Account and Transaction API

Introduction¶

This page explains the flow of the Account Information and Transaction API by OBIE. The Account Information Service Provider (AISP) can use the API endpoints described here to do the following:

• Register a resource to retrieve account information by creating an account access consent. This registers data that the customer (PSU) has consented to provide to the AISP such as data permissions, expiration, and historical period allowed for transactions/statements.
• Subsequently, retrieve account and transaction data.

Basic flow¶

See the below diagram describing the basic accounts information flow:

The PSU requests to access account information data using an AISP solution (A third-party provider). The AISP connects to the ASPSP that services the PSU's accounts and creates an account-access-consent resource. This informs the ASPSP that one of its PSUs is granting access to account and transaction information to an AISP. In this case, the AISP makes a POST request to ASPSP's /account-access-consents endpoint. The ASPSP responds with an identifier for the resource (the ConsentId). The account-access-consent resource will include the following fields which describe the data that the PSU has consented with the AISP:

• Permissions - a list of data clusters that have been consented for access
• Expiration Date - an optional expiration for when the AISP will no longer have access to the PSU's data
• Transaction Validity Period - the From/To date range which specifies a historical period for transactions and statements which may be accessed by the AISP

The AISP acts as a mediator for data to other parties, so it is valid for a PSU to have multiple account-access-consents for the same accounts, with different consent/authorisation parameters agreed. The AISP requests the PSU to authorise the consent. The ASPSP uses the redirection flow for this.

1. In a redirection flow, the AISP redirects the PSU to the ASPSP
2. The redirect includes ConsentId generated in the previous step
3. This allows the ASPSP to correlate the account-access-consent that was setup
4. The ASPSP authenticates the PSU
5. The ASPSP updates the state of the account-access-consent resource internally to indicate that the account access consent has been authorised
6. Once the consent has been authorised, the PSU is redirected back to the AISP

Once the PSU authorises the consent for the TPP to access account information, the AISP makes an API call to the ASPSP to retrieve account information. When the ASPSP provides account information, the TPP can expose the information via the AISP solution.

For more information, see Account and Transaction API Flow.

Endpoints¶

To access account information and transaction data, you can use the following available API endpoints: