FISKIL Consent API

openapi: 3.2.0
info:
  title: Fiskil Consent API
  version: '2026-08-22'
  summary: Consumer-permissioned banking, lending and energy data for Australia and New Zealand, through one API.
  description: Fiskil is the market leader in open data infrastructure, providing open banking, open finance and energy-data connectivity.
  contact:
    name: Fiskil
    url: https://www.fiskil.com/contact
  termsOfService: https://www.fiskil.com/legal/terms-of-service
servers:
- url: https://api.fiskil.com
  description: Production
security:
- bearerAuth: []
tags:
- name: Consent
  description: Consent arrangements and permissions.
paths:
  /consent/{arrangement_id}:
    delete:
      tags:
      - Consent
      summary: Revoke consent
      description: Allows a client to revoke a consent
      operationId: revoke-consent
      parameters:
      - name: arrangement_id
        in: path
        description: CDR arrangement ID as returned by the list consents API.
        required: true
        schema:
          type: string
          description: CDR arrangement ID as returned by the list consents API.
          example: 94549a73-a554-4b76-b824-d96898829751
        example: 94549a73-a554-4b76-b824-d96898829751
      responses:
        '204':
          description: No Content response.
      security:
      - bearerAuth: []
      externalDocs:
        description: Reference page for this operation
        url: https://docs.fiskil.com/data-api/api-reference/revoke-consent
  /permissions:
    get:
      tags:
      - Consent
      summary: List permissions
      description: Returns a list of Fiskil permissions.
      operationId: list-permissions
      parameters:
      - name: industry
        in: query
        description: The industry to filter on
        allowEmptyValue: true
        schema:
          type: string
          description: The industry to filter on
          example: banking
        example: banking
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Permission'
                example:
                - description: This will give the provider access to all of your transaction information
                  industry: banking
                  name: transactions
                  scope: bank:transactions:read
                  standards:
                  - CDR
                - description: This will give the provider access to all of your transaction information
                  industry: banking
                  name: transactions
                  scope: bank:transactions:read
                  standards:
                  - CDR
              example:
              - description: This will give the provider access to all of your transaction information
                industry: banking
                name: transactions
                scope: bank:transactions:read
                standards:
                - CDR
              - description: This will give the provider access to all of your transaction information
                industry: banking
                name: transactions
                scope: bank:transactions:read
                standards:
                - CDR
      security:
      - bearerAuth: []
      externalDocs:
        description: Reference page for this operation
        url: https://docs.fiskil.com/data-api/api-reference/list-permissions
  /consent:
    get:
      tags:
      - Consent
      summary: List consents
      description: List consents belonging to a client.
      operationId: list-consents
      parameters:
      - name: end_user_id
        in: query
        description: The ID of the end user to list consents for.
        required: false
        schema:
          type: string
      - name: active
        in: query
        description: Filter to include only active or inactive consents.
        required: false
        schema:
          type: boolean
      - name: expires_before
        in: query
        description: Optional RFC3339 timestamp. Only consents expiring before this time are returned.
        required: false
        schema:
          type: string
      - name: page[before]
        in: query
        description: When page[before] is specified, backwards pagination is achieved.
        required: false
        schema:
          type: string
      - name: page[after]
        in: query
        description: When page[after] is specified, forwards pagination is achieved.
        required: false
        schema:
          type: string
      - name: page[size]
        in: query
        description: When page[size] is specified, no more than page[size] resources will be included in the response. It is capped at 1000.
        required: false
        schema:
          type: integer
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/front_door.ConsentsBodyV3'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/front_door.ErrorBody'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/front_door.ErrorBody'
      security:
      - bearerAuth: []
      externalDocs:
        description: Reference page for this operation
        url: https://docs.fiskil.com/data-api/api-reference/list-consents
components:
  schemas:
    authapi.paginationLinks:
      type: object
      properties:
        next:
          type: string
        prev:
          type: string
    Permission:
      type: object
      properties:
        description:
          type: string
          description: A description of the permission.
          example: This will give the provider access to all of your transaction information
        industry:
          type: string
          description: The industry this permission belongs to.
          example: banking
        name:
          type: string
          description: The name of the permission.
          example: transactions
        scope:
          type: string
          description: The CDS scope this permission translates to
          example: bank:transactions:read
        standards:
          type: array
          items:
            type: string
            example: Possimus et cumque eveniet ea quaerat.
          description: Information about the assocated standards
          example:
          - CDR
      description: Information about permissions.
      example:
        description: This will give the provider access to all of your transaction information
        industry: banking
        name: transactions
        scope: bank:transactions:read
        standards:
        - CDR
      required:
      - name
      - description
      - scope
      - standards
      - industry
    front_door.ConsentsBodyV3:
      type: object
      properties:
        consents:
          description: A list of consents belonging to the client.
          type: array
          items:
            $ref: '#/components/schemas/server.ConsentResponse'
        links:
          description: Links to be used for pagination.
          allOf:
          - $ref: '#/components/schemas/authapi.paginationLinks'
    front_door.ErrorBody:
      type: object
      properties:
        id:
          description: Unique identifier for this error.
          type: string
        message:
          description: Details about the error that occurred.
          type: string
        name:
          description: The name of the error.
          type: string
    server.ConsentResponse:
      type: object
      properties:
        account_ids:
          description: 'List of IDs of accounts that were authorised for this consent. The details

