The Account Access Consents API from first direct — 2 operation(s) for account access consents.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/first-direct:first-direct-account-access-consents-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Account and Transaction API Specification Account Access…
description: 'Swagger for Account and Transaction API Specification.
**Please Note**: There are no optional fields, if a field is not marked as “Required” it is a Conditional field.'
termsOfService: https://www.openbanking.org.uk/terms
contact:
name: Service Desk
email: ServiceDesk@openbanking.org.uk
license:
name: open-licence
url: https://www.openbanking.org.uk/open-licence
version: 4.0.1
servers:
- url: /open-banking/v4.0/aisp
tags:
- name: Account Access Consents
paths:
/account-access-consents:
post:
tags:
- Account Access Consents
summary: Create an Account Access Consent
description: Enables an AISP to ask an ASPSP to create a new account-access-consent resource, by sending a copy of the consent to the ASPSP.
operationId: CreateAccountAccessConsents
parameters:
- $ref: '#/components/parameters/x-fapi-auth-date'
- $ref: '#/components/parameters/x-fapi-customer-ip-address'
- $ref: '#/components/parameters/x-fapi-interaction-id'
- $ref: '#/components/parameters/Authorization'
- $ref: '#/components/parameters/x-customer-user-agent'
- $ref: '#/components/parameters/x-client-id'
requestBody:
content:
application/json; charset=utf-8:
schema:
$ref: '#/components/schemas/OBReadConsent1'
application/json:
schema:
$ref: '#/components/schemas/OBReadConsent1'
application/jose+jwe:
schema:
$ref: '#/components/schemas/OBReadConsent1'
description: Default
required: true
responses:
'201':
$ref: '#/components/responses/201AccountAccessConsentsCreated'
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'405':
$ref: '#/components/responses/405Error'
'406':
$ref: '#/components/responses/406Error'
'415':
$ref: '#/components/responses/415Error'
'429':
$ref: '#/components/responses/429Error'
'500':
$ref: '#/components/responses/500Error'
security:
- TPPOAuth2Security:
- accounts
/account-access-consents/{ConsentId}:
get:
tags:
- Account Access Consents
summary: Get an Account Access Consent
description: Enables an AISP to retrieve the status of an AIS consent.
operationId: GetAccountAccessConsentsConsentId
parameters:
- $ref: '#/components/parameters/ConsentId'
- $ref: '#/components/parameters/x-fapi-auth-date'
- $ref: '#/components/parameters/x-fapi-customer-ip-address'
- $ref: '#/components/parameters/x-fapi-interaction-id'
- $ref: '#/components/parameters/Authorization'
- $ref: '#/components/parameters/x-customer-user-agent'
- $ref: '#/components/parameters/x-client-id'
responses:
'200':
$ref: '#/components/responses/200AccountAccessConsentsConsentIdRead'
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'405':
$ref: '#/components/responses/405Error'
'406':
$ref: '#/components/responses/406Error'
'429':
$ref: '#/components/responses/429Error'
'500':
$ref: '#/components/responses/500Error'
security:
- TPPOAuth2Security:
- accounts
delete:
tags:
- Account Access Consents
summary: Delete an Account Access Consent
description: Enables an AISP to inform the ASPSP that the PSU has revoked their consent.
operationId: DeleteAccountAccessConsentsConsentId
parameters:
- $ref: '#/components/parameters/ConsentId'
- $ref: '#/components/parameters/x-fapi-auth-date'
- $ref: '#/components/parameters/x-fapi-customer-ip-address'
- $ref: '#/components/parameters/x-fapi-interaction-id'
- $ref: '#/components/parameters/Authorization'
- $ref: '#/components/parameters/x-customer-user-agent'
- $ref: '#/components/parameters/x-client-id'
responses:
'204':
$ref: '#/components/responses/204AccountAccessConsentsConsentIdDeleted'
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'405':
$ref: '#/components/responses/405Error'
'406':
$ref: '#/components/responses/406Error'
'429':
$ref: '#/components/responses/429Error'
'500':
$ref: '#/components/responses/500Error'
security:
- TPPOAuth2Security:
- accounts
components:
schemas:
StatusUpdateDateTime:
description: "Date and time at which the resource status was updated. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
type: string
format: date-time
Links:
type: object
description: Links relevant to the payload
properties:
Self:
type: string
format: uri
First:
type: string
format: uri
Prev:
type: string
format: uri
Next:
type: string
format: uri
Last:
type: string
format: uri
additionalProperties: false
required:
- Self
OBReadConsentResponse1:
type: object
required:
- Data
- Risk
properties:
Data:
type: object
required:
- ConsentId
- CreationDateTime
- Status
- StatusUpdateDateTime
- Permissions
properties:
ConsentId:
description: Unique identification as assigned to identify the account access consent resource.
type: string
minLength: 1
maxLength: 128
CreationDateTime:
$ref: '#/components/schemas/CreationDateTime'
Status:
$ref: '#/components/schemas/OBInternalConsentStatus1Code'
StatusReason:
type: array
items:
$ref: '#/components/schemas/OBStatusReason'
description: Specifies the status reason.
