openapi: 3.2.0
info:
  title: Confirmation of Funds API Specification Funds Confirmation Consents API
  description: 'Swagger for Confirmation of Funds API Specification.


    **Please Note**: There are no optional fields, if a field is not marked as “Required” it is a Conditional field.

    '
  termsOfService: https://www.openbanking.org.uk/terms
  contact:
    name: Service Desk
    email: ServiceDesk@openbanking.org.uk
  license:
    name: open-licence
    url: https://www.openbanking.org.uk/open-licence
  version: 4.0.1
servers:
- url: /open-banking/v4.0/cbpii
tags:
- name: Funds Confirmation Consents
paths:
  /funds-confirmation-consents:
    post:
      tags:
      - Funds Confirmation Consents
      summary: Create a Funds Confirmation Consent
      description: Enables a CBPII to ask an ASPSP to create a new funds-confirmation-consent resource, by sending a copy of the consent to the ASPSP.
      operationId: CreateFundsConfirmationConsents
      parameters:
      - $ref: '#/components/parameters/x-fapi-auth-date'
      - $ref: '#/components/parameters/x-fapi-customer-ip-address'
      - $ref: '#/components/parameters/x-fapi-interaction-id'
      - $ref: '#/components/parameters/Authorization'
      - $ref: '#/components/parameters/x-customer-user-agent'
      - $ref: '#/components/parameters/x-client-id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OBFundsConfirmationConsent1'
        description: Default
        required: true
      responses:
        '201':
          $ref: '#/components/responses/201FundsConfirmationConsentsCreated'
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '405':
          $ref: '#/components/responses/405Error'
        '406':
          $ref: '#/components/responses/406Error'
        '415':
          $ref: '#/components/responses/415Error'
        '429':
          $ref: '#/components/responses/429Error'
        '500':
          $ref: '#/components/responses/500Error'
      security:
      - TPPOAuth2Security:
        - fundsconfirmations
  /funds-confirmation-consents/{ConsentId}:
    get:
      tags:
      - Funds Confirmation Consents
      summary: Get a Funds Confirmation Consent
      description: Enables a CBPII to retrieve the status of a Funds Confirmation Consent resource.
      operationId: GetFundsConfirmationConsentsConsentId
      parameters:
      - $ref: '#/components/parameters/ConsentId'
      - $ref: '#/components/parameters/x-fapi-auth-date'
      - $ref: '#/components/parameters/x-fapi-customer-ip-address'
      - $ref: '#/components/parameters/x-fapi-interaction-id'
      - $ref: '#/components/parameters/Authorization'
      - $ref: '#/components/parameters/x-customer-user-agent'
      - $ref: '#/components/parameters/x-client-id'
      responses:
        '200':
          $ref: '#/components/responses/200FundsConfirmationConsentsConsentIdRead'
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '405':
          $ref: '#/components/responses/405Error'
        '406':
          $ref: '#/components/responses/406Error'
        '429':
          $ref: '#/components/responses/429Error'
        '500':
          $ref: '#/components/responses/500Error'
      security:
      - TPPOAuth2Security:
        - fundsconfirmations
    delete:
      tags:
      - Funds Confirmation Consents
      summary: Delete a Funds Confirmation Consent
      description: Enables a CBPII to inform the PSU’s ASPSP that the PSU has revoked their consent to provide funds confirmations.
      operationId: DeleteFundsConfirmationConsentsConsentId
      parameters:
      - $ref: '#/components/parameters/ConsentId'
      - $ref: '#/components/parameters/x-fapi-auth-date'
      - $ref: '#/components/parameters/x-fapi-customer-ip-address'
      - $ref: '#/components/parameters/x-fapi-interaction-id'
      - $ref: '#/components/parameters/Authorization'
      - $ref: '#/components/parameters/x-customer-user-agent'
      - $ref: '#/components/parameters/x-client-id'
      responses:
        '204':
          $ref: '#/components/responses/204FundsConfirmationConsentsConsentIdDeleted'
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '405':
          $ref: '#/components/responses/405Error'
        '406':
          $ref: '#/components/responses/406Error'
        '429':
          $ref: '#/components/responses/429Error'
        '500':
          $ref: '#/components/responses/500Error'
      security:
      - TPPOAuth2Security:
        - fundsconfirmations
components:
  parameters:
    x-client-id:
      in: header
      name: x-client-id
      required: false
      description: "Only used if an ASPSP requires the client ID in order to return rate limit headers. \n\nTPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements.\n\nThis header __must not__ be used for client authentication\n"
      schema:
        type: string
    x-fapi-customer-ip-address:
      in: header
      name: x-fapi-customer-ip-address
      required: false
      description: The PSU's IP address if the PSU is currently logged in with the TPP.
      schema:
        type: string
    x-customer-user-agent:
      in: header
      name: x-customer-user-agent
      description: Indicates the user-agent that the PSU is using.
      required: false
      schema:
        type: string
    Authorization:
      in: header
      name: Authorization
      required: true
      description: An Authorisation Token as per https://tools.ietf.org/html/rfc6750
      schema:
        type: string
    x-fapi-interaction-id:
      in: header
      name: x-fapi-interaction-id
      required: false
      description: An RFC4122 UID used as a correlation id.
      schema:
        type: string
    ConsentId:
      name: ConsentId
      in: path
      description: ConsentId
      required: true
      schema:
        type: string
    x-fapi-auth-date:
      in: header
      name: x-fapi-auth-date
      required: false
      description: "The time when the PSU last logged in with the TPP. \nAll dates in the HTTP headers are represented as RFC 7231 Full Dates. An example is below: \nSun, 10 Sep 2017 19:43:31 UTC"
      schema:
        type: string
        pattern: ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} (GMT|UTC)$
  responses:
    415Error:
      description: Unsupported Media Type
      headers:
        x-fapi-interaction-id:
          required: true
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
    400Error:
      description: Bad request
      headers:
        x-fapi-interaction-id:
          required: true
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
        application/json:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
        application/jose+jwe:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
    429Error:
      description: Too Many Requests
      headers:
        Retry-After:
          description: Number in seconds to wait
          schema:
            type: integer
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
    403Error:
      description: Forbidden
      headers:
        x-fapi-interaction-id:
          required: true
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
        application/json:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
        application/jose+jwe:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
    401Error:
      description: Unauthorized
      headers:
        x-fapi-interaction-id:
          required: true
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
    201FundsConfirmationConsentsCreated:
      description: Funds Confirmation Consent Created
      headers:
        x-fapi-interaction-id:
          required: true
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimit-Policy'
        RateLimit:
          $ref: '#/components/headers/RateLimit'
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1'
        application/json:
          schema:
            $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1'
        application/jose+jwe:
          schema:
            $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1'
    204FundsConfirmationConsentsConsentIdDeleted:
      description: Funds Confirmation Consent Deleted
      headers:
        x-fapi-interaction-id:
          required: true
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimit-Policy'
        RateLimit:
          $ref: '#/components/headers/RateLimit'
    200FundsConfirmationConsentsConsentIdRead:
      description: Funds Confirmation Consent Read
      headers:
        x-fapi-interaction-id:
          required: true
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimit-Policy'
        RateLimit:
          $ref: '#/components/headers/RateLimit'
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1'
        application/json:
          schema:
            $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1'
        application/jose+jwe:
          schema:
            $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1'
    405Error:
      description: Method Not Allowed
      headers:
        x-fapi-interaction-id:
          required: true
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
    406Error:
      description: Not Acceptable
      headers:
        x-fapi-interaction-id:
          required: true
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
    500Error:
      description: Internal Server Error
      headers:
        x-fapi-interaction-id:
          required: true
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
        application/json:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
        application/jose+jwe:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
  schemas:
    OBInternalConsentStatus1Code:
      description: Specifies the status of consent resource in code form. For a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)
      type: string
      enum:
      - AWAU
      - RJCT
      - AUTH
      - CANC
      - EXPD
    ISODateTime:
      description: "All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
      type: string
      format: date-time
    OBFundsConfirmationConsentResponse1:
      type: object
      required:
      - Data
      properties:
        Data:
          type: object
          required:
          - ConsentId
          - CreationDateTime
          - Status
          - StatusUpdateDateTime
          - DebtorAccount
          properties:
            ConsentId:
              description: Unique identification as assigned to identify the funds confirmation consent resource.
              type: string
              minLength: 1
              maxLength: 128
            CreationDateTime:
              description: "Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
              type: string
              format: date-time
            Status:
              $ref: '#/components/schemas/OBInternalConsentStatus1Code'
            StatusReason:
              type: array
              items:
                $ref: '#/components/schemas/OBStatusReason'
            StatusUpdateDateTime:
              description: "Date and time at which the resource status was updated. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
              type: string
              format: date-time
            ExpirationDateTime:
              description: "Specified date and time the funds confirmation authorisation will expire.\nIf this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
              type: string
              format: date-time
            DebtorAccount:
              type: object
              required:
              - SchemeName
              - Identification
              description: Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied.
              properties:
                SchemeName:
                  description: Name of the identification scheme, in a coded form as published in an external list. For a full list of values refer to `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)
                  type: string
                  x-namespaced-enum:
                  - UK.OBIE.BBAN
                  - UK.OBIE.IBAN
                  - UK.OBIE.PAN
                  - UK.OBIE.Paym
                  - UK.OBIE.SortCodeAccountNumber
                  - UK.OBIE.Wallet
                Identification:
                  description: Identification assigned by an institution to identify an account. This identification is known by the account owner.
                  type: string
                  minLength: 1
                  maxLength: 256
                Name:
                  description: 'Name of the account, as assigned by the account servicing institution.

