Third party providers

The API functionality exposes details of the request accounts, their balances, bookings and transactions and it includes Accounts, Payments, Fees, and FX. This data can be accessed by licensed Account Information Service Providers and Payment Initiation Service Providers by providing a valid certificate and credentials.

To get onboarded as AISP or PISP, you’ll have to provide our Sales team with your company name, username, email address, phone number, IP address that will be used for sending requests to us, and Qualified Certificate (QSEAL). Get in touch with us [email protected].

Connecting to our APIs as an AISP and PISP

We have a RequestID Uniqueness Check. This means that if you are an AISP or a PISP you need to send a unique ID with each call. The request header must contain a unique X-Request-ID for each request. If the X-Request-ID is found not to be unique, a 400 Bad Request Inavalid X-Request-ID is returned.

To get the access token, you should include in the Authorization call these headers:

Header	Description
Authorization	HTTP Basic Authentication (username and password)
X-ARR-ClientCert or X-BC-ClientCert	AISP or PISP QSEAL Type Certificate

For sending requests, the following headers need to be included in all API calls:

Header	Description
X-Request-ID (Unique): Mandatory	ID of the request (in UUID format), unique to the call (generated by the initiating party, who must ensure uniqueness)
Digest	Base64 encoded hash of body (SHA-256 and SHA-512 supported). Use an empty string if there is no body.
Digest	Comma separated list of values for keyId, algorithm, headers and signature: - keyId: Certificate Serial Number, Issuer - algorithm: rsa-sha256 or rsa-sha512 - headers: List of values present in the Request Header: Digest, X-Request-ID, PSU-ID - signature: Base64 encoded signed value of Digest, X-Request-ID and PSU-ID
TPP-Signature-Certificate	Base64 encoded Qualified Certificate (QSEAL) used for signing
PSU-ID: Optional	Payment Service User ID. If PSU-ID is specified as part of the Signature headers, it must be specified in the Request header