StatusUpdateDateTime:
$ref: '#/components/schemas/StatusUpdateDateTime'
Permissions:
type: array
items:
description: Specifies the Open Banking account access data types. <br /> This is a list of the data clusters being consented by the PSU, and requested for authorisation with the ASPSP. <br /> For a full list of enumeration values refer to `OBInternalPermissions1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_internal_CodeSets)
type: string
enum:
- ReadAccountsBasic
- ReadAccountsDetail
- ReadBalances
- ReadBeneficiariesBasic
- ReadBeneficiariesDetail
- ReadDirectDebits
- ReadOffers
- ReadPAN
- ReadParty
- ReadPartyPSU
- ReadProducts
- ReadScheduledPaymentsBasic
- ReadScheduledPaymentsDetail
- ReadStandingOrdersBasic
- ReadStandingOrdersDetail
- ReadStatementsBasic
- ReadStatementsDetail
- ReadTransactionsBasic
- ReadTransactionsCredits
- ReadTransactionsDebits
- ReadTransactionsDetail
minItems: 1
ExpirationDateTime:
description: "Specified date and time the permissions will expire.\nIf this is not populated, the permissions will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
type: string
format: date-time
TransactionFromDateTime:
description: "Specified start date and time for the transaction query period.\nIf this is not populated, the start date will be open ended, and data will be returned from the earliest available transaction. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
type: string
format: date-time
TransactionToDateTime:
description: "Specified end date and time for the transaction query period.\nIf this is not populated, the end date will be open ended, and data will be returned to the latest available transaction. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
type: string
format: date-time
Risk:
$ref: '#/components/schemas/OBRisk2'
Links:
$ref: '#/components/schemas/Links'
Meta:
$ref: '#/components/schemas/Meta'
additionalProperties: false
OBStatusReason:
type: object
properties:
StatusReasonCode:
type: string
description: "Specifies the status reason in a code form. \n For a full description see `OBExternalStatusReason1Code` [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)"
minLength: 1
maxLength: 4
example: U004
StatusReasonDescription:
description: Description supporting the StatusReasonCode.
type: string
minLength: 1
maxLength: 500
example: Permissions field is missing
Path:
type: string
description: Recommended but optional reference to JSON path if relevant to the StatusReasonCode.
minLength: 1
maxLength: 500
example: Data.Permissions
OBError1:
type: object
properties:
ErrorCode:
$ref: '#/components/schemas/OBExternalStatusReason1Code'
Message:
description: 'A description of the error that occurred. e.g., ''A mandatory field isn''t supplied'' or ''RequestedExecutionDateTime must be in future''
OBL doesn''t standardise this field'
type: string
minLength: 1
maxLength: 500
Path:
description: Recommended but optional reference to the JSON Path of the field with error, e.g., Data.Initiation.InstructedAmount.Currency
type: string
minLength: 1
maxLength: 500
Url:
description: URL to help remediate the problem, or provide more information, or to API Reference, or help etc
type: string
required:
- ErrorCode
additionalProperties: false
minProperties: 1
OBInternalConsentStatus1Code:
description: Specifies the status of consent resource in code form.
