openapi: 3.0.1
info:
  title: Token.io's Open Banking API for TPPs Account on File Webhooks API
  description: '<b>Token.io''s Open Banking API</b><br/><br/>Token.io Support: <a href="https://support.token.io" target="_blank">support.token.io</a><br/><br/>The Token.io Open Banking API enables you to connect securely with banks for a range of services.<br/><br/> Using our API you can: <ul><li>provide authorized access to an authenticated user''s account information</li><li>get information on specific banks</li><li>initiate authorization with a user-selected bank</li><li>initate and track single immediate payments and future dated payments</li><li>use variable recurring payments (VRP) to grant long-held consents to Payment Initiation Service Providers (PISPs) to initiate series of payments from users'' bank accounts</li><li>carry out settlements, payments and refunds using our settlement accounts</li></ul><br/>For more information see our <a href="https://developer.token.io/token_rest_api_doc/content/e-rest/dashboard-intro.htm" target="_blank">developer documentation</a>.'
  version: ''
servers:
- url: https://api.token.io
tags:
- name: Webhooks
  description: These endpoints configure, retrieve and remove webhooks. See <a href="https://developer.token.io/token_rest_api_doc/content/e-rest/api-basics.htm#Webhook" target="_blank">Webhooks</a> for more details.
paths:
  /webhook/config:
    put:
      tags:
      - Webhooks
      summary: Set webhook config
      description: The `PUT /webhook/config` endpoint sets the webhook configuration.
      operationId: GatewayService.SetWebhookConfig
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetWebhookConfigRequest'
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SetWebhookConfigResponse'
        '400':
          description: The client specified an invalid argument
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_400'
        '401':
          description: The authorization information is missing or invalid
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_401'
        '403':
          description: Permission to access this endpoint is denied
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_403'
        '404':
          description: The requested entity, such as a payment, was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_404'
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_429'
        '500':
          description: An unexpected or internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_500'
        '501':
          description: The operation was not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_501'
        '503':
          description: Service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_503'
        '504':
          description: Gateway has timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_504'
      deprecated: false
      security:
      - Bearer: []
      - BasicAuth: []
      x-hideTryItPanel: true
    get:
      tags:
      - Webhooks
      summary: Get webhook config
      description: The `GET /webhook/config` endpoint retrieves the webhook configuration.
      operationId: GatewayService.GetWebhookConfig
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWebhookConfigResponse'
        '400':
          description: The client specified an invalid argument
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_400'
        '401':
          description: The authorization information is missing or invalid
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_401'
        '403':
          description: Permission to access this endpoint is denied
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_403'
        '404':
          description: The requested entity, such as a payment, was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_404'
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_429'
        '500':
          description: An unexpected or internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_500'
        '501':
          description: The operation was not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_501'
        '503':
          description: Service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_503'
        '504':
          description: Gateway has timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_504'
      deprecated: false
      security:
      - Bearer: []
      - BasicAuth: []
      x-hideTryItPanel: true
    delete:
      tags:
      - Webhooks
      summary: Delete webhook config
      description: The `DELETE /webhook/config` endpoint deletes the webhook configuration.
      operationId: GatewayService.DeleteWebhookConfig
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteWebhookConfigResponse'
        '400':
          description: The client specified an invalid argument
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_400'
        '401':
          description: The authorization information is missing or invalid
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_401'
        '403':
          description: Permission to access this endpoint is denied
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_403'
        '404':
          description: The requested entity, such as a payment, was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_404'
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_429'
        '500':
          description: An unexpected or internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_500'
        '501':
          description: The operation was not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_501'
        '503':
          description: Service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_503'
        '504':
          description: Gateway has timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response_504'
      deprecated: false
      security:
      - Bearer: []
      - BasicAuth: []
      x-hideTryItPanel: true
components:
  schemas:
    PaymentNotFoundError:
      required:
      - paymentId
      type: object
      properties:
        errorCode:
          example: NOT_FOUND
        paymentId:
          type: string
          description: The requested entity, the `paymentID`, was not found.
