Groupe BPCE CBPII API

openapi: 3.2.0
info:
  title: Funds Availability CBPII API
  version: 1.4.2.20-b
  description: 'This API intends to provide an interface between

    - Account Servicing Payment Service Providers (ASPSP)

    - Third Party (Payment Service) Providers (TPP)


    TPP may act with different roles as described below:

    - Account Information Service Providers (AISP)

    - Payment Initiation Service Providers (PISP)

    - Card Based Payment Instrument Issuers (CBPII)


    The Payment Service User (PSU) is the owner of the accounts held by the ASPSP and gives accreditations to the TPP in order to access his accounts…'
  termsOfService: https://apistore.groupebpce.com/terms-of-use
  contact:
    name: BPCE
    url: https://apistore.groupebpce.com/support-technique
  license:
    name: Copyright BPCE
    url: https://apistore.groupebpce.com/regulatory-information
  x-business-exposure: true
  x-internal-id: BDSP2BC1
servers:
- description: Production - Banque Populaire
  url: https://www.{etab}.oba-bad-me-live-api.banquepopulaire.fr/stet/psd2/v1.4.2
  variables:
    etab:
      default: '10207'
      enum:
      - '10207'
      - '10807'
      - '10907'
      - '13507'
      - '13807'
      - '14607'
      - '14707'
      - '16607'
      - '16807'
      - '17807'
      - '18707'
- description: Production - Caisse d'Epargne
  url: https://www.{etab}.oba-bad-me-live-api.caisse-epargne.fr/stet/psd2/v1.4.2
  variables:
    etab:
      default: '11315'
      enum:
      - '11315'
      - '11425'
      - '12135'
      - '13135'
      - '13335'
      - '13485'
      - '13825'
      - '14265'
      - '14445'
      - '14505'
      - '15135'
      - '16275'
      - '17515'
      - '18315'
      - '18715'
- description: Production - Banque BCP
  url: https://www.12579.oba-bad-me-live-api.banquebcp.fr/stet/psd2/v1.4.2
- description: Production - BTP Banque
  url: https://www.30258.oba-bad-me-live-api.btp-banque.fr/stet/psd2/v1.4.2
- description: Production - Crédit Coopératif
  url: https://www.42559.oba-bad-me-live-api.credit-cooperatif.coop/stet/psd2/v1.4.2
- description: Production - Banque Palatine
  url: https://www.40978.oba-bad-me-live-api.palatine.fr/stet/psd2/v1.4.2
- description: Production - Banque de Savoie
  url: https://www.10548.oba-bad-me-live-api.banque-de-savoie.fr/stet/psd2/v1.4.2
- description: Sandbox
  url: https://www.{etab}.sandbox.api.89c3.com/stet/psd2/v1.4.2
  variables:
    etab:
      default: '13807'
      enum:
      - '17515'
      - '13807'
tags:
- name: CBPII
paths:
  /funds-confirmations:
    post:
      operationId: fundsConfirmationsPost
      summary: Payment coverage check request (CBPII)
      description: '### Description

        The CBPII can ask an ASPSP to check if a given amount can be covered by the liquidity that is available on a PSU cash account or payment card.

        ### Prerequisites

        - The TPP has been registered by the Registration Authority for the CBPII role

        - The TPP and the PSU have a contract that has been registered by the ASPSP

        - At this step, the ASPSP has delivered an "Authorization Code", a "Resource Owner Password" or a "Client Credential" OAUTH2 access token to the TPP (cf. § 3.4.2).

        - Each ASPSP has to implement either the "Authorization Code"/"Resource Owner Password" or the "Client Credential" OAUTH2 access token model.

        - Doing this, it will edit the [security] section on this path in order to specify which model it has chosen

        - The TPP and the ASPSP have successfully processed a mutual check and authentication

        - The TPP has presented its OAUTH2 "Authorization Code", "Resource Owner Password" or "Client Credential" access token which allows the ASPSP to identify the relevant PSU.

        ### Business flow

        The CBPII requests the ASPSP for a payment coverage check against either a bank account or a card primary identifier.