type: string
enum:
- AWAU
- RJCT
- AUTH
- CANC
- EXPD
ISODateTime:
description: "All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
type: string
format: date-time
CreationDateTime:
description: "Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
type: string
example: '2024-05-29T00:00:00Z'
format: date-time
Meta:
title: MetaData
type: object
description: Meta Data relevant to the payload
properties:
TotalPages:
type: integer
format: int32
FirstAvailableDateTime:
$ref: '#/components/schemas/ISODateTime'
LastAvailableDateTime:
$ref: '#/components/schemas/ISODateTime'
additionalProperties: false
OBReadConsent1:
type: object
required:
- Data
- Risk
properties:
Data:
type: object
required:
- Permissions
properties:
Permissions:
type: array
items:
description: Specifies the Open Banking account access data types. <br /> This is a list of the data clusters being consented by the PSU, and requested for authorisation with the ASPSP. <br /> For a full list of enumeration values refer to `OBInternalPermissions1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_internal_CodeSets)
type: string
enum:
- ReadAccountsBasic
- ReadAccountsDetail
- ReadBalances
- ReadBeneficiariesBasic
- ReadBeneficiariesDetail
- ReadDirectDebits
- ReadOffers
- ReadPAN
- ReadParty
- ReadPartyPSU
- ReadProducts
- ReadScheduledPaymentsBasic
- ReadScheduledPaymentsDetail
- ReadStandingOrdersBasic
- ReadStandingOrdersDetail
- ReadStatementsBasic
- ReadStatementsDetail
- ReadTransactionsBasic
- ReadTransactionsCredits
- ReadTransactionsDebits
- ReadTransactionsDetail
minItems: 1
ExpirationDateTime:
description: "Specified date and time the permissions will expire.\nIf this is not populated, the permissions will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
type: string
format: date-time
TransactionFromDateTime:
description: "Specified start date and time for the transaction query period.\nIf this is not populated, the start date will be open ended, and data will be returned from the earliest available transaction. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
type: string
format: date-time
TransactionToDateTime:
description: "Specified end date and time for the transaction query period.\nIf this is not populated, the end date will be open ended, and data will be returned to the latest available transaction. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
type: string
format: date-time
Risk:
$ref: '#/components/schemas/OBRisk2'
OBExternalStatusReason1Code:
description: Low level textual error code, for all enum values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)
type: string
minLength: 4
maxLength: 4
example: U001
OBRisk2:
type: object
additionalProperties: false
properties: {}
description: 'The Risk section is sent by the initiating party to the ASPSP. <br />
It is used to specify additional details for risk scoring for Account Info.'
OBErrorResponse1:
description: An array of detail error codes, and messages, and URLs to documentation to help remediation.
type: object
properties:
Id:
description: A unique reference for the error instance, for audit purposes, in case of unknown/unclassified errors.
type: string
minLength: 1
maxLength: 40
Code:
description: Deprecated <br />High level textual error code, to help categorise the errors.
type: string
minLength: 1
example: 400 BadRequest
maxLength: 40
Message:
description: Deprecated <br />Brief Error message
type: string
minLength: 1
example: There is something wrong with the request parameters provided
maxLength: 500
Errors:
items:
$ref: '#/components/schemas/OBError1'
type: array
minItems: 1
required:
- Errors
additionalProperties: false
parameters:
ConsentId:
name: ConsentId
in: path
description: ConsentId
required: true
schema:
type: string
x-customer-user-agent:
in: header
name: x-customer-user-agent
description: Indicates the user-agent that the PSU is using.
required: false
schema:
type: string
x-fapi-customer-ip-address:
in: header
name: x-fapi-customer-ip-address
required: false
description: The PSU's IP address if the PSU is currently logged in with the TPP.
schema:
type: string
x-client-id:
in: header
name: x-client-id
required: false
description: "Only used if an ASPSP requires the client ID in order to return rate limit headers. \n\nTPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements.\n\nThis header __must not__ be used for client authentication\n"
schema:
type: string
Authorization:
in: header
name: Authorization
required: true
description: An Authorisation Token as per https://tools.ietf.org/html/rfc6750
schema:
type: string
x-fapi-auth-date:
in: header
name: x-fapi-auth-date
required: false
description: "The time when the PSU last logged in with the TPP. \nAll dates in the HTTP headers are represented as RFC 7231 Full Dates. An example is below: \nSun, 10 Sep 2017 19:43:31 UTC"
schema:
type: string
pattern: ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} (GMT|UTC)$
x-fapi-interaction-id:
in: header
name: x-fapi-interaction-id
required: false
description: An RFC4122 UID used as a correlation id.
schema:
type: string
headers:
RateLimit-Policy:
required: false
description: 'TPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements.
A non-empty list of Quota Policy Items. The Item value __MUST__ be a String.
Example:
`RateLimit-Policy: "default";q=100;w=10`
The **REQUIRED** "q" parameter indicates the quota allocated by this policy measured in quota units.
The **OPTIONAL** "w" parameter value conveys a time window.
'
schema:
type: string
RateLimit:
required: false
description: 'TPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements.
A server uses the "RateLimit" response header field to communicate the current service limit for a quota policy for a particular partition key.
Example:
`RateLimit: "default";r=50;t=30`
The **REQUIRED** "r" parameter value conveys the remaining quota units for the identified policy.
