---
swagger: "2.0"
info:
  title: "Tieto OpenBanking XS2A apis - Card and Card account information service"
  version: "1.3.4"
host: "openbanking.api.tieto.com"
tags:
- name: "Account consent service"
  description: "Operations for establish and managing account information consent."
- name: "Card account information service"
  description: "Operations for managing card account information."
- name: "Card information service"
  description: "Operations for managing card information."
schemes:
- "http"
- "https"
parameters:
  envParam:
    name: "sandbox|live"
    in: "path"
    description: "The addressed environment"
    required: true
    type: "string"
    enum:
    - "sandbox"
    - "live"
paths:
  /{sandbox|live}/xs2a/v1.3/consents:
    post:
      tags:
      - "Account consent service"
      summary: "Account info: Establish Consent Transaction"
      description: "Creates an account information consent resource at the ASPSP regarding\
        \ access to accounts specified in this request.\nAll permitted \"access\"\
        \ attributes (\"accounts\", \"balances\" and \"transactions\") used in this\
        \ message shall carry a non-empty array of account references, indicating\
        \ the accounts where the type of access is requested. Please note that a \"\
        transactions\", \"balances\" or \"accounts\" access right also gives access\
        \ to the generic /accounts endpoints.\n\"access\" attributes can carry an\
        \ empty array, indicating that TPP is asking for accessible account list."
      operationId: "postConsent"
      consumes:
      - "application/json"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - in: "body"
        name: "body"
        required: true
        schema:
          $ref: "#/definitions/JsonPostConsentsRequest"
      - name: "Content-Type"
        in: "header"
        required: true
        type: "string"
        enum:
        - "application/json"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "TPP-Explicit-Authorisation-Preferred"
        in: "header"
        description: "If it equals \"true\", the TPP prefers to start the authorisation\
          \ process separately, e.g. because of the usage of a signing basket. If\
          \ it equals \"false\" or if the parameter is not used, there is no preference\
          \ of the TPP."
        type: "boolean"
        default: false
      - name: "TPP-Redirect-URI"
        in: "header"
        description: "URI of the TPP, where the transaction flow shall be redirected\
          \ to after a Redirect. Mandated for the Redirect SCA Approach (including\
          \ OAuth2 SCA approach)."
        type: "string"
        format: "uri"
        required: true
      - name: "TPP-Nok-Redirect-URI"
        in: "header"
        description: "If this URI is contained, the TPP is asking to redirect the\
          \ transaction flow to this address instead of the TPP-Redirect-URI in case\
          \ of a negative result of the redirect SCA method."
        type: "string"
        format: "uri"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP."
        required: false
        type: "string"
      - name: "TPP-Oauth2-Preferred"
        in: "header"
        description: "If contains true, then OAuth2 SCA is used, otherwise if contains\
          \ false or header is missing, then redirect SCA is used."
        required: false
        type: "boolean"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        201:
          description: "No errors occurred. In _links section self link is used."
          headers:
            Location:
              type: "string"
              format: "uri"
              description: "Hyperlink for the status of the resource."
          schema:
            $ref: "#/definitions/JsonPostConsentsResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format;\nFrequencyPerDay isn't 1\
            \ when recurringIndicator is false;\nCombinedServiceIndicator is true"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a/v1.3/consents/{consent-id}:
    get:
      tags:
      - "Account consent service"
      summary: "Account info: Get Consent Request"
      description: "Returns the content of an account information consent object."
      operationId: "getConsent"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "consent-id"
        in: "path"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "No errors occurred. Returns consent. In _links section viewAccounts\
            \ link is used."
          schema:
            $ref: "#/definitions/JsonGetConsentResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Consent not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
    delete:
      tags:
      - "Account consent service"
      summary: "Account info: Delete an Account Information Consent Object"
      description: "The TPP can delete an account information consent object."
      operationId: "deleteConsent"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "consent-id"
        in: "path"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        204:
          description: "No errors ocurred. Deleted consent"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Consent not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a/v1.3/consents/{consent-id}/authorisations:
    get:
      tags:
      - "Account consent service"
      summary: "Account info: Get authorisation sub-resources request"
      description: "Will deliver an array of resource identifications of all generated\
        \ authorisation sub-resources."
      operationId: "consentsGetAuthorizations"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "consent-id"
        in: "path"
        description: "Identification of the related resource"
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "Returns array of authorisation sub-resources."
