openapi: 3.1.0 info: title: API reference Accounts data Misc API version: 1.0.0-3030f99c servers: - url: https://api.enablebanking.com - url: https://api.tilisy.com description: (deprecated) security: - bearerAuth: [] tags: - name: Misc paths: /aspsps: get: tags: - Misc summary: Get list of ASPSPs description: Get list of ASPSPs with their meta information operationId: get_aspsps_aspsps_get parameters: - name: country in: query required: false schema: type: string pattern: ^[A-Z]{2}$ description: Display only ASPSPs from specified country title: Country description: Display only ASPSPs from specified country - name: psu_type in: query required: false schema: $ref: '#/components/schemas/PSUType' description: Display only ASPSPs which support specified psu type description: Display only ASPSPs which support specified psu type - name: service in: query required: false schema: $ref: '#/components/schemas/Service' description: Display only ASPSPs which support specified service description: Display only ASPSPs which support specified service - name: payment_type in: query required: false schema: $ref: '#/components/schemas/PaymentType' description: Display only ASPSPs which support specified payment type description: Display only ASPSPs which support specified payment type responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/GetAspspsResponse' '400': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Not Found '408': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Request Timeout '422': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Unprocessable Entity '429': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Too Many Requests '500': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Internal Server Error /application: get: tags: - Misc summary: Get application description: Get application associated with provided JWT key ID operationId: get_application_application_get responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/GetApplicationResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '408': description: Request Timeout content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '422': description: Unprocessable Entity content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: schemas: AuthenticationApproach: type: string enum: - REDIRECT - DECOUPLED - EMBEDDED title: AuthenticationApproach example: REDIRECT x-enum-descriptions: - The TPP identifies the PSU and forwards the identification to the ASPSP which processes the authentication through a decoupled device - The TPP identifies the PSU and forwards the identification to the ASPSP which starts the authentication. The TPP forwards one authentication factor of the PSU (e.g. OTP or response to a challenge) - The PSU is redirected by the TPP to the ASPSP which processes identification and authentication PaymentStatus: type: string enum: - ACCC - ACCP - ACSC - ACSP - ACTC - ACWC - ACWP - PART - RCVD - PDNG - RJCT - ACPT - ACCR - RJCR - PACR - PDCR - CNCL - 'NULL' title: PaymentStatus example: ACCC x-enum-descriptions: - AcceptedCreditSettlementCompleted. Settlement on the creditor's account has been completed. - AcceptedCustomerProfile. Preceding check of technical validation was successful. Customer profile check was also successful. - AcceptedCancellationRequest. Cancellation is accepted. - Accepted. Request is accepted. - AcceptedSettlementCompleted. Settlement on the debtor's account has been completed. - AcceptedSettlementInProcess. All preceding checks such as technical validation and customer profile were successful. Dynamic risk assessment is now also successful and therefore the Payment Request has been accepted for execution. - AcceptedTechnicalValidation. Authentication and syntactical and semantical validation are successful. - AcceptedWithChange. Instruction is accepted but a change will be made, such as date or remittance not sent. - AcceptedWithoutPosting. Payment instruction included in the credit transfer is accepted without being posted to the creditor's account. - PaymentCancelled. Payment is cancelled. - NoCancellationProcess. There is no cancellation process ongoing. - PartiallyAcceptedCancellationRequest. Cancellation is partially accepted. - PartiallyAccepted. A number of transactions have been accepted, whereas another number of transactions have not yet achieved 'accepted' status. - PendingCancellationRequest. Cancellation request is pending. - Pending. Payment request or individual transaction included in the Payment Request is pending. Further checks and status update will be performed. - Received. Payment initiation has been received by the receiving agent. - RejectedCancellationRequest. Cancellation request is rejected. - Rejected. Payment request has been rejected. ReferenceNumberScheme: type: string enum: - SEBG - NORF - FIRF - INTL - BERF - SDDM title: ReferenceNumberScheme example: SEBG x-enum-descriptions: - Belgian reference number - Finnish reference number - International reference number (starting with RF) - Norwegian KID (OCR) - SEPA Direct Debit Mandate ID - Swedish Bankgiro OCR RegulatoryReportingCode: properties: value: type: string title: Value description: Value of the code, i.e. what needs to be passed as a code when filling in regulatory reporting details. description: title: Description description: Regulatory authority to which reporting shall be made type: string type: object required: - value - description title: RegulatoryReportingCode Credential: properties: name: type: string title: Name description: Internal name of the credential. The name is to be used when passing credentials to the "start user authorization" request examples: - userId title: type: string title: Title description: Title for the credential to be displayed to PSU examples: - User ID required: type: boolean title: Required description: Indication whether the credential is required examples: - true description: title: Description description: Description of the credential to be displayed to PSU examples: - Your identifier used for logging in to online banking type: string template: title: Template description: Perl compatible regular expression used for check of the credential format examples: - ^\d{8}$ type: string type: object required: - name - title - required title: Credential SandboxInfo: properties: users: items: $ref: '#/components/schemas/SandboxUser' type: array title: Users description: List of sandbox users which can be used to test sandbox environment type: object title: SandboxInfo ErrorResponse: properties: message: type: string title: Message description: Error message examples: - Required PSU header is not provided code: title: Code description: Error code, identical to the http response code examples: - 422 type: integer error: description: Text error code examples: - PSU_HEADER_NOT_PROVIDED $ref: '#/components/schemas/ErrorCode' detail: title: Detail description: Detailed explanation of an error examples: - PSU header psuIpAddress is not provided type: object required: - message title: ErrorResponse ChargeBearerCode: type: string enum: - SLEV - SHAR - DEBT - CRED title: ChargeBearerCode example: SLEV x-enum-descriptions: - The Payee (recipient of the payment) will incur all of the payment transaction fees - The Payer (sender of the payment) will bear all of the payment transaction fees - Shared. Transaction charges on the sender side are to be borne by the debtor, transaction charges on the receiver side are to be borne by the creditor - Service level. Charges are to be applied following the rules agreed in the service level and/or scheme ResponsePaymentType: properties: payment_type: $ref: '#/components/schemas/PaymentType' description: Payment type name max_transactions: title: Max Transactions description: Maximum number of transactions per payment type: integer currencies: title: Currencies description: List of supported currencies items: type: string type: array debtor_account_required: type: boolean title: Debtor Account Required description: 'States if debtor account is required for payment initiation request. When the debtor account is not provided it is to be chosen by the PSU during payment authorisation flow. Create payment body field: `payment_request.debtor_account`' default: false debtor_account_schemas: title: Debtor Account Schemas description: List of supported debtor account schemas items: $ref: '#/components/schemas/SchemeName' type: array creditor_account_schemas: title: Creditor Account Schemas description: List of supported creditor account schemas items: $ref: '#/components/schemas/SchemeName' type: array priority_codes: title: Priority Codes description: List of supported priority codes items: $ref: '#/components/schemas/PriorityCode' type: array charge_bearer_values: title: Charge Bearer Values description: List of supported charge bearer codes items: $ref: '#/components/schemas/ChargeBearerCode' type: array creditor_country_required: title: Creditor Country Required description: 'States if creditor country is required. Create payment body field: `payment_request.credit_transfer_transaction[*].beneficiary.creditor.postal_address.country`' default: false type: boolean creditor_name_required: title: Creditor Name Required description: 'States if creditor name is required. Create payment body field: `payment_request.credit_transfer_transaction[*].beneficiary.creditor.postal_address.country`' default: false type: boolean creditor_postal_address_required: title: Creditor Postal Address Required description: 'States if creditor postal address is required. Create payment body field: `payment_request.credit_transfer_transaction[*].beneficiary.creditor.postal_address`' default: false type: boolean remittance_information_required: title: Remittance Information Required description: 'States if remittance information is required. Create payment body field: `payment_request.credit_transfer_transaction[*].remittance_information`' default: false type: boolean remittance_information_lines: title: Remittance Information Lines description: Properties of remittance information. Each item of the array correspond to the remittance information line with the same index. When provided, the number of lines in the remittance information should be the same as the length of this array. items: $ref: '#/components/schemas/RemittanceInformationLineInfo' type: array debtor_currency_required: title: Debtor Currency Required description: 'States if debtor currency is required. Create payment body field: `payment_request.debtor_currency`' default: false type: boolean debtor_contact_email_required: title: Debtor Contact Email Required description: 'States if debtor''s contact email is required when a payment this type is being initiated. Create payment body field: `payment_request.debtor.contact_details.email_address`' default: false type: boolean debtor_contact_phone_required: title: Debtor Contact Phone Required description: 'States if debtor''s contact phone is required when a payment this type is being initiated. Create payment body field: `payment_request.debtor.contact_details.phone_number`' default: false type: boolean creditor_agent_bic_fi_required: title: Creditor Agent Bic Fi Required description: 'States if creditor agent bicFi is required. Create payment body field: `payment_request.credit_transfer_transaction[*].beneficiary.creditor_agent.bic_fi`' default: false type: boolean creditor_agent_clearing_system_member_id_required: title: Creditor Agent Clearing System Member Id Required description: 'States if creditor agent clearing system member ID is required. Create payment body field: `payment_request.credit_transfer_transaction[*].beneficiary.creditor_agent.clearing_system_member_id`' default: false type: boolean allowed_auth_methods: title: Allowed Auth Methods description: List of supported auth methods for this payment type items: type: string type: array regulatory_reporting_codes: title: Regulatory Reporting Codes description: List of supported codes for regulatory reporting details items: $ref: '#/components/schemas/RegulatoryReportingCode' type: array regulatory_reporting_code_required: title: Regulatory Reporting Code Required description: 'States if regulatory reporting shall be provided for credit transfer transactions. Create payment body field: `payment_request.credit_transfer_transaction[*].regulatory_reporting.details.code`' default: false type: boolean reference_number_supported: title: Reference Number Supported description: States if reference number can be provided for credit transfer transactions default: false type: boolean reference_number_schemas: title: Reference Number Schemas description: List of reference number schemas supported by a payment method items: $ref: '#/components/schemas/ReferenceNumberScheme' type: array requested_execution_date_supported: title: Requested Execution Date Supported description: States if requested execution date supported by a payment method default: false type: boolean requested_execution_date_max_period: title: Requested