---
swagger: "2.0"
info:
  title: "Tieto OpenBanking XS2A apis - Signing Baskets Service"
  version: "1.3.4"
host: "openbanking.api.tieto.com"
tags:
- name: "Signing Baskets Service"
  description: "Signing Baskets Service"
parameters:
  envParam:
    name: "sandbox|live"
    in: "path"
    description: "The addressed environment"
    required: true
    type: "string"
    enum:
    - "sandbox"
    - "live"
paths:
  /{sandbox|live}/xs2a/v1.3/signing-baskets/{basket-id}:
    get:
      tags:
      - "Signing Baskets Service"
      operationId: "getSigningBasket"
      description: "Returns the content of signing basket object."
      consumes:
      - "application/json"
      produces:
      - "application/json"
      summary: "Signing Baskets: Get Signing Baskets Details"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "basket-id"
        in: "path"
        required: true
        type: "string"
        format: "uuid"
        description: "Resource Identification of the related signing basket."
      - name: "X-Request-ID"
        in: "header"
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      responses:
        200:
          description: "No errors occurred. Returns signing basket. link is used."
          schema:
            $ref: "#/definitions/JsonGetSigningBasketResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Consent not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a/v1.3/signing-baskets/{basket-id}/authorisations:
    get:
      tags:
      - "Signing Baskets Service"
      summary: "Signing Baskets: Get authorisation sub-resources request"
      description: "Will deliver an array of resource identifications of all generated\
        \ authorisation sub-resources."
      operationId: "signingBasketsGetAuthorizations"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "basket-id"
        in: "path"
        required: true
        type: "string"
        format: "uuid"
        description: "Resource Identification of the related signing basket."
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      responses:
        200:
          description: "Returns array of authorisation sub-resources."
          schema:
            $ref: "#/definitions/JsonGetAuthorisationsResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Consent not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
    post:
      tags:
      - "Signing Baskets Service"
      summary: "Signing Baskets: Start authorisation process"
      description: "Starts the authorisation process for a signing baskets."
      operationId: "signingBasketsStartAuthorization"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "basket-id"
        in: "path"
        required: true
        type: "string"
        format: "uuid"
        description: "Resource Identification of the related signing basket."
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "TPP-Redirect-URI"
        in: "header"
        description: "URI of the TPP, where the transaction flow shall be redirected\
          \ to after a Redirect. Mandated for the Redirect SCA Approach (including\
          \ OAuth2 SCA approach)."
        type: "string"
        format: "uri"
        required: true
      - name: "TPP-Nok-Redirect-URI"
        in: "header"
        description: "If this URI is contained, the TPP is asking to redirect the\
          \ transaction flow to this address instead of the TPP-Redirect-URI in case\
          \ of a negative result of the redirect SCA method."
        type: "string"
        format: "uri"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP."
        required: false
        type: "string"
      responses:
        201:
          description: "Created authorisation sub-resource."
          schema:
            $ref: "#/definitions/JsonPostAuthorisationsResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format; No matching subResourceService\
            \ for the requested SCA approach."
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Can't create authorisation sub-resource because consent is\
            \ in Pending state. Initial consent request may contain some validation\
            \ errors, e.g. outdated expiration date."
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Consent not found;"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a/v1.3/signing-baskets/{basket-id}/authorisations/{authorisation-id}:
    get:
      tags:
      - "Signing Baskets Service"
      summary: "Signing Baskets: Get SCA status request"
      description: "Checks the SCA status of a authorisation sub-resource."
      operationId: "signingBasketsGetAuthorizationStatus"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "basket-id"
        in: "path"
        required: true
        type: "string"
        format: "uuid"
        description: "Resource Identification of the related signing basket."
      - name: "X-Request-ID"
        in: "header"
        description: "ID of the request, unique to the call, as determined by the\
          \ initiating party."
