TietoEVRY Account consent service API

openapi: 3.2.0
info:
  title: Tietoevry Account consent service API
  version: '1.0'
  description: 'Operations tagged Account consent service across 6 of this provider''s published API definitions: tietoevry-financial-api-aggregation-swagger.json, tietoevry-openbanking-xs2a-swagger.json, tietoevry-tieto-xs2a-accounts-cards-premium.v1_3.yaml, tietoevry-tieto-xs2a-accounts-premium.v1_3.yaml, tietoevry-tieto-xs2a-accounts.v1_2.yaml, tietoevry-tieto-xs2a-accounts.v1_3.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://aggregation.api.tieto.com
- url: http://openbanking.api.tieto.com
- url: https://openbanking.api.tieto.com
- url: https://openbanking.api.tieto.com/sandbox
- url: https://openbanking.api.tieto.com/live
tags:
- name: Account consent service
  description: Operations for establish and managing account information consent.
paths:
  /v1/xs2a/v1.0/providers/{provider-id}/consents:
    post:
      tags:
      - Account consent service
      summary: Establish Consent Transaction
      description: 'Creates an account information consent resource at the ASPSP regarding access to accounts specified in this request.

        All permitted "access" attributes ("accounts", "balances" and "transactions") used in this message shall either carry a non-empty array of account references, indicating the accounts where the type of access is requested, or shall carry an empty array to indicate that the type of access is requested for all available accounts. Note that some providers may not support pre-indicated accounts, and in such situations the request shall fall back to access to all available accounts.

        Please note that a "transactions", "balances" or "accounts" access right also gives access to the generic /accounts endpoints, i.e. is implicitly supporting also the "accounts" access.'
      operationId: postConsent
      parameters:
      - name: provider-id
        in: path
        description: Identifier of an ASPSP, previously returned by the system
        required: true
        schema:
          type: string
      - name: Content-Type
        in: header
        required: true
        schema:
          type: string
          enum:
          - application/json
      - name: End-User-ID
        in: header
        description: The system-generated ID of an anonymous End User.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      - name: TPP-Explicit-Authorisation-Preferred
        in: header
        description: If it equals "true", the TPP prefers to start the authorisation process separately, e.g. because of the usage of a signing basket. If it equals "false" or if the parameter is not used, there is no preference of the TPP. This especially indicates that the TPP assumes a direct authorisation of the transaction in the next step, without using a signing basket.
        schema:
          type: boolean
          default: false
      - name: TPP-Redirect-URI
        in: header
        description: URI of the TPP, where the transaction flow shall be redirected to after a Redirect. Mandated for the Redirect SCA Approach (including OAuth2 SCA approach).
        required: true
        schema:
          type: string
          format: uri
      - name: TPP-Nok-Redirect-URI
        in: header
        description: If this URI is contained, the TPP is asking to redirect the transaction flow to this address instead of the TPP-Redirect-URI in case of a negative result of the redirect SCA method.
        schema:
          type: string
          format: uri
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonPostConsentsResponse'
        '201':
          description: No errors occurred. In _links section self link is used.
          headers:
            Location:
              description: Hyperlink for the status of the resource.
              schema:
                type: string
                format: uri
        '400':
          description: 'One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format;

            FrequencyPerDay isn''t 1 when recurringIndicator is false;

            CombinedServiceIndicator is true'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/JsonPostConsentsRequest'
    servers:
    - url: https://aggregation.api.tieto.com
  /v1/xs2a/v1.0/providers/{provider-id}/consents/{consent-id}:
    get:
      tags:
      - Account consent service
      summary: Get Consent Request
      description: Returns the content of an account information consent object.
      operationId: getConsent
      parameters:
      - name: provider-id
        in: path
        description: Identifier of an ASPSP, previously returned by the system
        required: true
        schema:
          type: string
      - name: Accept
        in: header
        required: true
        schema:
          type: string
          enum:
          - application/json
      - name: End-User-ID
        in: header
        description: The system-generated ID of an anonymous End User.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      - name: consent-id
        in: path
        description: Shall be contained since “Establish Consent Transaction” was performed via this API before.
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: No errors occurred. Returns consent. In _links section viewAccounts link is used.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonGetConsentResponse'
        '400':
          description: One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse'
        '403':
          description: The Consent-ID cannot be matched by the ASPSP relative to the TPP.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse'
    delete:
      tags:
      - Account consent service
      summary: Delete an Account Information Consent Object
      description: The TPP can delete an account information consent object.
      operationId: deleteConsent
      parameters:
      - name: provider-id
        in: path
        description: Identifier of an ASPSP, previously returned by the system
        required: true
        schema:
          type: string
      - name: consent-id
        in: path
        description: Shall be contained since “Establish Consent Transaction” was performed via this API before.
        required: true
        schema:
          type: string
          format: uuid
      - name: End-User-ID
        in: header
        description: The system-generated ID of an anonymous End User.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No errors occurred. Deleted consent
        '400':
          description: One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse'
        '404':
          description: Consent not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse'
    servers:
    - url: https://aggregation.api.tieto.com
  /v1/xs2a/v1.0/providers/{provider-id}/consents/{consent-id}/authorisations:
    get:
      tags:
      - Account consent service
      summary: Get authorisation sub-resources request
      description: Will deliver an array of resource identifications of all generated authorisation sub-resources.
      operationId: consentsGetAuthorizations
      parameters:
      - name: provider-id
        in: path
        description: Identifier of an ASPSP, previously returned by the system
        required: true
        schema:
          type: string
      - name: consent-id
        in: path
        description: Identification of the related resource
        required: true
        schema:
          type: string
          format: uuid
      - name: End-User-ID
        in: header
        description: The system-generated ID of an anonymous End User.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Returns array of authorisation sub-resources.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonGetAuthorisationsResponse'
    post:
      tags:
      - Account consent service
      summary: Start authorisation process
      description: Starts an authorisation process in for establishing account information consent data on the server.
      operationId: consentsStartAuthorization
      parameters:
      - name: provider-id
        in: path
        description: Identifier of an ASPSP, previously returned by the system
        required: true
        schema:
          type: string
      - name: consent-id
        in: path
        description: Identification of the related resource
        required: true
        schema:
          type: string
          format: uuid
      - name: End-User-ID
        in: header
        description: The system-generated ID of an anonymous End User.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      - name: TPP-Explicit-Authorisation-Preferred
        in: header
        description: If it equals "true", the TPP prefers to start the authorisation process separately, e.g. because of the usage of a signing basket. If it equals "false" or if the parameter is not used, there is no preference of the TPP. This especially indicates that the TPP assumes a direct authorisation of the transaction in the next step, without using a signing basket.
        schema:
          type: boolean
          default: false
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonPostAuthorisationsResponse'
        '201':
          description: Created authorisation sub-resource.
    servers:
    - url: https://aggregation.api.tieto.com
  /v1/xs2a/v1.0/providers/{provider-id}/consents/{consent-id}/authorisations/{authorisation-id}:
    get:
      tags:
      - Account consent service
      summary: Get SCA status request
      description: Checks the SCA status of a authorisation sub-resource.
      operationId: consentsGetAuthorizationStatus
      parameters:
      - name: provider-id
        in: path
        description: Identifier of an ASPSP, previously returned by the system
        required: true
        schema:
          type: string
      - name: consent-id
        in: path
        description: Identification of the related resource
        required: true
        schema:
          type: string
          format: uuid
      - name: End-User-ID
        in: header
        description: The system-generated ID of an anonymous End User.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      - name: authorisation-id
        in: path
        description: Identification of the related authorisation sub-resource
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Returns array of authorisation sub-resources.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonGetAuthorisationStatusResponse'
    servers:
    - url: https://aggregation.api.tieto.com
  /v1/xs2a/v1.0/providers/{provider-id}/consents/{consent-id}/status:
    get:
      tags:
      - Account consent service
      summary: Get Status Request
      description: Can check the status of an account information consent resource.
      operationId: getConsentStatus
      parameters:
      - name: provider-id
        in: path
        description: Identifier of an ASPSP, previously returned by the system
        required: true
        schema:
          type: string
      - name: consent-id
        in: path
        description: Shall be contained since “Establish Consent Transaction” was performed via this API before.
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
          enum:
          - application/json
      - name: End-User-ID
        in: header
        description: The system-generated ID of an anonymous End User.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: No errors occurred. Returns the transactionStatus of the consent.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonGetConsentStatusResponse'
        '400':
          description: One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse'
        '403':
          description: The Consent-ID cannot be matched by the ASPSP relative to the TPP.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse'
    servers:
    - url: https://aggregation.api.tieto.com
  /sandbox/xs2a/v1.3/consents:
    post:
      tags:
      - Account consent service
      summary: Establish Consent Transaction
      description: 'Creates an account information consent resource at the ASPSP regarding access to accounts specified in this request.

        All permitted "access" attributes ("accounts", "balances" and "transactions") used in this message shall carry a non-empty array of account references, indicating the accounts where the type of access is requested. Please note that a "transactions", "balances" or "accounts" access right also gives access to the generic /accounts endpoints, i.e. is implicitly supporting also the "accounts" access.'
      operationId: postConsent
      parameters:
      - name: Content-Type
        in: header
        required: true
        schema:
          type: string
          enum:
          - application/json
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      - name: TPP-Explicit-Authorisation-Preferred
        in: header
        description: If it equals "true", the TPP prefers to start the authorisation process separately, e.g. because of the usage of a signing basket. If it equals "false" or if the parameter is not used, there is no preference of the TPP. This especially indicates that the TPP assumes a direct authorisation of the transaction in the next step, without using a signing basket.
        schema:
          type: boolean
          default: false
      - name: TPP-Redirect-URI
        in: header
        description: URI of the TPP, where the transaction flow shall be redirected to after a Redirect. Mandated for the Redirect SCA Approach (including OAuth2 SCA approach).
        required: true
        schema:
          type: string
          format: uri
      - name: TPP-Nok-Redirect-URI
        in: header
        description: If this URI is contained, the TPP is asking to redirect the transaction flow to this address instead of the TPP-Redirect-URI in case of a negative result of the redirect SCA method.
        schema:
          type: string
          format: uri
      responses:
        '200':
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonPostConsentsResponse_2'
        '201':
          description: No errors occurred. In _links section self link is used.
          headers:
            Location:
              description: Hyperlink for the status of the resource.
              schema:
                type: string
                format: uri
        '400':
          description: 'One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format;

