File Payment Consents - v3.1.2

1. Overview
2. Endpoints
   1. POST /file-payment-consents
      1. Status
   2. POST /file-payment-consents/{ConsentId}/file
      1. Status
   3. GET /file-payment-consents/{ConsentId}
      1. Status
   4. GET /file-payment-consents/{ConsentId}/file
   5. State Model
      1. Payment Order Consent
3. Data Model
   1. Reused Classes
      1. OBFile2
         1. UML Diagram
         2. Notes
         3. Data Dictionary
   2. File Payment Consent - Request
      1. UML Diagram
      2. Notes
      3. Data Dictionary
   3. File Payment Consent - Response
      1. UML Diagram
      2. Notes
      3. Data Dictionary
4. Usage Examples
   1. POST /file-payment-consents
      1. Request
      2. Response
   2. POST /file-payment-consents/{ConsentId}/file
      1. Request
      2. Response

Overview

The File Payment Consent resource is used by a PISP to register an intent to initiate a File Payment.

This resource description should be read in conjunction with a compatible Payment Initiation API Profile.

Endpoints

POST /file-payment-consents

The API endpoint allows the PISP to ask an ASPSP to create a new file-payment-consent resource.

• The POST action indicates to the ASPSP that a file payment consent has been staged. At this point, the PSU may not have been identified by the ASPSP and the request payload may not contain any information of the account(s) that should be debited.
• The endpoint allows the PISP to send metadata of the consent (between PSU and PISP) to the ASPSP.
• The metadata of the consent must include the FileType of the request.
• The metadata of the consent must include the FileHash, which is a base64 encoding of a SHA256 hash of the file to be uploaded.
• The ASPSP creates the file-payment-consent resource and responds with a unique ConsentId to refer to the resource.

Status

The default Status is “AwaitingUpload” immediately after the file-payment-consent has been created.

POST /file-payment-consents/{ConsentId}/file

The API endpoint allows the PISP to upload a file to an ASPSP, against a file-payment-consent resource.

• The endpoint allows the PISP to send a copy of the consent (between PSU and PISP) to the ASPSP for the PSU to authorise. The PISP must upload the file against the ConsentId before redirecting the PSU to authorise the consent.
• The file structure must match the FileType in the file-payment-consent request.
• An ASPSP must confirm the hash of the file matches with the FileHash provided in the file-payment-consent Metadata.
• The metadata for the file-payment-consent must match the contents of the uploaded file:
  • If the content of the metadata does not match the content of the file, the ASPSP must reject the file-payment-consent.
• The file is sent in the HTTP request body.
• HTTP headers (e.g. Content-Type) are used to describe the file.

Status

The default Status is “AwaitingAuthorisation” immediately after the file has been uploaded.

GET /file-payment-consents/{ConsentId}

A PISP can optionally retrieve a payment consent resource that they have created to check its status.

Status

Once the PSU authorises the payment-consent resource, the Status of the payment-consent resource will be updated with “Authorised”.

If the PSU rejects the consent or the file-payment-consent has failed some other ASPSP validation, the Status will be set to “Rejected”.

Once a file-payment has been successfully created using the file-payment-consent, the Status of the file-payment-consent will be set to “Consumed”.

The available Status codes for the file-payment-consent resource are:

GET /file-payment-consents/{ConsentId}/file

The API endpoint allows the PISP to download a file (that had been uploaded against a file-payment-consent resource) from an ASPSP.

• The file is sent in the HTTP response body.
• HTTP headers (e.g. Content-Type) are used to describe the file.

State Model

Payment Order Consent

The state model for the file-payment-consent resource follows the generic consent state model. However, does not use the “Revoked” status, as the consent for a file-payment is not a long-lived consent.

The definitions for the Status:

Data Model

The data dictionary section gives the detail on the payload content for the File Payment API flows.

Reused Classes

OBFile2

This section describes the OBFile2 class, which is reused as the Initiation object in the file-payment-consent resource.

UML Diagram

Notes

For the OBFile2 Initiation object:

• All elements in the Initiation payload that are specified by the PISP must not be changed via the ASPSP, as this is part of formal consent from the PSU.
• If the ASPSP is able to establish a problem with payload or any contextual error during the API call, the ASPSP must reject the file-payment-consent request immediately.
• If the ASPSP establishes a problem with the file-payment-consent after the API call, the ASPSP must set the Status of the file-payment-consent resource to Rejected.
• The DebtorAccount is optional as the PISP may not know the account identification details for the PSU.
• If the DebtorAccount is specified by the PISP and is invalid for the PSU - then the file-payment-consent will be set to Rejected after PSU authentication.
• An ASPSP may choose which fields must be populated to process a specified FileType, and may reject the request if the fields are not populated. These ASPSP specific requirements must be documented.
• An ASPSP may choose which fields must not be populated to process a specified FileType, and may reject the request if the fields are populated. These ASPSP specific requirements must be documented.