                    Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account.'
                  type: string
                  minLength: 1
                  maxLength: 350
                SecondaryIdentification:
                  description: "This is secondary identification of the account, as assigned by the account servicing institution. \nThis can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination)."
                  type: string
                  minLength: 1
                  maxLength: 34
                Proxy:
                  $ref: '#/components/schemas/OBProxy1'
        Links:
          $ref: '#/components/schemas/Links'
        Meta:
          $ref: '#/components/schemas/Meta'
      additionalProperties: false
    OBError1:
      type: object
      properties:
        ErrorCode:
          $ref: '#/components/schemas/OBExternalStatusReason1Code'
        Message:
          description: 'A description of the error that occurred. e.g., ''A mandatory field isn''t supplied'' or ''RequestedExecutionDateTime must be in future''

            OBL doesn''t standardise this field'
          type: string
          minLength: 1
          maxLength: 500
        Path:
          description: Recommended but optional reference to the JSON Path of the field with error, e.g., Data.Initiation.InstructedAmount.Currency
          type: string
          minLength: 1
          maxLength: 500
        Url:
          description: URL to help remediate the problem, or provide more information, or to API Reference, or help etc
          type: string
      required:
      - ErrorCode
      additionalProperties: false
      minProperties: 1
    Meta:
      title: MetaData
      type: object
      description: Meta Data relevant to the payload
      properties:
        TotalPages:
          type: integer
          format: int32
        FirstAvailableDateTime:
          $ref: '#/components/schemas/ISODateTime'
        LastAvailableDateTime:
          $ref: '#/components/schemas/ISODateTime'
      additionalProperties: false
    OBFundsConfirmationConsent1:
      type: object
      required:
      - Data
      properties:
        Data:
          type: object
          required:
          - DebtorAccount
          properties:
            ExpirationDateTime:
              description: "Specified date and time the funds confirmation authorisation will expire.\n If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
              type: string
              format: date-time
            DebtorAccount:
              type: object
              required:
              - SchemeName
              - Identification
              description: Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied.
              properties:
                SchemeName:
                  description: Name of the identification scheme, in a coded form as published in an external list. For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)
                  type: string
                  x-namespaced-enum:
                  - UK.OBIE.BBAN
                  - UK.OBIE.IBAN
                  - UK.OBIE.PAN
                  - UK.OBIE.Paym
                  - UK.OBIE.SortCodeAccountNumber
                  - UK.OBIE.Wallet
                Identification:
                  description: Identification assigned by an institution to identify an account. This identification is known by the account owner.
                  type: string
                  minLength: 1
                  maxLength: 256
                Name:
                  description: 'Name of the account, as assigned by the account servicing institution.