          schema:
            $ref: "#/definitions/JsonGetAuthorisationsResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Consent not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
    post:
      tags:
      - "Account consent service"
      summary: "Account info: Start authorisation process"
      description: "Starts an authorisation process in for establishing account information\
        \ consent data on the server."
      operationId: "consentsStartAuthorization"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "consent-id"
        in: "path"
        description: "Identification of the related resource"
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "TPP-Redirect-URI"
        in: "header"
        description: "URI of the TPP, where the transaction flow shall be redirected\
          \ to after a Redirect. Mandated for the Redirect SCA Approach (including\
          \ OAuth2 SCA approach)."
        type: "string"
        format: "uri"
        required: true
      - name: "TPP-Nok-Redirect-URI"
        in: "header"
        description: "If this URI is contained, the TPP is asking to redirect the\
          \ transaction flow to this address instead of the TPP-Redirect-URI in case\
          \ of a negative result of the redirect SCA method."
        type: "string"
        format: "uri"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP."
        required: true
        type: "string"
      - name: "TPP-Oauth2-Preferred"
        in: "header"
        description: "If contains true, then OAuth2 SCA is used, otherwise if contains\
          \ false or header is missing, then redirect SCA is used."
        required: false
        type: "boolean"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        201:
          description: "Created authorisation sub-resource."
          schema:
            $ref: "#/definitions/JsonPostAuthorisationsResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format; No matching subResourceService\
            \ for the requested SCA approach."
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Can't create authorisation sub-resource because consent is\
            \ in Pending state. Initial consent request may contain some validation\
            \ errors, e.g. outdated expiration date."
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Consent not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a/v1.3/consents/{consent-id}/authorisations/{authorisation-id}:
    get:
      tags:
      - "Account consent service"
      summary: "Account info: Get SCA status request"
      description: "Checks the SCA status of a authorisation sub-resource."
      operationId: "consentsGetAuthorizationStatus"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "consent-id"
        in: "path"
        description: "Identification of the related resource"
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "authorisation-id"
        in: "path"
        description: "Identification of the related authorisation sub-resource"
        required: true
        type: "string"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "Returns authorisation SCA status."
          schema:
            $ref: "#/definitions/JsonGetAuthorisationStatusResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format;"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Can't create authorisation sub-resource because consent is\
            \ in Pending state. Initial consent request may contain some validation\
            \ errors, e.g. outdated expiration date."
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Consent not found; Authorisation sub-resource not found;"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a/v1.3/consents/{consent-id}/status:
    get:
      tags:
      - "Account consent service"
      summary: "Account info: Get Status Request"
      description: "Can check the status of an account information consent resource."
      operationId: "getConsentStatus"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "consent-id"
        in: "path"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "No errors ocurred. Returns the transactionStatus of the consent."
          schema:
            $ref: "#/definitions/JsonGetConsentStatusResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Consent not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a-premium/v1.3/card-accounts:
    get:
      tags:
      - "Card account information service"
      summary: "Account info: Read Account List"
      description: "Reads a list of bank accounts, with balances where required."
      operationId: "getCardAccounts"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Consent-ID"
        in: "header"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP. If PSU presence (currently\
          \ IP address) is provided with recurring consent then recurring consent\
          \ counter is not incremented. Therefore account data can be gathered without\
          \ limits."
        required: false
        type: "string"
      - name: "withBalance"
        in: "query"
        description: "If contained, this function reads the list of accessible payment\
          \ accounts including the booking balance. This call will be rejected if\
          \ the withBalance parameter is used in a case, where the access right on\
          \ balances is not granted in the related consent"
        required: false
        type: "boolean"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "No errors occurred. Return a list of card accounts. Each account's\
            \ _links section is using viewBalances and viewTransactions links."
          schema:
            $ref: "#/definitions/JsonGetCardAccountsResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        401:
          description: "Consent expired; Consent is not valid for requested resource"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Consent not found; Consent not authorized by user"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        429:
          description: "Consent access exceeded"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a-premium/v1.3/card-accounts/{account-id}:
    get:
      tags:
      - "Card account information service"
      summary: "Card account info: Read Card Account Details"
      description: "Reads details about a card account, with balances where required."
      operationId: "getCardAccount"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "account-id"
        in: "path"
        description: "This identification is denoting the addressed account. The account-id\
          \ is retrieved by using a “Read Account List” call. The account-id is the\
          \ “id” attribute of the account structure. Its value is constant at least\
          \ throughout the lifecycle of a given consent."
        required: true
        type: "string"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Consent-ID"
        in: "header"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP. If PSU presence (currently\
          \ IP address) is provided with recurring consent then recurring consent\
          \ counter is not incremented. Therefore account data can be gathered without\
          \ limits."
        required: false
        type: "string"
      - name: "withBalance"
        in: "query"
        description: "If contained, this function reads the list of accessible card\
          \ accounts including the booking balance. This call will be rejected if\
          \ the withBalance parameter is used in a case, where the access right on\
          \ balances is not granted in the related consent"
        required: false
        type: "boolean"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "No errors occurred. Returns a card account. In _links section\
            \ viewBalances and viewTransactions links will be used"
          schema:
            $ref: "#/definitions/JsonGetCardAccountResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        401:
          description: "Consent expired, consent is not valid for requested resource"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Consent absent, consent not authorized by user"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Card account not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        429:
          description: "Consent access exceeded"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a-premium/v1.3/card-accounts/{account-id}/balances:
    get:
      tags:
      - "Card account information service"
      summary: "Card account info: Read Balance"
      description: "Reads card account data from a given card account addressed by\
        \ 'account-id'."
      operationId: "getCardAccountBalances"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "account-id"
        in: "path"
        description: "This identification is denoting the addressed card account.\
          \ The account-id is retrieved by using a “Read Card account List” call.\
          \ The account-id is the “id” attribute of the card account structure. Its\
          \ value is constant at least throughout the lifecycle of a given consent."
        required: true
        type: "string"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Consent-ID"
        in: "header"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP. If PSU presence (currently\
          \ IP address) is provided with recurring consent then recurring consent\
          \ counter is not incremented. Therefore card account data can be gathered\
          \ without limits."
        required: false
        type: "string"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "No errors occurred. Returns the card account's balances"
          schema:
            $ref: "#/definitions/JsonGetCardAccountBalancesResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        401:
          description: "Consent expired, consent is not valid for requested resource"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Consent absent, consent not authorized by user"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Card account not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        429:
          description: "Consent access exceeded"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a-premium/v1.3/card-accounts/{account-id}/transactions:
    get:
      tags:
      - "Card account information service"
      summary: "Card account info: Read Transaction List"
      description: "Reads card account data from a given card account addressed by\
        \ 'account-id'."
      operationId: "getCardAccountTransactions"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "account-id"
        in: "path"
        description: "This identification is denoting the addressed card account.\
          \ The account-id is retrieved by using a “Read Card Account List” call.\
          \ The account-id is the “id” attribute of the card account structure. Its\
          \ value is constant at least throughout the lifecycle of a given consent."
        required: true
        type: "string"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Consent-ID"
        in: "header"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP. If PSU presence (currently\
          \ IP address) is provided with recurring consent then recurring consent\
          \ counter is not incremented. Therefore account data can be gathered without\
          \ limits."
        required: false
        type: "string"
      - name: "dateFrom"
        in: "query"
        description: "ISODate\nStarting date of the transaction list\nMust not be\
          \ farther then 90 days in past for recurring consent.\nMust not be farther\
          \ then 7 years in past for non-recurring consent."
        required: true
        type: "string"
        format: "date-time"
      - name: "dateTo"
        in: "query"
        description: "ISODate\nEnd date of the transaction list, default is now if\
          \ not given\nMust not be farther then 90 days in past for recurring consent.\n\
          Must not be farther then 7 years in past for non-recurring consent."
        required: false
        type: "string"
        format: "date-time"
      - name: "bookingStatus"
        in: "query"
        description: "Filter by transaction booking status"
        required: true
        type: "string"
        enum:
        - "booked"
        - "pending"
        - "both"
      - name: "withBalance"
        in: "query"
        description: "If contained, this function reads the list of accessible card\
          \ accounts including the booking balance. This call will be rejected if\
          \ the withBalance parameter is used in a case, where the access right on\
          \ balances is not granted in the related consent"
        required: false
        type: "boolean"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "No errors occurred. Returns card account's transactions. In\
            \ _links section viewCardAccount link will be used."
          schema:
            $ref: "#/definitions/JsonGetCardAccountTransactionsResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        401:
          description: "Consent expired, consent is not valid for requested resource"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Consent absent, consent not authorized by user"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Card account not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        429:
          description: "Consent access exceeded"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a-premium/v1.3/card-accounts/{account-id}/transactions/{transactionId}:
    get:
      tags:
      - "Card account information service"
      summary: "Card account info: Read Transaction details"
      description: "Reads transaction data from a given card account addressed by\
        \ 'account-id' and 'transactionId'. This call is only available on transactions\
        \ as reported in a JSON format."