            of the accounts can be looked up using the Accounts API for the appropriate

            industry.'
          type: array
          items:
            type: string
        active:
          description: Indicates whether consent is active or not
          type: boolean
        app_logo:
          description: URL to a logo of your application
          type: string
        app_name:
          description: Your application name
          type: string
        arrangement_id:
          description: CDR arrangement ID provided by DH.
          type: string
        created_at:
          description: When the Consent was created
          type: string
        duration:
          description: The time period access was granted. Its in seconds
          type: integer
        end_user_email:
          description: End users email
          type: string
        end_user_id:
          description: ID of the end user that authorised the consent
          type: string
        expires_at:
          description: RFC3339 date-time that the consent expires (or already expired) at
          type: string
        institution_id:
          description: The identifier for the institution the Consent is held with.
          type: string
        institution_logo:
          description: Institution logo
          type: string
        institution_name:
          description: Institution name
          type: string
        institution_type:
          description: Institution Type
          type: string
        last_accessed:
          description: The last time the ADR, or Fiskil used the consent to access data.
          type: string
        last_consent:
          description: The last time the Consent was acknowledged by the End User.
          type: string
        permissions:
          description: A list of the data permissions granted.
          type: array
          items:
            type: string
        termination_reason:
          description: Reason for consent termination
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Exchange a client_id and client_secret at POST /v1/token for an access token, then send it as `Authorization: Bearer <token>`. See https://docs.fiskil.com/data-api/guides/getting-started/authentication'
externalDocs:
  description: Fiskil API documentation
  url: https://docs.fiskil.com
x-products:
- name: Data API
  role: data recipient
  summary: Consumer-permissioned access to banking, lending and energy data through one API.
  audience: Fintechs, lenders, accounting and proptech platforms, energy retailers and comparison services.
  surfaces:
  - Banking API
  - Energy API
  selfServe: true
  sandbox:
    available: true
    free: true
    selfServe: true
    note: Sandbox only. Production access starts on the Launch plan.
  specification: Enumerated in the `paths` object of this document.
  documentation: https://docs.fiskil.com/data-api
  apiReference: https://docs.fiskil.com/data-api/api-reference
- name: Data Provider
  role: data holder
  summary: Managed platform for institutions to share customer and product data with consent and meet their regulatory obligations.
  audience: Banks, non-bank lenders, energy retailers and enterprises.
  surfaces:
  - Consent management
  - Product Portal
  - Regulatory reporting
  selfServe: false
  specification: Published per regime — see `x-specifications`.
  documentation: https://docs.fiskil.com/data-holder
x-specifications:
- name: Data Holder — CDR
  description: 'Consumer Data Right data holder APIs for Australia: consent, authorisation, banking and energy resource endpoints.'
  regime: AU CDR
  url: https://docs.fiskil.com/openapi/holder-cdr.json
- name: Data Holder — Authentication
  description: Authentication and authorisation for data holder surfaces.
  regime: AU CDR
  url: https://docs.fiskil.com/openapi/holder-auth.json
- name: Data Holder — Bring Your Own Data
  description: Expose an existing internal API as a compliant data holder surface.
  regime: Cross-regime
  url: https://docs.fiskil.com/openapi/holder-byod.json
- name: Data Holder — FDX
  description: Financial Data Exchange APIs, the standard used to meet CFPB Section 1033 in the United States.
  regime: US Section 1033 / FDX
  url: https://docs.fiskil.com/openapi/holder-fdx.json
- name: Data Holder — PSD2
  description: PSD2 open banking APIs for the European Union.
  regime: EU PSD2
  url: https://docs.fiskil.com/openapi/holder-psd2.json
- name: Data Holder — Platform API
  description: Platform administration and configuration.
  regime: Cross-regime
  url: https://docs.fiskil.com/openapi/holder-platform-api.json
- name: Data Holder — LATAM Colombia
  description: Open finance data holder APIs for Colombia.
  regime: CO open finance
  url: https://docs.fiskil.com/openapi/holder-latam-colombia.json
- name: Data Holder — LATAM Chile
  description: Open finance data holder APIs for Chile.
  regime: CL open finance
  url: https://docs.fiskil.com/openapi/holder-latam-chile.json
x-specifications-translated:
- name: Data Holder — Authentication (es)
  url: https://docs.fiskil.com/openapi/holder-auth.es.json
- name: Data Holder — Platform API (es)
  url: https://docs.fiskil.com/openapi/holder-platform-api.es.json
- name: Data Holder — LATAM Colombia (es)
  url: https://docs.fiskil.com/openapi/holder-latam-colombia.es.json
- name: Data Holder — LATAM Chile (es)
  url: https://docs.fiskil.com/openapi/holder-latam-chile.es.json
x-machine-readable:
  llms: https://www.fiskil.com/llms.txt
  llmsFull: https://www.fiskil.com/llms-full.txt
  sitemapIndex: https://www.fiskil.com/sitemap-index.xml
  docsIndex: https://docs.fiskil.com/llms.txt
  agentSkill: https://docs.fiskil.com/skill.md
  mcpServer: https://docs.fiskil.com/api/ai/mcp
  dataApiReference: https://docs.fiskil.com/data-api/api-reference
  specCatalogue: https://docs.fiskil.com/openapi/index.json
x-schema-source: Merged from the published Data API specifications at docs.fiskil.com/openapi.