                    Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account.'
                  type: string
                  minLength: 1
                  maxLength: 350
                SecondaryIdentification:
                  description: "This is secondary identification of the account, as assigned by the account servicing institution. \nThis can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination)."
                  type: string
                  minLength: 1
                  maxLength: 34
                Proxy:
                  $ref: '#/components/schemas/OBProxy1'
      additionalProperties: false
    Links:
      type: object
      description: Links relevant to the payload
      properties:
        Self:
          type: string
          format: uri
        First:
          type: string
          format: uri
        Prev:
          type: string
          format: uri
        Next:
          type: string
          format: uri
        Last:
          type: string
          format: uri
      additionalProperties: false
      required:
      - Self
    ExternalProxyAccountType1Code:
      description: Specifies the external proxy account type code, as published in the proxy account type external code set.<br > For a full list of values refer to `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)
      type: string
      enum:
      - TELE
      - EMAL
      - DNAM
      - CINC
      - COTX
      - COID
      - CUST
      - DRLC
      - EIDN
      - EWAL
      - PVTX
      - LEIC
      - MBNO
      - NIDN
      - CCPT
      - SHID
      - SOSE
      - TOKN
      - UBIL
      - VIPN
      - BIID
    OBExternalStatusReason1Code:
      description: Low level textual error code, for all enum values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)
      type: string
      minLength: 4
      maxLength: 4
      example: U001
    OBErrorResponse1:
      description: An array of detail error codes, and messages, and URLs to documentation to help remediation.
      type: object
      properties:
        Id:
          description: A unique reference for the error instance, for audit purposes, in case of unknown/unclassified errors.
          type: string
          minLength: 1
          maxLength: 40
        Code:
          description: Deprecated <br>High level textual error code, to help categorise the errors.
          type: string
          minLength: 1
          example: 400 BadRequest
          maxLength: 40
        Message:
          description: Deprecated <br>Brief Error message
          type: string
          minLength: 1
          example: There is something wrong with the request parameters provided
          maxLength: 500
        Errors:
          items:
            $ref: '#/components/schemas/OBError1'
          type: array
          minItems: 1
      required:
      - Errors
      additionalProperties: false
    OBStatusReason:
      type: object
      properties:
        StatusReasonCode:
          type: string
          description: "Specifies the status reason in a code form. \n For a full list of values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)"
          minLength: 1
          maxLength: 4
          example: ERIN
        StatusReasonDescription:
          description: Description supporting the StatusReasonCode.
          type: string
          minLength: 1
          maxLength: 500
        Path:
          type: string
          description: Optional reference to the JSON Path of the field when status reason refers to an object/field, e.g., Data.DebtorAccount.SchemeName
          minLength: 1
          maxLength: 500
    OBProxy1:
      description: Specifies an alternate assumed name for the identification of the account.
      type: object
      required:
      - Identification
      - Code
      properties:
        Identification:
          description: Identification used to indicate the account identification under another specified name.
          type: string
          minLength: 1
          maxLength: 2048
        Code:
          $ref: '#/components/schemas/ExternalProxyAccountType1Code'
        Type:
          type: string
          description: Type of the proxy identification.
          minLength: 1
          maxLength: 35
  headers:
    RateLimit-Policy:
      required: false
      description: 'TPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements.


        A non-empty list of Quota Policy Items. The Item value __MUST__ be a String.


        Example:

        `RateLimit-Policy: "default";q=100;w=10`


        The **REQUIRED** "q" parameter indicates the quota allocated by this policy measured in quota units.


        The **OPTIONAL** "w" parameter value conveys a time window.

        '
      schema:
        type: string
    RateLimit:
      required: false
      description: 'TPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements.


        A server uses the "RateLimit" response header field to communicate the current service limit for a quota policy for a particular partition key.


        Example:

        `RateLimit: "default";r=50;t=30`


        The **REQUIRED** "r" parameter value conveys the remaining quota units for the identified policy.


        The **OPTIONAL** "t" parameter value conveys the time window reset time for the identified policy.

        '
      schema:
        type: string
  securitySchemes:
    TPPOAuth2Security:
      type: oauth2
      description: TPP client credential authorisation flow with the ASPSP
      flows:
        clientCredentials:
          tokenUrl: https://authserver.example/token
          scopes:
            fundsconfirmations: Funds confirmation entitlement
    PSUOAuth2Security:
      type: oauth2
      description: OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when a TPP wants to access an ASPSP resource owned by the PSU
      flows:
        authorizationCode:
          authorizationUrl: https://authserver.example/authorization
          tokenUrl: https://authserver.example/token
          scopes:
            fundsconfirmations: Funds confirmation entitlement