      operationId: "getCardAccountTransaction"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "account-id"
        in: "path"
        description: "This identification is denoting the addressed card account.\
          \ The account-id is retrieved by using a “Read Card Account List” call.\
          \ The account-id is the “id” attribute of the card account structure. Its\
          \ value is constant at least throughout the lifecycle of a given consent."
        required: true
        type: "string"
      - name: "transactionId"
        in: "path"
        description: "This identification is denoting the addressed transaction. The\
          \ transactionId is retrieved by using a “Read Transaction List” call. The\
          \ transactionId is the “id” attribute of the transaction structure. Its\
          \ value is constant at least throughout the lifecycle of a given consent."
        required: true
        type: "string"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Consent-ID"
        in: "header"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP. If PSU presence (currently\
          \ IP address) is provided with recurring consent then recurring consent\
          \ counter is not incremented. Therefore account data can be gathered without\
          \ limits."
        required: false
        type: "string"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "No errors occurred. Returns transaction details."
          schema:
            $ref: "#/definitions/JsonGetCardAccountTransactionDetailsResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        401:
          description: "Consent expired, consent is not valid for requested resource"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Consent absent, consent not authorized by user"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Card account not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        429:
          description: "Consent access exceeded"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a-premium/v1.3/cards:
    get:
      tags:
      - "Card information service"
      summary: "Card info: Read Card List"
      description: "Reads a list of bank cards, with balances where required."
      operationId: "getCards"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Consent-ID"
        in: "header"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP. If PSU presence (currently\
          \ IP address) is provided with recurring consent then recurring consent\
          \ counter is not incremented. Therefore card data can be gathered without\
          \ limits."
        required: false
        type: "string"
      - name: "withBalance"
        in: "query"
        description: "If contained, this function reads the list of accessible cards\
          \ including the booking balance. This call will be rejected if the withBalance\
          \ parameter is used in a case, where the access right on balances is not\
          \ granted in the related consent"
        required: false
        type: "boolean"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "No errors occurred. Return a list of cards. Each cards's _links\
            \ section is using viewBalances and viewTransactions links."
          schema:
            $ref: "#/definitions/JsonGetCardsResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        401:
          description: "Consent expired; Consent is not valid for requested resource"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Consent not found; Consent not authorized by user"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        429:
          description: "Consent access exceeded"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a-premium/v1.3/cards/{card-id}:
    get:
      tags:
      - "Card information service"
      summary: "Card info: Read Card Details"
      description: "Reads details about an card, with balances where required."
      operationId: "getCard"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "card-id"
        in: "path"
        description: "This identification is denoting the addressed card. The card-id\
          \ is retrieved by using a “Read Card List” call. The card-id is the “id”\
          \ attribute of the card structure. Its value is constant at least throughout\
          \ the lifecycle of a given consent."
        required: true
        type: "string"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Consent-ID"
        in: "header"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP. If PSU presence (currently\
          \ IP address) is provided with recurring consent then recurring consent\
          \ counter is not incremented. Therefore account data can be gathered without\
          \ limits."
        required: false
        type: "string"
      - name: "withBalance"
        in: "query"
        description: "If contained, this function reads the list of accessible cards\
          \ including the booking balance. This call will be rejected if the withBalance\
          \ parameter is used in a case, where the access right on balances is not\
          \ granted in the related consent"
        required: false
        type: "boolean"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "No errors occurred. Returns a card. In _links section viewBalances\
            \ and viewTransactions links will be used"
          schema:
            $ref: "#/definitions/JsonGetCardResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        401:
          description: "Consent expired, consent is not valid for requested resource"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Consent absent, consent not authorized by user"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Card not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        429:
          description: "Consent access exceeded"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a-premium/v1.3/cards/{card-id}/balances:
    get:
      tags:
      - "Card information service"
      summary: "Card info: Read Balance"
      description: "Reads card data from a given card addressed by 'card-id'."
      operationId: "getCardBalances"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "card-id"
        in: "path"
        description: "This identification is denoting the addressed card. The card-id\
          \ is retrieved by using a “Read Card List” call. The card-id is the “id”\
          \ attribute of the card structure. Its value is constant at least throughout\
          \ the lifecycle of a given consent."
        required: true
        type: "string"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Consent-ID"
        in: "header"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP. If PSU presence (currently\
          \ IP address) is provided with recurring consent then recurring consent\
          \ counter is not incremented. Therefore account data can be gathered without\
          \ limits."