        The ASPSP answers with a structure embedding the original request and the result as a Boolean.'
      parameters:
      - $ref: '#/components/parameters/AuthorizationParameter'
      - $ref: '#/components/parameters/PsuIpAddressHeader'
      - $ref: '#/components/parameters/PsuIpPortHeader'
      - $ref: '#/components/parameters/PsuHttpMethodHeader'
      - $ref: '#/components/parameters/PsuDateHeader'
      - $ref: '#/components/parameters/PsuGeoLocation'
      - $ref: '#/components/parameters/PsuUserAgentHeader'
      - $ref: '#/components/parameters/PsuRefererHeader'
      - $ref: '#/components/parameters/PsuAcceptHeader'
      - $ref: '#/components/parameters/PsuAcceptCharsetHeader'
      - $ref: '#/components/parameters/PsuAcceptEncodingHeader'
      - $ref: '#/components/parameters/PsuAcceptLanguageHeader'
      - $ref: '#/components/parameters/PsuDeviceId'
      - $ref: '#/components/parameters/DigestHeader'
      - $ref: '#/components/parameters/SignatureHeader'
      - $ref: '#/components/parameters/Correlation'
      requestBody:
        description: parameters of a payment coverage request
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PaymentCoverageRequestResource'
        required: true
      responses:
        '200':
          description: payment coverage request
          headers:
            X-Request-ID:
              description: 'Correlation header to be set in a request and retrieved in the relevant response

                '
              schema:
                type: string
            Digest:
              description: Digest of the body
              schema:
                type: string
            Signature:
              description: '[http-signature of the response ](https://datatracker.ietf.org/doc/draft-cavage-http-signatures/)

                The keyId must specify the way to get the relevant qualified certificate. It is requested that this identifier is an URL aiming to provide the relevant Qualified Certificate.

                '
              schema:
                type: string
            Warning:
              description: 'Warning header.

                This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message.

                '
              schema:
                type: string
          content:
            application/json; charset=utf-8:
              schema:
                $ref: '#/components/schemas/HalPaymentCoverageReport'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '405':
          $ref: '#/components/responses/405'
        '406':
          $ref: '#/components/responses/406'
        '408':
          $ref: '#/components/responses/408'
        '429':
          $ref: '#/components/responses/429'
        '500':
          $ref: '#/components/responses/500'
        '503':
          $ref: '#/components/responses/503'
      security:
      - accessCode:
        - cbpii
      - resourceOwnerIdentification:
        - cbpii
      - clientCredentials:
        - cbpii
      tags:
      - CBPII
components:
  schemas:
    PaymentCoverageRequestResource:
      description: Payment coverage request structure. The request must rely either on a cash account or a payment card.
      type: object
      properties:
        paymentCoverageRequestId:
          description: Identification of the payment Coverage Request
          type: string
          maxLength: 35
        payee:
          description: The merchant where the card is accepted as information to the PSU.
          type: string
          maxLength: 70
        instructedAmount:
          $ref: '#/components/schemas/AmountType'
        accountId:
          $ref: '#/components/schemas/AccountIdentification'
      required:
      - paymentCoverageRequestId
      - instructedAmount
      - accountId
      example:
        paymentCoverageRequestId: MyCoverage123456
        instructedAmount:
          currency: EUR
          amount: 12345
        accountId:
          iban: YY13RDHN98392489481620896668799742
    AccountIdentification:
      description: Unique and unambiguous identification for the account between the account owner and the account servicer.
      type: object
      properties:
        iban:
          description: "ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer. \n\nFurther specifications of the format and content of the IBAN can be found in the standard ISO 13616 \"Banking and related financial services - International Bank Account Number (IBAN)\" version 1997-10-01, or later revisions.\n"
          type: string
          pattern: ^[A-Z]{2,2}[0-9]{2,2}[a-zA-Z0-9]{1,30}$
        other:
          $ref: '#/components/schemas/GenericIdentification'
        currency:
          $ref: '#/components/schemas/CurrencyCode'
      example:
        iban: YY64COJH41059545330222956960771321
    GenericIdentification:
      description: 'ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer.

        API: The ASPSP will document which account reference type it will support.

        '
      type: object
      properties:
        identification:
          description: 'API: Identifier

            '
          type: string
          maxLength: 70
        schemeName:
          description: 'Name of the identification scheme.