          example: pm2:12345abcd:abcde
      description: 'The error object returned when given payment cannot be found: ResourceNotFound.'
      allOf:
      - $ref: '#/components/schemas/ErrorWithCode'
    inline_response_500:
      properties:
        error:
          allOf:
          - type: object
            properties:
              errorCode:
                type: string
                description: This is a textual error code categorising the error.
                example: InternalServerError
          - $ref: '#/components/schemas/ServerError'
    SetWebhookConfigResponse:
      type: object
      description: No data included or required in the response.
    inline_response_504:
      required:
      - error
      type: object
      properties:
        error:
          $ref: '#/components/schemas/GatewayTimeoutError'
    inline_response_400:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/Error'
    ServerError:
      type: object
      properties:
        message:
          type: string
          description: A description of the error.
          example: This is a description of the error.
        tokenTraceId:
          type: string
          description: The trace identifier for the given call.
          example: '5678912345'
      description: 'This could refer to either an error by the payment service provider or the bank. When the bank reports a 5xx error, `"token-external-error": "true"` is set as a header in the HTTP response, indicating that the "internal" error originates from the bank. When one of the payment service providers internal services fails or when the bank reports a 4xx error, this header is not populated. The absence of this response header should be interpreted as `"token-external-error": "false"`.'
      allOf:
      - $ref: '#/components/schemas/ErrorWithCode'
    inline_response_501:
      required:
      - error
      type: object
      properties:
        error:
          $ref: '#/components/schemas/NotImplementedError'
    Error:
      type: object
      properties:
        message:
          type: string
          description: A description of the error.
          example: This is a description of the error.
        tokenTraceId:
          type: string
          description: The trace identifier for the given call.
          example: '5678912345'
      description: The request does not have valid authentication credentials needed to perform the operation.
    ResourceExhaustedError:
      required:
      - paymentId
      type: object
      properties:
        errorCode:
          example: RESOURCE_EXHAUSTED
        paymentId:
          type: string
          description: The maximum number of requests has been reached.
          example: Resource exhausted. Check quota.
      description: Resource exhausted. Too many requests.
      allOf:
      - $ref: '#/components/schemas/ErrorWithCode'
    EventType:
      type: string
      description: Specifies the types of webhook currently configured.
      example: PAYMENT_STATUS_CHANGED
      enum:
      - INVALID
      - TRANSFER_STATUS_CHANGED
      - STANDING_ORDER_STATUS_CHANGED
      - REFUND_STATUS_CHANGED
      - PAYMENT_STATUS_CHANGED
      - VRP_STATUS_CHANGED
      - VRP_CONSENT_STATUS_CHANGED
      - VIRTUAL_ACCOUNT_CREDIT_RECEIVED
      - PAYOUT_STATUS_CHANGED
      - SETTLEMENT_RULE_PAYOUT_EXECUTION_FAILED
      - BANK_AIS_OUTAGE_STATUS_CHANGED
      - BANK_SIP_OUTAGE_STATUS_CHANGED
    inline_response_404:
      required:
      - error
      type: object
      properties:
        error:
          $ref: '#/components/schemas/PaymentNotFoundError'
    ErrorWithCode:
      required:
      - errorCode
      - message
      type: object
      properties:
        errorCode:
          type: string
          description: A textual error code categorising the error.
          example: InternalServerError
        message:
          type: string
          description: A description of the error that occurred and a possible way to fix it.
          example: '`RefId` should not be longer than 35 symbols.'
      description: Error object providing details about the error.
      allOf:
      - $ref: '#/components/schemas/Error'
    Config:
      required:
      - type
      - url
      type: object
      properties:
        type:
          type: array
          items:
            $ref: '#/components/schemas/EventType'
        url:
          type: string
          description: Specifies the webhook URL that receives the status updates.
          example: your-webhook-url.com
      description: Specifies the types of webhook currently configured.