        required: false
        type: "string"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "No errors ocurred. Returns the card's balances"
          schema:
            $ref: "#/definitions/JsonGetCardBalancesResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        401:
          description: "Consent expired, consent is not valid for requested resource"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Consent absent, consent not authorized by user"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Card not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        429:
          description: "Consent access exceeded"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a-premium/v1.3/cards/{card-id}/transactions:
    get:
      tags:
      - "Card information service"
      summary: "Card info: Read Transaction List"
      description: "Reads card data from a given card addressed by 'card-id'."
      operationId: "getCardTransactions"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "card-id"
        in: "path"
        description: "This identification is denoting the addressed card. The card-id\
          \ is retrieved by using a “Read Card List” call. The card-id is the “id”\
          \ attribute of the card structure. Its value is constant at least throughout\
          \ the lifecycle of a given consent."
        required: true
        type: "string"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Consent-ID"
        in: "header"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP. If PSU presence (currently\
          \ IP address) is provided with recurring consent then recurring consent\
          \ counter is not incremented. Therefore account data can be gathered without\
          \ limits."
        required: false
        type: "string"
      - name: "dateFrom"
        in: "query"
        description: "ISODate\nStarting date of the transaction list\nMust not be\
          \ farther then 90 days in past for recurring consent.\nMust not be farther\
          \ then 7 years in past for non-recurring consent."
        required: true
        type: "string"
        format: "date-time"
      - name: "dateTo"
        in: "query"
        description: "ISODate\nEnd date of the transaction list, default is now if\
          \ not given\nMust not be farther then 90 days in past for recurring consent.\n\
          Must not be farther then 7 years in past for non-recurring consent."
        required: false
        type: "string"
        format: "date-time"
      - name: "bookingStatus"
        in: "query"
        description: "Filter by transaction booking status"
        required: true
        type: "string"
        enum:
        - "booked"
        - "pending"
        - "both"
      - name: "withBalance"
        in: "query"
        description: "If contained, this function reads the list of accessible cards\
          \ including the booking balance. This call will be rejected if the withBalance\
          \ parameter is used in a case, where the access right on balances is not\
          \ granted in the related consent"
        required: false
        type: "boolean"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "No errors ocurred. Returns card's transactions. In _links\
            \ section viewCard link will be used."
          schema:
            $ref: "#/definitions/JsonGetCardTransactionsResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        401:
          description: "Consent expired, consent is not valid for requested resource"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Consent absent, consent not authorized by user"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Card not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        429:
          description: "Consent access exceeded"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a-premium/v1.3/cards/{card-id}/transactions/{transactionId}:
    get:
      tags:
      - "Card information service"
      summary: "Card info: Read Transaction details"
      description: "Reads transaction data from a given card addressed by 'card-id'\
        \ and 'transactionId'. This call is only available on transactions as reported\
        \ in a JSON format."
      operationId: "getCardTransaction"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "card-id"
        in: "path"
        description: "This identification is denoting the addressed card. The card-id\
          \ is retrieved by using a “Read Card List” call. The card-id is the “id”\
          \ attribute of the card structure. Its value is constant at least throughout\
          \ the lifecycle of a given consent."
        required: true
        type: "string"
      - name: "transactionId"
        in: "path"
        description: "This identification is denoting the addressed transaction. The\
          \ transactionId is retrieved by using a “Read Transaction List” call. The\
          \ transactionId is the “id” attribute of the transaction structure. Its\
          \ value is constant at least throughout the lifecycle of a given consent."
        required: true
        type: "string"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "Consent-ID"
        in: "header"
        description: "Shall be contained since “Establish Consent Transaction” was\
          \ performed via this API before."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP. If PSU presence (currently\
          \ IP address) is provided with recurring consent then recurring consent\
          \ counter is not incremented. Therefore account data can be gathered without\
          \ limits."
        required: false
        type: "string"
      - name: "Authorization"
        in: "header"
        description: "Is contained only, if an OAuth2 based SCA was performed in the\
          \ related consent authorisation."
        required: false
        type: "string"
      - name: "PSU-ID"
        in: "header"
        description: "Client ID of the PSU in the bank."
        required: false
        type: "string"
      - name: "PSU-Corporate-ID"
        in: "header"
        description: "Corporate client ID of the PSU in the bank."
        required: false
        type: "string"
      responses:
        200:
          description: "No errors occurred. Returns transaction details."