Data Dictionary

File Payment Consent - Request

The OBWriteFileConsent3 object will be used for the call to:

• POST /file-payment-consents

UML Diagram

Notes

The file-payment-consent request contains these objects:

• Initiation
• Authorisation
• SCASupportData

For the file-payment-consent request object:

• There is no Risk section in the OBWriteFileConsent3 object - as this is not relevant for a file payment.

Data Dictionary

File Payment Consent - Response

The OBWriteFileConsentResponse3 object will be used for a response to a call to:

• POST /file-payment-consents
• GET /file-payment-consents/{ConsentId}

UML Diagram

Notes

The file-payment-consent response contains the full original payload from the file-payment-consent request with these additional elements:

• ConsentId.
• CreationDateTime the file-payment-consent resource was created.
• Status and StatusUpdateDateTime of the file-payment-consent resource.
• CutOffDateTime Behaviour is explained in Payment Initiation API Profile, Section - Payment Restrictions -> CutOffDateTime Behaviour.
• Charges array - for the breakdown of applicable ASPSP charges.

Data Dictionary

Usage Examples

POST /file-payment-consents

Request

POST /file-payment-consents HTTP/1.1
Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA
x-idempotency-key: FRESCO.21302.GFX.20
x-jws-signature: TGlmZSdzIGEgam91cm5leSBub3QgYSBkZXN0aW5hdGlvbiA=..T2ggZ29vZCBldmVuaW5nIG1yIHR5bGVyIGdvaW5nIGRvd24gPw==
x-fapi-auth-date: Sun, 10 Sep 2017 19:43:31 UTC
x-fapi-customer-ip-address: 104.25.212.99
x-fapi-interaction-id: 93bac548-d2de-4546-b106-880a5018460d
Content-Type: application/json
Accept: application/json

{
  "Data": {
    "Initiation": {
      "FileType": "UK.OBIE.pain.001.001.08",
      "FileHash": "m5ah/h1UjLvJYMxqAoZmj9dKdjZnsGNm+yMkJp/KuqQ",
      "FileReference": "GB2OK238",
      "NumberOfTransactions": "100",
      "ControlSum": 3459.30
    }
  }
}

Response

HTTP/1.1 201 Created
x-jws-signature: V2hhdCB3ZSBnb3QgaGVyZQ0K..aXMgZmFpbHVyZSB0byBjb21tdW5pY2F0ZQ0K
x-fapi-interaction-id: 93bac548-d2de-4546-b106-880a5018460d
Content-Type: application/json

{
  "Data": {
    "ConsentId" : "512345",
    "Status": "AwaitingUpload",
    "CreationDateTime": "2018-06-05T15:15:13+00:00",
    "StatusUpdateDateTime": "2018-06-05T15:15:13+00:00",
    "Initiation": {
      "FileType": "UK.OBIE.pain.001.001.08",
      "FileHash": "m5ah/h1UjLvJYMxqAoZmj9dKdjZnsGNm+yMkJp/KuqQ",
      "FileReference": "GB2OK238",
      "NumberOfTransactions": "100",
      "ControlSum": 3459.30
    }
  },
  "Links":{
    "Self":"https://api.alphabank.com/open-banking/v4.0/pisp/file-payment-consents/512345"
  },
  "Meta":{}
}

POST /file-payment-consents/{ConsentId}/file

Request

POST /file-payment-consents/512345/file HTTP/1.1
Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA
x-idempotency-key: FRESCO.21302.GFX.20
x-jws-signature: TGlmZSdzIGEgam91cm5leSBub3QgYSBkZXN0aW5hdGlvbiA=..T2ggZ29vZCBldmVuaW5nIG1yIHR5bGVyIGdvaW5nIGRvd24gPw==
x-fapi-auth-date: Sun, 10 Sep 2017 19:43:31 UTC
x-fapi-customer-ip-address: 104.25.212.99
x-fapi-interaction-id: 93bac548-d2de-4546-b106-880a5018460d
Content-Type: text/xml
Accept: application/json

[File-Data]

A sample file with 3 transactions is provided below:

Response

HTTP/1.1 200 OK
x-fapi-interaction-id: 93bac548-d2de-4546-b106-880a5018460d