            Possible values for the scheme name, partially based on ISO20022 external code list, are the following:

            | Code | Name | Description |

            | ---- | ---- | ----------- |

            | BANK | BankPartyIdentification | Unique and unambiguous assignment made by a specific bank or similar financial institution to identify a relationship as defined between the bank and its client. |

            | COID | CountryIdentificationCode) : Country authority given organisation identification (e.g., corporate registration number) |

            | SREN | SIREN | The SIREN number is a 9 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation in France. |

            | SRET | SIRET | The SIRET number is a 14 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation unit in France. It consists of the SIREN number, followed by a five digit classification number, to identify the local geographical unit of that entity. |

            | NIDN | NationalIdentityNumber | Number assigned by an authority to identify the national identity number of a person. |

            Other values are also permitted, for instance:

            | Code | Name | Description |

            | ---- | ---- | ----------- |

            | OAUT | OAUTH2 | OAUTH2 access token that is owned by the PISP being also an AISP and that can be used in order to identify the PSU |

            | CPAN | CardPan | Card PAN |

            Each implementation of the STET PSD2 API must specify in its own documentation which schemes can actually been used

            '
          type: string
          maxLength: 70
        issuer:
          description: 'ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties

            '
          type: string
          maxLength: 35
      required:
      - identification
      - schemeName
      example:
        identification: 12FR5
        schemeName: COID
        issuer: FR
    CurrencyCode:
      description: "Specifies the currency of the amount or of the account. \nA code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 \"Codes for the representation of currencies and funds\". \n"
      type: string
      pattern: ^[A-Z]{3,3}$
      example: EUR
    PaymentCoverageReportLinks:
      description: 'links that can be used for further navigation to post another coverage request.

        '
      type: object
      properties:
        self:
          $ref: '#/components/schemas/GenericLink'
      required:
      - self
      readOnly: true
      example:
        self:
          href: v1/funds-confirmations
    ErrorModel:
      description: Generic error report structure
      type: object
      properties:
        timestamp:
          description: current timestamp
          type: string
          format: date-time
        status:
          description: HTTP error code
          type: integer
          format: int32
        error:
          description: HTTP error text
          type: string
          maxLength: 140
        message:
          description: HTTP textual reason phrase
          type: string
          maxLength: 140
        path:
          description: Relevant path that was used
          type: string
          maxLength: 140
      required:
      - status
      - message
      example:
        timestamp: 2018-03-30T16:06:27.499+0000
        status: 400
        error: Bad Request
        message: Missing request header 'Digest' for method parameter of type String
        path: /v1/accounts
    AmountType:
      description: 'Structure aiming to embed the amount and the currency to be used.

        '
      type: object
      properties:
        amount:
          description: 'ISO20022: Amount of money to be moved between the debtor and creditor, before deduction of charges, expressed in the currency as ordered by the initiating party.

            '
          type: number
          format: float
          pattern: ^\-{0,1}[0-9]{1,13}(\.[0-9]{0,5}){0,1}$
        currency:
          $ref: '#/components/schemas/CurrencyCode'
      required:
      - amount
      - currency
      example:
        currency: EUR
        amount: 12.25
    HalPaymentCoverageReport:
      description: HYPERMEDIA structure used for returning the payment coverage report to the CBPII
      type: object
      properties:
        request:
          $ref: '#/components/schemas/PaymentCoverageRequestResource'
        result:
          description: 'Result of the coverage check :

            - true: the payment can be covered

            - false: the payment cannot be covered

            '
          type: boolean
        _links:
          $ref: '#/components/schemas/PaymentCoverageReportLinks'
      required:
      - request
      - result
      - _links
      example:
        request:
          paymentCoverageRequestId: MyCoverage123456
          instructedAmount:
            currency: EUR
            amount: 12345
          accountId:
            iban: YY13RDHN98392489481620896668799742
        result: true
        _links:
          self:
            href: v1/funds-confirmations
    GenericLink:
      description: hypertext reference
      type: object
      properties:
        href:
          description: URI to be used. HREF stands for Hypertext REFerence.
          type: string
          maxLength: 2000
        templated:
          description: specifies "true" if href is a URI template, i.e. with parameters. Otherwise, this property is absent or set to false
          type: boolean
      required:
      - href
      example:
        href: v1/accounts/Alias1/balances
  responses:
    '406':
      description: Not Acceptable.
      headers:
        X-Request-ID:
          description: 'Correlation header to be set in a request and retrieved in the relevant response

            '
          schema:
            type: string
        Warning:
          description: 'Warning header.