Execution Date Max Period description: Maximum requested execution date interval in the future type: integer remittance_reference_supported: title: Remittance Reference Supported description: States if both reference number and remittance information can be provided simultaneously default: false type: boolean final_successful_statuses: title: Final Successful Statuses description: List of the final successful statuses for the payment type. Please note that when a payment reaches one of the statuses provided in this list, it is not yet guaranteed that the funds will be credited to the creditor's account specified in the payment request. It is up to the application that created the payment to conclude whether the funds are (or will be) received, depending on the actual payment status and other factors. items: $ref: '#/components/schemas/PaymentStatus' type: array psu_type: $ref: '#/components/schemas/PSUType' description: PSU type type: object required: - payment_type - psu_type title: ResponsePaymentType example: allowed_auth_methods: - string charge_bearer_values: - SLEV creditor_account_schemas: - IBAN creditor_agent_bic_fi_required: false creditor_agent_clearing_system_member_id_required: false creditor_country_required: false creditor_name_required: false creditor_postal_address_required: false currencies: - EUR debtor_account_required: false debtor_account_schemas: - IBAN debtor_contact_email_required: false debtor_contact_phone_required: false debtor_currency_required: false max_transactions: 1 payment_type: SEPA priority_codes: - NORM psu_type: business reference_number_schemas: - FIRF - INTL reference_number_supported: true regulatory_reporting_code_required: false remittance_information_lines: - max_length: 140 min_length: 1 pattern: ^.{1,140}$ remittance_information_required: false requested_execution_date_max_period: 365 requested_execution_date_supported: true SchemeName: type: string enum: - CHID - GS1G - DUNS - BANK - TXID - CUST - EMPL - OTHC - DRLC - CUSI - SOSE - ARNU - CCPT - OTHI - COID - SREN - SRET - NIDN - OAUT - CPAN - BBAN - IBAN - MIBN - BGNR - PGNR title: SchemeName example: CHID x-enum-descriptions: - AlienRegistrationNumber - BankPartyIdentification. Unique and unambiguous assignment made by a specific bank or similar financial institution to identify a relationship as defined between the bank and its client. - Basic Bank Account Number. Represents a country-specific bank account number. - Swedish BankGiro account number. Used in domestic Swedish giro payments - PassportNumber - Clearing Identification Number - CountryIdentificationCode. Country authority given organisation identification (e.g., corporate registration number) - Card PAN (masked or plain) - CustomerIdentificationNumberIndividual. Handelsbanken-specific code - CorporateCustomerNumber - DriversLicenseNumber - Data Universal Numbering System - EmployerIdentificationNumber - GS1GLNIdentifier - International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer. - Masked IBAN - NationalIdentityNumber. Number assigned by an authority to identify the national identity number of a person. - OAUTH2 access token that is owned by the PISP being also an AISP and that can be used in order to identify the PSU - OtherCorporate. Handelsbanken-specific code - OtherIndividual. Handelsbanken-specific code - Swedish PlusGiro account number. Used in domestic Swedish giro payments - SocialSecurityNumber - The SIREN number is a 9 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation in France. - The SIRET number is a 14 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation unit in France. It consists of the SIREN number, followed by a five digit classification number, to identify the local geographical unit of that entity. - TaxIdentificationNumber RemittanceInformationLineInfo: properties: min_length: title: Min Length description: Minimum length of remittance information line type: integer max_length: title: Max Length description: Maximum length of remittance information line type: integer pattern: title: Pattern description: Specifies a regexp pattern for the remittance information line type: string type: object title: RemittanceInformationLineInfo PaymentType: type: string enum: - SEPA - INST_SEPA - DOMESTIC - CROSSBORDER - DOMESTIC_SE_GIRO - INTERNAL - BULK_SEPA - BULK_DOMESTIC - BULK_DOMESTIC_SE_GIRO title: PaymentType example: SEPA x-enum-descriptions: - Domestic bulk credit transfers - Swedish domestic bulk Giro payments (BankGiro/PlusGiro) - SEPA bulk credit transfers - Crossborder credit transfers - Domestic credit transfers - Swedish domestic Giro payments (BankGiro/PlusGiro) - Instant SEPA credit transfers (without fallback to SEPA) - Transfer made within an ASPSP - SEPA credit transfers ASPSPData: properties: name: type: string title: Name description: Name of the ASPSP (i.e. a bank or a similar financial institution) examples: - Nordea country: type: string title: Country description: Two-letter ISO 3166 code of the country, in which ASPSP operates examples: - FI logo: type: string maxLength: 2083 minLength: 1 format: uri title: Logo description: ASPSP logo URL. It is possible to transform (e.g. resize) the logo by adding special suffixes at the end of the URL. For example, `-/resize/500x/`. For full list of possible transformations, please refer to https://uploadcare.com/docs/transformations/image/ examples: - https://enablebanking.com/brands/FI/Nordea/ psu_types: items: $ref: '#/components/schemas/PSUType' type: array title: Psu Types description: List of PSU types supported by ASPSP examples: - - personal - business auth_methods: items: $ref: '#/components/schemas/AuthMethod' type: array title: Auth Methods description: List of available authentication methods. Provided in case multiple methods are available or it is possible to supply authentication credentials while initiating authorization. maximum_consent_validity: type: integer title: Maximum Consent Validity description: Maximum consent validity which bank supports in seconds sandbox: description: Applicable only to sandbox environment. Additional information necessary to use sandbox environment. $ref: '#/components/schemas/SandboxInfo' beta: type: boolean title: Beta description: Flag showing whether implementation is in beta mode bic: title: Bic description: BIC of the ASPSP type: string required_psu_headers: items: type: string type: array title: Required Psu Headers description: List of the headers required to indicate to data retrieval endpoints that PSU is online. Either all required PSU headers or none of PSU headers are to be provided, otherwise PSU_HEADER_NOT_PROVIDED error will be returned. payments: items: $ref: '#/components/schemas/ResponsePaymentType' type: array title: Payments description: Supported payment types by country and their properties group: description: Group, which the ASPSP belongs to $ref: '#/components/schemas/ASPSPGroup' type: object required: - name - country - logo - psu_types - auth_methods - maximum_consent_validity - beta title: ASPSPData example: auth_methods: - approach: REDIRECT credentials: - description: Business identity code (Y-tunnus) in 1234567-8 format name: companyId required: true template: ^\d{7}-\d$ title: Company ID hidden_method: false name: MTA psu_type: business beta: false bic: NDEAFIHH country: FI logo: https://enablebanking.com/brands/FI/Nordea/ maximum_consent_validity: 15552000 name: Nordea payments: - allowed_auth_methods: - MTA charge_bearer_values: - SLEV creditor_account_schemas: - IBAN creditor_agent_bic_fi_required: false creditor_agent_clearing_system_member_id_required: false creditor_country_required: false creditor_name_required: false creditor_postal_address_required: false currencies: - EUR debtor_account_required: true debtor_account_schemas: - IBAN debtor_contact_email_required: false debtor_contact_phone_required: false debtor_currency_required: false max_transactions: 1 payment_type: SEPA priority_codes: - NORM psu_type: business reference_number_schemas: - FIRF - INTL reference_number_supported: true regulatory_reporting_code_required: false remittance_information_lines: - max_length: 140 min_length: 1 pattern: ^.