    DeleteWebhookConfigResponse:
      type: object
      description: No data returned in the successful response.
    inline_response_403:
      required:
      - error
      type: object
      properties:
        error:
          $ref: '#/components/schemas/PermissionDeniedError'
    SetWebhookConfigRequest:
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Config'
    ServiceUnavailableError:
      required:
      - paymentId
      type: object
      properties:
        errorCode:
          example: UNAVAILABLE
        paymentId:
          type: string
          description: The service is unavailable, likely due to a transient condition; this is usually corrected with a retry.
          example: Unavailable
      description: Service is unavailable, likely due to a transient condition; this is usually corrected with a retry.
      allOf:
      - $ref: '#/components/schemas/ErrorWithCode'
    inline_response_401:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/Error'
    inline_response_429:
      required:
      - error
      type: object
      properties:
        error:
          $ref: '#/components/schemas/ResourceExhaustedError'
    PermissionDeniedError:
      type: object
      properties:
        errorCode:
          example: PermissionDenied
      description: 'The error returned when the member is not authorized to perform the given operation: PermissionDenied. <br/>This error message will be accompanied by the reason from the bank. Typically this means the access token has expired and the user must re-authenticate with the bank.'
      allOf:
      - $ref: '#/components/schemas/ErrorWithCode'
    GatewayTimeoutError:
      required:
      - paymentId
      type: object
      properties:
        errorCode:
          example: DEADLINE_EXCEEDED
        paymentId:
          type: string
          description: The deadline expired before the operation could complete.
          example: Deadline exceeded.
      description: The deadline expired before the operation could complete.
      allOf:
      - $ref: '#/components/schemas/ErrorWithCode'
    GetWebhookConfigResponse:
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Config'
      description: Specifies details of the webhook.
    NotImplementedError:
      required:
      - paymentId
      type: object
      properties:
        errorCode:
          example: UNIMPLEMENTED
        paymentId:
          type: string
          description: The operation was not implemented,supported or enabled by the bank.
          example: Not implemented.
      description: The operation was not implemented, supported or enabled by the bank.
      allOf:
      - $ref: '#/components/schemas/ErrorWithCode'
    inline_response_503:
      required:
      - error
      type: object
      properties:
        error:
          $ref: '#/components/schemas/ServiceUnavailableError'
  securitySchemes:
    Bearer:
      type: http
      description: '**For Production and Sandbox environments.**<br />When using curl samples the authorization header is given as -H `''Authorization: Bearer + JWT''`<br/>Please substitute your Bearer key here.<br/>For example:<br/> -H `''Authorization: Bearer eyJhbGciOiJFZERTQSIsImtpZCI6IjF4N2RmNHZ1RlVIWVFDYTciLCJtaWQiOiJtOlhUalhlMkFQZTRvdmVaalE4cHoyNGdEbUZEcTo1ekt0WEVBcSIsImhvc3QiOiJsb2NhbGhvc3Q6ODAwMCIsIm1ldGhvZCI6IlBPU1QiLCJwYXRoIjoiL2JhbmtzL2lyb24vdXNlcnMiLCJleHAiOjE1ODYyOTczNDQ3ODd9..bi3wxEoMHIul_F2f7gCDvgjHQKCjIyP9_SkQns-yXpS0UqoaOqSJrW89COexU71gt-mH3jH6mtp2aksEywvFDg''`<br/>Enter the JWT Bearer token only (see <a href="https://developer.token.io/token_rest_api_doc/content/e-rest/authentication.htm#JWT" target="_blank">JWT Authentication</a> for more information).'
      scheme: bearer
      bearerFormat: JWT
    BasicAuth:
      type: apiKey
      description: '**For Sandbox environment only.**<br />When using curl samples the authorization header is given as -H `''Authorization: YOUR_API_KEY_HERE''`<br/>Please substitute your Basic key here.<br/>For example:<br/> -H `''Authorization: Basic bS0zanhoS3pqRjRSWFQ1dHZLTlhMQU14cm80d0E1LTV6S3RYRUFxOmU1MWZjZDQ0LTM5MGQtNDYxZi04YjA0LTEyMjcxOTg4YWYwNg==''`'
      name: Authorization
      in: header