          schema:
            $ref: "#/definitions/JsonGetCardTransactionDetailsResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        401:
          description: "Consent expired, consent is not valid for requested resource"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Consent absent, consent not authorized by user"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Card not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        429:
          description: "Consent access exceeded"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
definitions:
  JsonErrorResponse:
    type: "object"
    required:
    - "transactionStatus"
    properties:
      psuMessage:
        type: "string"
      tppMessages:
        type: "array"
        items:
          $ref: "#/definitions/JsonMessage"
      transactionStatus:
        $ref: "#/definitions/TransactionStatus"
  JsonGetCardAccountResponse:
    type: "object"
    required:
    - "cardAccount"
    properties:
      cardAccount:
        $ref: "#/definitions/JsonCardAccountDetails"
  JsonGetCardAccountBalancesResponse:
    type: "object"
    required:
    - "balances"
    properties:
      cardAccount:
        $ref: "#/definitions/JsonAccountReference"
      balances:
        type: "array"
        items:
          $ref: "#/definitions/JsonBalance"
  JsonGetCardAccountsResponse:
    type: "object"
    required:
    - "cardAccounts"
    properties:
      cardAccounts:
        type: "array"
        items:
          $ref: "#/definitions/JsonCardAccountDetails"
  JsonGetCardsResponse:
    type: "object"
    required:
    - "cards"
    properties:
      cards:
        type: "array"
        items:
          $ref: "#/definitions/JsonCardAccountDetails"
  JsonGetCardResponse:
    type: "object"
    required:
    - "card"
    properties:
      card:
        $ref: "#/definitions/JsonCardAccountDetails"
  JsonGetCardBalancesResponse:
    type: "object"
    required:
    - "balances"
    properties:
      card:
        $ref: "#/definitions/JsonAccountReference"
      balances:
        type: "array"
        items:
          $ref: "#/definitions/JsonBalance"
  JsonGetCardTransactionsResponse:
    type: "object"
    properties:
      card:
        $ref: "#/definitions/JsonAccountReference"
      cardTransactions:
        $ref: "#/definitions/JsonCardAccountReport"
      balances:
        type: "array"
        items:
          $ref: "#/definitions/JsonBalance"
      _links:
        $ref: "#/definitions/JsonLinks"
  JsonGetAuthorisationStatusResponse:
    type: "object"
    properties:
      scaStatus:
        $ref: "#/definitions/ScaStatus"
      authorisationId:
        type: "string"
      _links:
        readOnly: true
        $ref: "#/definitions/JsonLinks"
  JsonGetAuthorisationsResponse:
    type: "object"
    properties:
      authorisationsIds:
        type: "array"
        items:
          type: "string"
  JsonGetConsentResponse:
    type: "object"
    required:
    - "access"
    - "combinedServiceIndicator"
    - "consentStatus"
    - "frequencyPerDay"
    - "recurringIndicator"
    - "validUntil"
    properties:
      access:
        $ref: "#/definitions/JsonAccountAccess"
      recurringIndicator:
        type: "boolean"
        description: "true, if the consent is for recurring access to the account\
          \ data false, if the consent is for one access to the account data"
      validUntil:
        type: "string"
        description: "This parameter is indicates a valid until date for the requested\
          \ consent. The content is date in ISODate Format, e.g. 2017-10-30. For recurring consents validUntil must
            not be farther then 180 days in future."
      frequencyPerDay:
        type: "string"
        description: "This field indicates the requested maximum frequency for an\
          \ access without PSU involvement per day. For a one-off access, this attribute\
          \ is set to \"1\"."
      combinedServiceIndicator:
        type: "boolean"
        example: false
        description: "Unsupported mandatory field. Must be set to false"
      consentStatus:
        $ref: "#/definitions/ConsentStatus"
      _links:
        readOnly: true
        $ref: "#/definitions/JsonLinks"
  JsonGetConsentStatusResponse:
    type: "object"
    properties:
      consentStatus:
        $ref: "#/definitions/ConsentStatus"
  JsonPostAuthorisationsResponse:
    type: "object"
    properties:
      psuMessage:
        type: "string"
      tppMessages:
        type: "array"
        items:
          $ref: "#/definitions/JsonMessage"
      scaStatus:
        $ref: "#/definitions/ScaStatus"
      _links:
        readOnly: true
        $ref: "#/definitions/JsonLinks"
  JsonPostConsentsRequest:
    type: "object"
    required:
    - "access"
    - "combinedServiceIndicator"
    - "frequencyPerDay"
    - "recurringIndicator"
    - "validUntil"
    properties:
      access:
        $ref: "#/definitions/JsonAccountAccess"
      recurringIndicator:
        type: "boolean"
        description: "true, if the consent is for recurring access to the account\
          \ data false, if the consent is for one access to the account data"
      validUntil:
        type: "string"
        description: "This parameter is requesting a valid until date for the requested\
          \ consent. The content is the local ASPSP date in ISODate Format, e.g. 2017-10-30. For recurring consents validUntil must
            not be farther then 180 days in future."
      frequencyPerDay:
        type: "string"
        description: "This field indicates the requested maximum frequency for an\
          \ access without PSU involvement per day. For a one-off access, this attribute\
          \ is set to \"1\"."
      combinedServiceIndicator:
        type: "boolean"
        example: false
        description: "Unsupported mandatory field. Must be set to false"
  JsonPostConsentsResponse:
    type: "object"
    properties:
      psuMessage:
        type: "string"
      tppMessages:
        type: "array"
        items:
          $ref: "#/definitions/JsonMessage"
      consentId:
        type: "string"
        format: "uuid"
      consentStatus:
        $ref: "#/definitions/ConsentStatus"
      _links:
        readOnly: true
        $ref: "#/definitions/JsonLinks"
  JsonGetCardAccountTransactionDetailsResponse:
    type: "object"
    properties:
      transactionsDetails:
        $ref: "#/definitions/JsonCardTransaction"
  JsonAccountAccess:
    type: "object"
    properties:
      accounts:
        type: "array"
        items:
          $ref: "#/definitions/JsonAccountReference"
      balances:
        type: "array"
        items:
          $ref: "#/definitions/JsonAccountReference"
      transactions:
        type: "array"
        items:
          $ref: "#/definitions/JsonAccountReference"
      restrictedTo:
        type: "array"
        items:
          $ref: "#/definitions/CashAccountType"
  JsonCardAccountDetails:
    type: "object"
    required:
    - "maskedPan"
    - "currency"
    properties:
      maskedPan:
        type: "string"
      currency:
        type: "string"
      resourceId:
        type: "string"
      ownerName:
        type: "string"
      name:
        type: "string"
      displayName:
        type: "string"
      balances:
        type: "array"
        items:
          $ref: "#/definitions/JsonBalance"
      product:
        type: "string"
      status:
        $ref: "#/definitions/AccountStatus"
      usage:
        $ref: "#/definitions/AccountUsage"
      details:
        type: "string"
      creditLimit:
        $ref: "#/definitions/JsonAmount"
      _links:
        $ref: "#/definitions/JsonLinks"
    description: "JsonCardAccountDetails must contain maskedPan field"
  JsonGetCardAccountTransactionsResponse:
    type: "object"
    properties:
      cardAccount:
        $ref: "#/definitions/JsonAccountReference"
      cardTransactions:
        $ref: "#/definitions/JsonCardAccountReport"
      balances:
        type: "array"
        items:
          $ref: "#/definitions/JsonBalance"
      _links:
        $ref: "#/definitions/JsonLinks"
  JsonGetCardTransactionDetailsResponse:
    type: "object"
    properties:
      transactionsDetails:
        $ref: "#/definitions/JsonCardTransaction"
  JsonAccountReference:
    type: "object"
    properties:
      iban:
        type: "string"
      bban:
        type: "string"
      pan:
        type: "string"
      maskedPan:
        type: "string"
      msisdn:
        type: "string"
      currency:
        type: "string"
      cashAccountType:
        $ref: "#/definitions/CashAccountType"
    description: "Must contain one of iban,bban,maskedPan,msisdn or pan field"
  JsonCardAccountReport:
    type: "object"
    required:
    - "booked"
    - "_links"
    properties:
      booked:
        type: "array"
        items:
          $ref: "#/definitions/JsonCardTransaction"
      pending:
        type: "array"
        items:
          $ref: "#/definitions/JsonCardTransaction"
      _links:
        $ref: "#/definitions/JsonLinks"
  JsonAmount:
    type: "object"
    required:
    - "amount"
    - "currency"
    properties:
      currency:
        type: "string"
      amount:
        type: "string"
  JsonBalance:
    type: "object"
    required:
    - "balanceAmount"
    - "balanceType"
    properties:
      balanceAmount:
        $ref: "#/definitions/JsonAmount"
      balanceType:
        $ref: "#/definitions/BalanceType"
      referenceDate:
        type: "string"
      lastChangeDateTime:
        type: "string"
      lastCommittedTransaction:
        type: "string"
  JsonHref:
    type: "object"
    properties:
      href:
        type: "string"