{1,140}$ remittance_information_required: true requested_execution_date_max_period: 365 requested_execution_date_supported: true psu_types: - business required_psu_headers: - Psu-Ip-Address GetApplicationResponse: properties: name: type: string title: Name description: Application name description: title: Description description: Application description type: string kid: type: string format: uuid4 title: Kid description: Application key id environment: $ref: '#/components/schemas/Environment' description: Application environment redirect_urls: items: type: string minLength: 1 format: uri type: array title: Redirect Urls description: List of allowed redirect urls active: type: boolean title: Active description: Indication whether the application is active countries: items: type: string type: array title: Countries description: List of supported countries services: items: $ref: '#/components/schemas/Service' type: array title: Services description: List of supported services type: object required: - name - kid - environment - redirect_urls - active - countries - services title: GetApplicationResponse PriorityCode: type: string enum: - HIGH - NORM - EXPR title: PriorityCode example: HIGH x-enum-descriptions: - Express priority. Polish-specific priority code - High priority - Normal priority Environment: type: string enum: - SANDBOX - PRODUCTION title: Environment example: SANDBOX x-enum-descriptions: - Live production environment - Simulation environment used for testing purposes PSUType: type: string enum: - business - personal title: PSUType example: business x-enum-descriptions: - Business/corporate users - 'Private/retail users ' GetAspspsResponse: properties: aspsps: items: $ref: '#/components/schemas/ASPSPData' type: array title: Aspsps description: List of available ASPSPs and countries type: object required: - aspsps title: GetAspspsResponse AuthMethod: properties: name: title: Name description: Internal name of the authentication method type: string title: title: Title description: Human-readable title of the authentication method type: string psu_type: $ref: '#/components/schemas/PSUType' description: PSU type to which the authentication method is applicable credentials: items: $ref: '#/components/schemas/Credential' type: array title: Credentials description: List of credentials which are possible to supply while initiating authorization approach: $ref: '#/components/schemas/AuthenticationApproach' description: Authentication approach used in the current authentication method hidden_method: type: boolean title: Hidden Method description: Flag showing whether the current authentication method is hidden from the user. If `true` then the user will not be able to select this authentication method. It is only possible to select this authentication method via API. type: object required: - psu_type - approach - hidden_method title: AuthMethod ASPSPGroup: properties: name: type: string title: Name description: Name of the group, which the ASPSP belongs to examples: - Volksbanken Raiffeisenbanken logo: type: string minLength: 1 format: uri title: Logo description: URL of the logo for the group to which the ASPSP belongs. This URL supports the same transformation postfixes as ASPSP logo URLs. examples: - https://enablebanking.com/brands/DE/Volksbanken%20Raiffeisenbanken/ type: object required: - name - logo title: ASPSPGroup ErrorCode: type: string enum: - ACCESS_DENIED - ACCOUNT_DOES_NOT_EXIST - ALREADY_AUTHORIZED - ASPSP_ACCOUNT_NOT_ACCESSIBLE - ASPSP_ERROR - ASPSP_TIMEOUT - ASPSP_RATE_LIMIT_EXCEEDED - AUTHORIZATION_NOT_PROVIDED - CLOSED_SESSION - DATE_TO_WITHOUT_DATE_FROM - DATE_FROM_IN_FUTURE - EXPIRED_AUTHORIZATION_CODE - EXPIRED_SESSION - INVALID_ACCOUNT_ID - INVALID_HOST - UNAUTHORIZED_IP - NO_ACCOUNTS_ADDED - PAYMENT_NOT_FOUND - PSU_HEADER_NOT_PROVIDED - PSU_HEADER_INVALID - REDIRECT_URI_NOT_ALLOWED - REVOKED_SESSION - SESSION_DOES_NOT_EXIST - UNAUTHORIZED_ACCESS - UNTRUSTED_PAYMENT_PARTY - WEBHOOK_URI_NOT_ALLOWED - WRONG_ASPSP_PROVIDED - WRONG_AUTHORIZATION_CODE - WRONG_DATE_INTERVAL - WRONG_CREDENTIALS_PROVIDED - WRONG_REQUEST_PARAMETERS - WRONG_SESSION_STATUS - WRONG_TRANSACTIONS_PERIOD - WRONG_CONTINUATION_KEY - TRANSACTION_DOES_NOT_EXIST - PAYMENT_LIMIT_EXCEEDED - ASPSP_PAYMENT_NOT_ACCESSIBLE - INVALID_PAYMENT - ASPSP_PSU_ACTION_REQUIRED - PAYMENT_NOT_FINALIZED title: ErrorCode example: PSU_HEADER_NOT_PROVIDED x-enum-descriptions: - Access to this resource is denied. Check services available for your application. - No account found matching provided id - Session is already authorized - The PSU does not have access to the requested account or it doesn't exist - Error interacting with ASPSP - Payment can not be requested from the ASPSP - PSU action is required to proceed - ASPSP Rate limit exceeded - Timeout interacting with ASPSP - Authorization