The **OPTIONAL** "t" parameter value conveys the time window reset time for the identified policy.
'
schema:
type: string
responses:
405Error:
description: Method Not Allowed
headers:
x-fapi-interaction-id:
description: An RFC4122 UID used as a correlation id.
required: true
schema:
type: string
204AccountAccessConsentsConsentIdDeleted:
description: Account Access Consents Deleted
headers:
x-fapi-interaction-id:
description: An RFC4122 UID used as a correlation id.
required: true
schema:
type: string
RateLimit-Policy:
$ref: '#/components/headers/RateLimit-Policy'
RateLimit:
$ref: '#/components/headers/RateLimit'
201AccountAccessConsentsCreated:
description: Account Access Consents Created
headers:
x-fapi-interaction-id:
description: An RFC4122 UID used as a correlation id.
required: true
schema:
type: string
RateLimit-Policy:
$ref: '#/components/headers/RateLimit-Policy'
RateLimit:
$ref: '#/components/headers/RateLimit'
content:
application/json; charset=utf-8:
schema:
$ref: '#/components/schemas/OBReadConsentResponse1'
application/json:
schema:
$ref: '#/components/schemas/OBReadConsentResponse1'
application/jose+jwe:
schema:
$ref: '#/components/schemas/OBReadConsentResponse1'
401Error:
description: Unauthorized
headers:
x-fapi-interaction-id:
description: An RFC4122 UID used as a correlation id.
required: true
schema:
type: string
429Error:
description: Too Many Requests
headers:
Retry-After:
description: Number in seconds to wait
schema:
type: integer
x-fapi-interaction-id:
description: An RFC4122 UID used as a correlation id.
schema:
type: string
403Error:
description: Forbidden
headers:
x-fapi-interaction-id:
description: An RFC4122 UID used as a correlation id.
required: true
schema:
type: string
content:
application/json; charset=utf-8:
schema:
$ref: '#/components/schemas/OBErrorResponse1'
application/json:
schema:
$ref: '#/components/schemas/OBErrorResponse1'
application/jose+jwe:
schema:
$ref: '#/components/schemas/OBErrorResponse1'
500Error:
description: Internal Server Error
headers:
x-fapi-interaction-id:
description: An RFC4122 UID used as a correlation id.
required: true
schema:
type: string
content:
application/json; charset=utf-8:
schema:
$ref: '#/components/schemas/OBErrorResponse1'
application/json:
schema:
$ref: '#/components/schemas/OBErrorResponse1'
application/jose+jwe:
schema:
$ref: '#/components/schemas/OBErrorResponse1'
406Error:
description: Not Acceptable
headers:
x-fapi-interaction-id:
description: An RFC4122 UID used as a correlation id.
required: true
schema:
type: string
415Error:
description: Unsupported Media Type
headers:
x-fapi-interaction-id:
description: An RFC4122 UID used as a correlation id.
required: true
schema:
type: string
400Error:
description: Bad request
headers:
x-fapi-interaction-id:
description: An RFC4122 UID used as a correlation id.
required: true
schema:
type: string
content:
application/json; charset=utf-8:
schema:
$ref: '#/components/schemas/OBErrorResponse1'
application/json:
schema:
$ref: '#/components/schemas/OBErrorResponse1'
application/jose+jwe:
schema:
$ref: '#/components/schemas/OBErrorResponse1'
200AccountAccessConsentsConsentIdRead:
description: Account Access Consents Read
headers:
x-fapi-interaction-id:
description: An RFC4122 UID used as a correlation id.
required: true
schema:
type: string
RateLimit-Policy:
$ref: '#/components/headers/RateLimit-Policy'
RateLimit:
$ref: '#/components/headers/RateLimit'
content:
application/json; charset=utf-8:
schema:
$ref: '#/components/schemas/OBReadConsentResponse1'
application/json:
schema:
$ref: '#/components/schemas/OBReadConsentResponse1'
application/jose+jwe:
schema:
$ref: '#/components/schemas/OBReadConsentResponse1'
securitySchemes:
TPPOAuth2Security:
type: oauth2
description: TPP client credential authorisation flow with the ASPSP
flows:
clientCredentials:
tokenUrl: https://authserver.example/token
scopes:
accounts: Ability to read Accounts information
PSUOAuth2Security:
type: oauth2
description: OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when a TPP wants to access an ASPSP resource owned by the PSU
flows:
authorizationCode:
authorizationUrl: https://authserver.example/authorization
tokenUrl: https://authserver.example/token
scopes:
accounts: Ability to read Accounts information