  JsonLinks:
    type: "object"
    properties:
      scaRedirect:
        $ref: "#/definitions/JsonHref"
      scaOAuth:
        $ref: "#/definitions/JsonHref"
      self:
        $ref: "#/definitions/JsonHref"
      status:
        $ref: "#/definitions/JsonHref"
      account:
        $ref: "#/definitions/JsonHref"
      balances:
        $ref: "#/definitions/JsonHref"
      transactions:
        $ref: "#/definitions/JsonHref"
      transactionDetails:
        $ref: "#/definitions/JsonHref"
      first:
        $ref: "#/definitions/JsonHref"
      next:
        $ref: "#/definitions/JsonHref"
      previous:
        $ref: "#/definitions/JsonHref"
      last:
        $ref: "#/definitions/JsonHref"
      download:
        $ref: "#/definitions/JsonHref"
      updatePsuIdentification:
        $ref: "#/definitions/JsonHref"
      startAuthorisation:
        $ref: "#/definitions/JsonHref"
      scaStatus:
        $ref: "#/definitions/JsonHref"
  JsonMessage:
    type: "object"
    required:
    - "category"
    - "code"
    properties:
      category:
        type: "string"
      code:
        type: "string"
      path:
        type: "string"
      text:
        type: "string"
  JsonCardTransaction:
    type: "object"
    required:
    - "transactionAmount"
    properties:
      cardTransactionId:
        type: "string"
      terminalId:
        type: "string"
      transactionDate:
        type: "string"
      acceptorTransactionDateTime:
        type: "string"
      bookingDate:
        type: "string"
      transactionAmount:
        $ref: "#/definitions/JsonAmount"
      currencyExchange:
        type: "array"
        items:
          $ref: "#/definitions/JsonReportExchangeRate"
      originalAmount:
        $ref: "#/definitions/JsonAmount"
      markupFee:
        $ref: "#/definitions/JsonAmount"
      markupFeePercentage:
        type: "string"
      cardAcceptorId:
        type: "string"
      cardAcceptorAddress:
        $ref: "#/definitions/JsonAddress"
      cardAcceptorPhone:
        type: "string"
      merchantCategoryCode:
        type: "string"
      maskedPAN:
        type: "string"
      transactionDetails:
        type: "string"
      invoiced:
        type: "boolean"
      proprietaryBankTransactionCode:
        type: "string"
  JsonReportExchangeRate:
    type: "object"
    required:
    - "sourceCurrency"
    - "exchangeRate"
    - "unitCurrency"
    properties:
      sourceCurrency:
        type: "string"
      exchangeRate:
        type: "string"
      unitCurrency:
        type: "string"
  JsonAddress:
    type: "object"
    required:
    - "country"
    properties:
      streetName:
        type: "string"
      buildingNumber:
        type: "string"
      townName:
        type: "string"
      postCode:
        type: "string"
      country:
        type: "string"
        description: "Country Code"
  CashAccountType:
    type: "string"
    enum:
    - "CACC"
    - "CARD"
  TransactionStatus:
    type: "string"
    enum:
    - "ACCC"
    - "ACCP"
    - "ACSC"
    - "ACSP"
    - "ACTC"
    - "ACWC"
    - "ACWP"
    - "RCVD"
    - "PDNG"
    - "RJCT"
    - "CANC"
    - "ACFC"
    - "PATC"
    - "PART"
  ScaStatus:
    type: "string"
    enum:
    - "received"
    - "psuIdentified"
    - "psuAuthenticated"
    - "scaMethodSelected"
    - "started"
    - "finalised"
    - "failed"
    - "exempted"
  BalanceType:
    type: "string"
    enum:
    - "closingBooked"
    - "expected"
    - "openingBooked"
    - "interimAvailable"
    - "interimBooked"
    - "forwardAvailable"
    - "nonInvoiced"
  ConsentStatus:
    type: "string"
    enum:
    - "received"
    - "rejected"
    - "valid"
    - "revokedByPsu"
    - "expired"
    - "terminatedByTpp"
  AccountStatus:
    type: "string"
    enum:
    - "enabled"
    - "deleted"
    - "blocked"
  AccountUsage:
    type: "string"
    enum:
    - "PRIV"
    - "ORGA"
  JsonTransaction:
    properties:
      remittanceInformationStructured:
        type: "object"
        required:
        - "reference"
        properties:
          reference:
            type: "string"
          referenceType:
            type: "string"
          referenceIssuer:
            type: "string"