header is not provided - Session is closed - date_from can not be in the future - date_from must be provided if date_to provided - Authorization code is expired - Session is expired - Either iban or other account identification is required - Invalid host - Invalid or expired payment provided - No allowed accounts added to the application - The amount value or the the number of transactions exceeds the limit - You can not delete a payment that is not finalized or cancelled - Payment not found - Provided PSU header contains invalid value - Required PSU header is not provided - Redirect URI not allowed - Session is revoked - No session found matching provided id - No transaction found matching provided id - Unauthorized access - Used IP address is not authorized to access the resource - Either creditor or debtor account is not trusted - Webhook URI not allowed - Wrong ASPSP name provided - Wrong authorization code provided - Wrong continuation key provided - Wrong credentials provided - date_from should be less than or equal date_to - Wrong request parameters provided - Wrong session status - Wrong transactions period requested Service: type: string enum: - AIS - PIS title: Service example: AIS x-enum-descriptions: - Account Information Service - Payment Initiation Service SandboxUser: properties: username: title: Username description: Username examples: - MyUsername type: string password: title: Password description: Password examples: - MySecretPassword type: string otp: title: Otp description: One time password examples: - '123456' type: string type: object title: SandboxUser securitySchemes: bearerAuth: scheme: bearer bearerFormat: JWT type: http description: "In order to get access to this API you need to:\n\n- Generate a private RSA key and a self-signed certificate;\n- Upload the certificate to enablebanking.com and get application ID;\n- Construct JWT with the data described below and signed with your private key;\n- Send the JWT in the Authorization header.\n\n## Private key and certificate generation\n\n> Generating private RSA key\n\n```bash\nopenssl genrsa -out private.key 4096\n```\n\nOpenSSL CLI can be used for generation of a private key and self-signed certificate.\n\nMake sure you keep the private key in secret (e.g. don't expose it to client, share\nwith anyone nor embed into mobile or other apps intalled to user devices).\n\n> Generating self-signed certificate\n\n```bash\nopenssl req -new -x509 -days 365 -key private.key -out public.crt -subj \"/C=FI/ST=Uusima/L=Helsinki/O=ExampleOrganisation/CN=www.bigorg.com\"\n```\n\nYou should replace values under `-subj` with appropriate values.\n\nAlternatively you can use the private key generated in your browser\n[when registering a new application](#certificate-upload-and-application-registration).\nJust choose **Generate in the browser (using SubtleCrypto) and export private key** option\nwhen registering an application, and the private key will be exported after the application\nhas been registered (the corresponding certificate will be used for the app registration).\n\n## Certificate upload and application registration\n\nTo register a new application you need to have an account on the \n[Enable Banking Control Panel](https://enablebanking.com/cp). You can create one by visiting\n[https://enablebanking.com/sign-in/](https://enablebanking.com/sign-in/)\nand entering your email address (a one-time authentication link will be sent to your email address).\n\nIn [the app registration form](https://enablebanking.com/cp/applications) you will be asked to\nupload the public certificate that you created for the application being registered.\n\nAn application can be registered to either `PRODUCTION` (aka \"live\") or `SANDBOX` (aka \"simulation\")\nenvironment. Applications can not be transferred from the sandbox to the production environment and\nvice versa.\n\nApplications registered into the sandbox environment are activated automatically. Applications\nregistered to the production environment at first appear as pending and will be activated either \nafter contractual formalities for the use of the API are cleared or after you \n[whitelist your own accounts](../linked-accounts/index.md). For more information please contact us at\n[info@enablebanking.com](mailto:info@enablebanking.com).\n\n

Application registration API

