Events - UK OB

API Overview

The Aggregated Polling API allows a bank to deliver multiple signed event notifications to TPPs though the use of polling. It is intended as an alternative or complement to Real Time Notification in that:

• It can be used as the sole method to collect event notifications by a TPP.

• It offers a means to catch-up following a period where the TPP's Real Time Notification endpoint has been offline.

API Authorization

The sequence diagram below shows the HTTP requests made by TPP during authorization flow for Event notification API The authorization flow uses tls_client_auth for authentication (link) and includes:

• [1] OAuth2 Client Credentials grant (link) for issuing temporary access token.

• [2] TPP makes a request with temporary access token for receiving events

Detailed step description:

[1] TPP retrieves a temp token

TPP requests the Danske Bank’s Authorization Service for a temporary access token.

The token is retrieved using the OAuth2 Client Credentials flow (link).

A sample request may look like this:

POST /oauth2/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=...&scope=accounts

(Note that for PSD2 apis you also need to provide a country code e.g. /dk/oauth2/token) Description of the parameters used in the payload is below:

grant_type Type of authorization flow being processed. In this case the value MUST be “client_credentials” (link).

scope The scope of the token to be generated (link). For Account/Transaction api the parameter MUST contain the “accounts” keyword.

client_id The TPP identifier (link). ClientId is returned during the TPP registration as described in the onboarding tutorial.

Connecting to the token endpoint requires a mutual TLS connection with the network certificate used during TPP registration. A sample response may look like this:

HTTP/1.1 200 OK
Content-Type: application/json
{
	"token_type": "bearer",
	"access_token": "AAJANGE1....",
	"expires_in": 3600,
	"consented_on": 1548749964,
	"scope": "accounts"
}

The response is a json with the following attributes:

token_type – Type of token issued, this will be always “bearer”. access_token – Access token that can be used to create the account access consent. Access token should be included in the Authorization header in the POST request:

Authorization: Bearer <access token>

Token is valid for 1h. expires_in – For how long in ms this token will be valid. consented_on – At what point in time this token was issued scope – Repeated scope value from the initial request.

[2] TPP creates an event request

TPP creates an event describing what kind of information it wants to retrieve. Request payload is a json.

More information can be found https://openbankinguk.github.io/read-write-api-site3/v4.0/profiles/aggregated-polling-api-profile.html