Payment Initiation - UK OB

IMPORTANT! All the documentation related with this API authorization can now be find in a separate documentation page.

API Overview

The basic usage scenario for Payment Initiation api is shown on this diagram:

When a TPP wants to initiate a payment (with PSU being the payer) it acquires a temporary access token and creates a payment consent. The payment consent contains details about the payment to be processed. The available types of payments are:

• domestic payment / scheduled payment / standing order,

• international payment / scheduled payment (available from 09.2019, international standing orders are not in scope).

Payment consent needs to be confirmed by the PSU (OpenID Connect Hybrid Flow). If PSU approves it then TPP will receive an access token that will allow him to create a payment request and thus submit the payment for processing. Each payment request has a unique resource id that can be used for checking the payment processing status. (Where specifications allow a maximum text number greater than we provide, where possible we will truncate the field instead of rejecting the payment request.) The access tokens for Payment Initiation api cannot be refreshed or reused. The Authorization steps need to be repeated for each payment (unless special conditions apply). Next sections provide a more detailed description for the steps mentioned above. The Openbanking UK reference documentation can be found here: link.

Making API calls

Technical description of Payment Initiation api endpoints can be found in the reference section: link. In each call to the Payment Initiation api these are obligatory:

• MTLS connection (with the Network certificate used during TPP onboarding: link).

• Valid access token (acquired as described in the Authorization section: link).

Additionally the following headers may apply for api calls involving a payload (please check reference section to see if they’re required):

• Valid x-fapi-financial-id value in header (for Danske Bank it’s 0015800000jf7AeAAI),

• An x-idempotency-key header with a random value that will prevent multiple processing of the same request,

• An x-jws-signature header with detached JWS signature of the payload.

A sample request might look like this:

GET /domestic-payments/123 HTTP/1.1
Authorization: Bearer <access token>
x-fapi-financial-id: 0015800000jf7AeAAI

Sandbox test data

The following test customers can be used for authenticating in Sandbox authorization flows:

Login / Password

8195475386 / xUKSWPgHy2H2XBt8cv

If you find the test data not matching your needs please contact us.