\n\nYou can also register an application sending POST request containing JSON with the application\ndetails and public certificate to `https://enablebanking.com/api/applications` endpoint.\n\nThe JSON body for the endpoint is to include the following fields:\n\n- \"certificate\": Content of the certificate or public key of the application (always required)\n- \"environment\": Environment (`SANDBOX` or `PRODUCTION`) in which the application will operate (always required)\n- \"name\": Name of the application being registered (always required)\n- \"redirect_urls\": List of allowed redirect URLs for the application (always required)\n- \"description\": Description of the application being registered (required when the `environment` field is set to `PRODUCTION`)\n- \"gdpr_email\": Email address for data protection matters (required when the `environment` field is set to `PRODUCTION`)\n- \"privacy_url\": URL of the application's privacy policy (required when the `environment` field is set to `PRODUCTION`)\n- \"terms_url\": URL of the application's terms of service (required when the `environment` field is set to `PRODUCTION`)\n\n> App registration example using curl\n\n```bash\ncurl -X POST -H \"Authorization: Bearer YOUR-JWT-ON-ENABLEBANKING-COM\" \\\n -H \"Content-Type: application/json\" \\\n -d \"{\\\"name\\\":\\\"My app\\\",\\\"certificate\\\":\\\"$(cat public.crt | tr '\\n' '|' | sed 's/|/\\\\n/g')\\\",\\\"environment\\\":\\\"SANDBOX\\\",\\\"redirect_urls\\\":[\\\"https://example.org/\\\"]}\" \\\n https://enablebanking.com/api/applications\n```\n\nIn response to the app registration request, you will receive an ID assigned to your application, which\nis to be used when [forming JTW token](#jwt-format-and-signature).\n\n> Example response\n\n```json\n{\n \"app_id\": \"cf589be3-3755-465b-a8df-a90a16a31403\"\n}\n```\n\n## JWT format and signature\n\n> JWT example\n\n```bash\neyJ0eXAiOiAiSldUIiwgImFsZyI6ICJSUzI1NiIsICJraWQiOiAiY2Y1ODliZTMtMzc1NS00NjViLWE4ZGYtYTkwYTE2YTMxNDAzIn0.eyJpc3MiOiAiZW5hYmxlYmFua2luZy5jb20iLCAiYXVkIjogImFwaS50aWxpc3kuY29tIiwgImlhdCI6IDE2MDE0NTY3NjgsICJleHAiOiAxNjAxNTQzMTY4fQ.daO3ENSYIA3ud7Ay7uGQ0xxqq9r4_WLcM5SbrN_6_fqsFZXFdoGQA5nKiyP8Ot4nWdYcZvaNWxEAOIodUFndOP8pjihF9-rMXuNGEjde1cq2WjYzKwiIeodUej8okDWdB--szcgurzGMd8RRMjqr951PWqnXS-PbrRsavDHp8l2q4YBjh2m80nRruKnQCAn0dtm4A5G9rZaEowo9z-c8HJU101jKddyOpHhl9UvxVrERzHtyO4LdidiP4rP1hmaVMWybSbcIMI_h30qjqWP21kYRH9ENITTttbf0uZIa8s74jKYxNIdiiDyRaq9WjoPolrHI_ZxcMjp8mmCKX-N-1w\n```\n\nYou can read more about JWT here: https://jwt.io/introduction/\n\nJWT header must contain following fields:\n\n- \"typ\": \"JWT\" (always the same)\n- \"alg\": \"RS256\" (always the same, only RS256 is supported)\n- \"kid\": \"\" (application id obtained after certificate upload)\n\nJWT body must contain following fields:\n\n- \"iss\": \"enablebanking.com\" (always the same)\n- \"aud\": \"api.enablebanking.com\" (always the same, formerly had to be \"api.tilisy.com\", which is now deprecated)\n- \"iat\": 1601456603 (timestamp when the token is being created)\n- \"exp\": 1601460262 (timestamp when the token expires)\n\nMaximum allowed time-to-live for token is 86400 seconds (24 hours). Tokens created with longer\nTTL are not accepted by the API.\n\n> Check code samples in C#, Node.js, PHP, Python and Ruby in [our GitHub repository](https://github.com/enablebanking/enablebanking-api-samples)\n\n```\nhttps://github.com/enablebanking/enablebanking-api-samples\n```\n\n## Send request with JWT provided\n\n> Example request\n\n```http\nGET https://api.enablebanking.com/application HTTP/1.1\nHost: api.enablebanking.com\nAuthorization: Bearer eyJ0eXAiOiAiSldUIiwgImFsZyI6ICJSUzI1NiIsICJraWQiOiAiY2Y1ODliZTMtMzc1NS00NjViLWE4ZGYtYTkwYTE2YTMxNDAzIn0.eyJpc3MiOiAiZW5hYmxlYmFua2luZy5jb20iLCAiYXVkIjogImFwaS5lbmFibGViYW5raW5nLmNvbSIsICJpYXQiOiAxNjAxNDU2NzY4LCAiZXhwIjogMTYwMTU0MzE2OH0.daO3ENSYIA3ud7Ay7uGQ0xxqq9r4_WLcM5SbrN_6_fqsFZXFdoGQA5nKiyP8Ot4nWdYcZvaNWxEAOIodUFndOP8pjihF9-rMXuNGEjde1cq2WjYzKwiIeodUej8okDWdB--szcgurzGMd8RRMjqr951PWqnXS-PbrRsavDHp8l2q4YBjh2m80nRruKnQCAn0dtm4A5G9rZaEowo9z-c8HJU101jKddyOpHhl9UvxVrERzHtyO4LdidiP4rP1hmaVMWybSbcIMI_h30qjqWP21kYRH9ENITTttbf0uZIa8s74jKYxNIdiiDyRaq9WjoPolrHI_ZxcMjp8mmCKX-N-1w\n```\n\nIn order to authenticate your application, you need to provide JWT in the \"Authorization\" header\nof your request.\n"