Known issues

• POST should be used for /token requests, sometimes a 400 status code is returned instead of 405 when using any other method, which might be confusing

• The hybrid flow response parameters are returned in a fragment, not the query part of the URL (… all response parameters are added to the fragment component of the Redirection URI, as specified in OAuth 2.0 Multiple Response Type Encoding Practices [OAuth.Responses], unless a different Response Mode was specified.)

• The scope URL parameter should be a space delimited string, not a JSON array

• "Forbidden AC" error, means that an incorrect access token is used for the specified flow

• "Intent ID is present" error, means that an Authorization Code token was used when a Client Credentials token was expected

• “403 - Strong customer authentication required” in conjunction with the application of RTS Article 10. Strong Customer Authentication (SCA) rules applied according to OBIE guidelines regarding RTS Article 10:

  - If TPP calls any of the three endpoints that do not require SCA (accounts, balances, or transactions (<90days)), then for 15 minutes TPP is allowed to call all AIS GET endpoints without SCA. This is considered a "Bundled request".

  - If TPP calls any other AIS GET endpoint without a prior call to accounts, balances, or transactions (<90days), SCA is required for every call (GET Standing orders, Scheduled payments, Party, etc.).

  - After re-authentication (or first authentication) the above mentioned 15 minutes period of unrestricted access applies.