl: https://authserver.example/token scopes: accounts: Ability to read Accounts information TPPOAuth2Security: type: oauth2 description: TPP client credential authorisation flow with the ASPSP flows: clientCredentials: tokenUrl: https://authserver.example/token scopes: accounts: Ability to read Accounts information