            This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message.

            '
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/ErrorModel'
    '401':
      description: Unauthorized, authentication failure.
      headers:
        X-Request-ID:
          description: 'Correlation header to be set in a request and retrieved in the relevant response

            '
          schema:
            type: string
        Warning:
          description: 'Warning header.

            This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message.

            '
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/ErrorModel'
    '429':
      description: Too many requests.
      headers:
        X-Request-ID:
          description: 'Correlation header to be set in a request and retrieved in the relevant response

            '
          schema:
            type: string
        Warning:
          description: 'Warning header.

            This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message.

            '
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/ErrorModel'
    '408':
      description: Request Timeout.
      headers:
        X-Request-ID:
          description: 'Correlation header to be set in a request and retrieved in the relevant response

            '
          schema:
            type: string
        Warning:
          description: 'Warning header.

            This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message.

            '
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/ErrorModel'
    '503':
      description: Service unavailable.
      headers:
        X-Request-ID:
          description: 'Correlation header to be set in a request and retrieved in the relevant response

            '
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/ErrorModel'
    '405':
      description: Method Not Allowed.
      headers:
        X-Request-ID:
          description: 'Correlation header to be set in a request and retrieved in the relevant response

            '
          schema:
            type: string
        Warning:
          description: 'Warning header.

            This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message.

            '
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/ErrorModel'
    '400':
      description: Invalid status value
      headers:
        X-Request-ID:
          description: 'Correlation header to be set in a request and retrieved in the relevant response

            '
          schema:
            type: string
        Warning:
          description: 'Warning header.

            This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message.

            '
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/ErrorModel'
    '403':
      description: Forbidden, authentication successful but access to resource is not allowed.
      headers:
        X-Request-ID:
          description: 'Correlation header to be set in a request and retrieved in the relevant response

            '
          schema:
            type: string
        Warning:
          description: 'Warning header.

            This header can be used by the server to inform the client of a deprecated entry-point through the value "299" value and a descriptive message.

            '
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/ErrorModel'
    '500':
      description: Internal server error.
      headers:
        X-Request-ID:
          description: 'Correlation header to be set in a request and retrieved in the relevant response

            '
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/ErrorModel'
  parameters:
    PsuIpAddressHeader:
      name: PSU-IP-Address
      in: header
      description: IP address used by the PSU's terminal when connecting to the TPP
      schema:
        type: string
    PsuAcceptHeader:
      name: PSU-Accept
      in: header
      description: '"Accept" header field sent by the PSU terminal when connecting to the TPP

        '
      schema:
        type: string
    SignatureHeader:
      name: Signature
      in: header
      required: true
      description: '[http-signature of the request](https://datatracker.ietf.org/doc/draft-cavage-http-signatures/)

        The keyId must specify the way to get the relevant qualified certificate. It is requested that this identifier is an URL aiming to provide the relevant Qualified Certificate.

        '
      schema:
        type: string
    Correlation:
      name: X-Request-ID
      in: header
      required: true
      description: 'Correlation header to be set in a request and retrieved in the relevant response

        '
      schema:
        type: string
        maxLength: 70
    PsuIpPortHeader:
      name: PSU-IP-Port
      in: header
      description: IP port used by the PSU's terminal when connecting to the TPP
      schema:
        type: string
    PsuDeviceId:
      name: PSU-Device-ID
      in: header
      description: 'UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available.

        UUID identifies either a device or a device dependant application installation.

        In case of installation identification this ID need to be unaltered until removal from device.