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "authorisation-id"
        in: "path"
        description: "Identification of the related authorisation sub-resource"
        required: true
        type: "string"
      responses:
        200:
          description: "Returns authorisation SCA status."
          schema:
            $ref: "#/definitions/JsonGetAuthorisationStatusResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format;"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        403:
          description: "Can't create authorisation sub-resource because consent is\
            \ in Pending state. Initial consent request may contain some validation\
            \ errors, e.g. outdated expiration date."
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Consent not found; Authorisation sub-resource not found;"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a/v1.3/signing-baskets/{basket-id}/status:
    get:
      tags:
      - "Signing Baskets Service"
      summary: "Signing Baskets: Get Status Request"
      description: "Can check the status of a signing basket."
      operationId: "getSigningBasketStatus"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - name: "basket-id"
        in: "path"
        required: true
        type: "string"
        format: "uuid"
        description: "Resource Identification of the related signing basket."
      - name: "X-Request-ID"
        in: "header"
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      responses:
        200:
          description: "No errors ocurred. Returns signing basket's status"
          schema:
            $ref: "#/definitions/JsonGetSigningBasketStatusResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
        404:
          description: "Payment not found"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
  /{sandbox|live}/xs2a/v1.3/signing-baskets:
    post:
      tags:
      - "Signing Baskets Service"
      summary: "Signing Baskets: Create signing basket"
      description: "Creates a signing basket at the ASPSP."
      operationId: "initiateSigningBasket"
      consumes:
      - "application/json"
      produces:
      - "application/json"
      parameters:
      - $ref: "#/parameters/envParam"
      - in: "body"
        name: "body"
        required: true
        schema:
          $ref: "#/definitions/JsonPostSigningBasketRequest"
      - name: "Content-Type"
        in: "header"
        required: true
        type: "string"
      - name: "X-Request-ID"
        in: "header"
        required: true
        type: "string"
        format: "uuid"
      - name: "X-API-Key"
        in: "header"
        description: "Authorisation key that can be acquired in TPP developer portal."
        required: true
        type: "string"
      - name: "TPP-Explicit-Authorisation-Preferred"
        in: "header"
        description: "If it equals \"true\", the TPP prefers to start the authorisation\
          \ process separately, e.g. because of the usage of a signing basket. If\
          \ it equals \"false\" or if the parameter is not used, there is no preference\
          \ of the TPP."
        type: "boolean"
        default: false
      - name: "TPP-Redirect-URI"
        in: "header"
        description: "URI of the TPP, where the transaction flow shall be redirected\
          \ to after a Redirect. Mandated for the Redirect SCA Approach (including\
          \ OAuth2 SCA approach)."
        type: "string"
        format: "uri"
        required: true
      - name: "TPP-Nok-Redirect-URI"
        in: "header"
        description: "If this URI is contained, the TPP is asking to redirect the\
          \ transaction flow to this address instead of the TPP-Redirect-URI in case\
          \ of a negative result of the redirect SCA method."
        type: "string"
        format: "uri"
      - name: "PSU-IP-Address"
        in: "header"
        description: "The forwarded IP Address header field consists of the corresponding\
          \ HTTP request IP Address field between PSU and TPP."
        required: true
        type: "string"
      responses:
        201:
          description: "No errors occurred. In _links section redirect and self links\
            \ are used."
          schema:
            $ref: "#/definitions/JsonPostSigningBasketResponse"
        400:
          description: "One of mandatory parameters(headers, request body or query\
            \ parameters) missing or in incorrect format, creditor address is missing\
            \ when payment product is cross-border-credit-transfers; Only EUR currency\
            \ was used when payment product isn't cross-border-credit-transfers;"
          schema:
            $ref: "#/definitions/JsonErrorResponse"
definitions:
  JsonErrorResponse:
    type: "object"
    required:
    - "transactionStatus"
    properties:
      psuMessage:
        type: "string"
      tppMessages:
        type: "array"
        items:
          $ref: "#/definitions/JsonMessage"
      transactionStatus:
        $ref: "#/definitions/TransactionStatus"
  JsonPostSigningBasketRequest:
    type: "object"
    properties:
      paymentIds:
        type: "array"
        items:
          type: "string"
      consentIds:
        type: "array"
        items:
          type: "string"
  JsonPostSigningBasketResponse:
    type: "object"
    required:
    - "basketId"
    - "transactionStatus"
    properties:
      psuMessage:
        type: "string"
      tppMessages:
        type: "array"
        items:
          $ref: "#/definitions/JsonMessage"
      basketId:
        type: "string"
        format: "uuid"
      transactionStatus:
        $ref: "#/definitions/TransactionStatus"
      _links:
        readOnly: true
        $ref: "#/definitions/JsonLinks"
  JsonGetSigningBasketResponse:
    type: "object"
    properties:
      paymentIds:
        type: "array"
        items:
          type: "string"
      consentIds:
        type: "array"
        items:
          type: "string"
      transactionStatus:
        $ref: "#/definitions/TransactionStatus"
      _links:
        readOnly: true
        $ref: "#/definitions/JsonLinks"
  JsonGetSigningBasketStatusResponse:
    type: "object"
    required:
    - "transactionStatus"
    properties:
      transactionStatus:
        $ref: "#/definitions/TransactionStatus"
  JsonPostAuthorisationsResponse:
    type: "object"
    properties:
      psuMessage:
        type: "string"
      tppMessages:
        type: "array"
        items:
          $ref: "#/definitions/JsonMessage"
      scaStatus:
        $ref: "#/definitions/ScaStatus"
      _links:
        readOnly: true
        $ref: "#/definitions/JsonLinks"
  JsonGetAuthorisationStatusResponse:
    type: "object"
    properties:
      scaStatus:
        $ref: "#/definitions/ScaStatus"
      authorisationId:
        type: "string"
      _links:
        readOnly: true
        $ref: "#/definitions/JsonLinks"
  JsonGetAuthorisationsResponse:
    type: "object"
    properties:
      authorisationsIds:
        type: "array"
        items:
          type: "string"
  JsonHref:
    type: "object"
    properties:
      href:
        type: "string"
  JsonLinks:
    type: "object"
    properties:
      scaRedirect:
        $ref: "#/definitions/JsonHref"
      scaOAuth:
        $ref: "#/definitions/JsonHref"
      self:
        $ref: "#/definitions/JsonHref"
      status:
        $ref: "#/definitions/JsonHref"
      account:
        $ref: "#/definitions/JsonHref"
      balances:
        $ref: "#/definitions/JsonHref"
      transactions:
        $ref: "#/definitions/JsonHref"
      transactionDetails:
        $ref: "#/definitions/JsonHref"
      first:
        $ref: "#/definitions/JsonHref"
      next:
        $ref: "#/definitions/JsonHref"
      previous:
        $ref: "#/definitions/JsonHref"
      last:
        $ref: "#/definitions/JsonHref"
      download:
        $ref: "#/definitions/JsonHref"
      updatePsuIdentification:
        $ref: "#/definitions/JsonHref"
      startAuthorisation:
        $ref: "#/definitions/JsonHref"
      scaStatus:
        $ref: "#/definitions/JsonHref"
  JsonMessage:
    type: "object"
    required:
    - "category"
    - "code"
    properties:
      category:
        type: "string"
      code:
        type: "string"
      path:
        type: "string"
      text:
        type: "string"
  TransactionStatus:
    type: "string"
    enum:
    - "ACCC"
    - "ACCP"
    - "ACSC"
    - "ACSP"
    - "ACTC"
    - "ACWC"
    - "ACWP"
    - "RCVD"
    - "PDNG"
    - "RJCT"
    - "CANC"
    - "ACFC"
    - "PATC"
    - "PART"
  ScaStatus:
    type: "string"
    enum:
    - "received"
    - "psuIdentified"
    - "psuAuthenticated"
    - "scaMethodSelected"
    - "started"
    - "finalised"
    - "failed"
    - "exempted"