        '
      schema:
        type: string
    PsuUserAgentHeader:
      name: PSU-User-Agent
      in: header
      description: '"User-Agent" header field sent by the PSU terminal when connecting to the TPP

        '
      schema:
        type: string
    AuthorizationParameter:
      name: Authorization
      in: header
      description: Access token to be passed as a header
      required: true
      schema:
        type: string
    PsuAcceptEncodingHeader:
      name: PSU-Accept-Encoding
      in: header
      description: '"Accept-Encoding" header field sent by the PSU terminal when connecting to the TPP

        '
      schema:
        type: string
    DigestHeader:
      name: Digest
      in: header
      required: false
      description: Digest of the body
      schema:
        type: string
    PsuAcceptLanguageHeader:
      name: PSU-Accept-Language
      in: header
      description: '"Accept-Language" header field sent by the PSU terminal when connecting to the TPP

        '
      schema:
        type: string
    PsuRefererHeader:
      name: PSU-Referer
      in: header
      description: '"Referer" header field sent by the PSU terminal when connecting to the TPP.

        Notice that an initial typo in RFC 1945 specifies that "referer" (incorrect spelling) is to be used. The correct spelling "referrer" can be used but might not be understood.

        '
      schema:
        type: string
    PsuDateHeader:
      name: PSU-Date
      in: header
      description: Timestamp of the most relevant PSU’s terminal request to the TTP
      schema:
        type: string
    PsuGeoLocation:
      name: PSU-GEO-Location
      in: header
      description: Geographical location of the PSU as provided by the PSU mobile terminal if any to the TPP
      schema:
        type: string
    PsuHttpMethodHeader:
      name: PSU-HTTP-Method
      in: header
      description: Http method for the most relevant PSU’s terminal request to the TTP
      schema:
        type: string
    PsuAcceptCharsetHeader:
      name: PSU-Accept-Charset
      in: header
      description: '"Accept-Charset" header field sent by the PSU terminal when connecting to the TPP

        '
      schema:
        type: string
  securitySchemes:
    accessCode:
      description: "In order to access the PSU's account information, the AISP needs to get either an authorization code grant or a resource owner password OAUTH2 token.\nIn order to post a funds confirmation request, the CBPII needs to get either an authorization code grant or a resource owner password OAUTH2 token when registration of the account has not been previously processed.\nIn order to confirm a Payment or Transfer Request, the PISP needs to get either an authorization code grant or a client credential OAUTH2 token. \nThe client_id field within the token request must be filled with the value of the organization identifier attribute that has been set in the distinguished name of eIDAS certificate of the TPP, according to ETSI recommandations. \n(cf §5.2.1 of [ETSI specfication](https://www.etsi.org/standards-search#page=1&search=TS119495))\n"
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: /stet/psd2/oauth/authorize
          tokenUrl: /stet/psd2/oauth/token
          scopes:
            cbpii: Access by a CBPII to one given PSU's account to check payment coverage
          refreshUrl: /stet/psd2/oauth/token
    clientCredentials:
      description: "In order to post, get or modify a Payment or Transfer Request, the PISP needs to get a client credential OAUTH2 token. \nIn order to confirm a Payment or Transfer Request, the PISP needs to get either an authorization code grant or a client credential OAUTH2 token. \nIn order to post a funds confirmation request, the CBPII needs to get a client credential OAUTH2 token when registration of the account has already been previously processed.\nThe client_id field within the token request must be filled with the value of the organization identifier attribute that has been set in the distinguished name of eIDAS certificate of the TPP, according to ETSI recommandations. \n(cf §5.2.1 of [ETSI specfication](https://www.etsi.org/standards-search#page=1&search=TS119495))\n"
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: /stet/psd2/oauth/token
          scopes:
            cbpii: Access by a CBPII to one given PSU's account to check payment coverage
          refreshUrl: /stet/psd2/oauth/token
    resourceOwnerIdentification:
      description: "In order to access the PSU's account information, the AISP needs to get either an authorization code grant or a resource owner password OAUTH2 token.\nIn order to post a funds confirmation request, the CBPII needs to get either an authorization code grant or a resource owner password OAUTH2 token when registration of the account has not been previously processed.\nThe client_id field within the token request must be filled with the value of the organization identifier attribute that has been set in the distinguished name of eIDAS certificate of the TPP, according to ETSI recommandations. \n(cf §5.2.1 of [ETSI specfication](https://www.etsi.org/standards-search#page=1&search=TS119495))\n"
      type: oauth2
      flows:
        password:
          tokenUrl: /stet/psd2/oauth/token
          scopes:
            cbpii: Access by a CBPII to one given PSU's account to check payment coverage
          refreshUrl: /stet/psd2/oauth/token