            FrequencyPerDay isn''t 1 when recurringIndicator is false;

            CombinedServiceIndicator is true'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse_2'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/JsonPostConsentsRequest_2'
    servers:
    - url: http://openbanking.api.tieto.com
    - url: https://openbanking.api.tieto.com
  /sandbox/xs2a/v1.3/consents/{consent-id}:
    get:
      tags:
      - Account consent service
      summary: Get Consent Request
      description: Returns the content of an account information consent object.
      operationId: getConsent
      parameters:
      - name: Accept
        in: header
        required: true
        schema:
          type: string
          enum:
          - application/json
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      - name: consent-id
        in: path
        description: Shall be contained since “Establish Consent Transaction” was performed via this API before.
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: No errors ocurred. Returns consent. In _links section viewAccounts link is used.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonGetConsentResponse_2'
        '400':
          description: One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse_2'
        '404':
          description: Consent not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse_2'
    delete:
      tags:
      - Account consent service
      summary: Delete an Account Information Consent Object
      description: The TPP can delete an account information consent object.
      operationId: deleteConsent
      parameters:
      - name: consent-id
        in: path
        description: Shall be contained since “Establish Consent Transaction” was performed via this API before.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No errors ocurred. Deleted consent
        '400':
          description: One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse_2'
        '404':
          description: Consent not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse_2'
    servers:
    - url: http://openbanking.api.tieto.com
    - url: https://openbanking.api.tieto.com
  /sandbox/xs2a/v1.3/consents/{consent-id}/authorisations:
    get:
      tags:
      - Account consent service
      summary: Get authorisation sub-resources request
      description: Will deliver an array of resource identifications of all generated authorisation sub-resources.
      operationId: consentsGetAuthorizations
      parameters:
      - name: consent-id
        in: path
        description: Identification of the related resource
        required: true
        schema:
          type: string
          format: uuid
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Returns array of authorisation sub-resources.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonGetAuthorisationsResponse_2'
    post:
      tags:
      - Account consent service
      summary: Start authorisation process
      description: Starts an authorisation process in for establishing account information consent data on the server.
      operationId: consentsStartAuthorization
      parameters:
      - name: consent-id
        in: path
        description: Identification of the related resource
        required: true
        schema:
          type: string
          format: uuid
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      - name: TPP-Redirect-URI
        in: header
        description: URI of the TPP, where the transaction flow shall be redirected to after a Redirect. Mandated for the Redirect SCA Approach (including OAuth2 SCA approach).
        required: true
        schema:
          type: string
          format: uri
      - name: TPP-Nok-Redirect-URI
        in: header
        description: If this URI is contained, the TPP is asking to redirect the transaction flow to this address instead of the TPP-Redirect-URI in case of a negative result of the redirect SCA method.
        schema:
          type: string
          format: uri
      responses:
        '201':
          description: Created authorisation sub-resource.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonPostAuthorisationsResponse_2'
    servers:
    - url: http://openbanking.api.tieto.com
    - url: https://openbanking.api.tieto.com
  /sandbox/xs2a/v1.3/consents/{consent-id}/authorisations/{authorisation-id}:
    get:
      tags:
      - Account consent service
      summary: Get SCA status request
      description: Checks the SCA status of a authorisation sub-resource.
      operationId: consentsGetAuthorizationStatus
      parameters:
      - name: consent-id
        in: path
        description: Identification of the related resource
        required: true
        schema:
          type: string
          format: uuid
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      - name: authorisation-id
        in: path
        description: Identification of the related authorisation sub-resource
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Returns array of authorisation sub-resources.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonGetAuthorisationStatusResponse'
    servers:
    - url: http://openbanking.api.tieto.com
    - url: https://openbanking.api.tieto.com
  /sandbox/xs2a/v1.3/consents/{consent-id}/status:
    get:
      tags:
      - Account consent service
      summary: Get Status Request
      description: Can check the status of an account information consent resource.
      operationId: getConsentStatus
      parameters:
      - name: consent-id
        in: path
        description: Shall be contained since “Establish Consent Transaction” was performed via this API before.
        required: true
        schema:
          type: string
          format: uuid
      - name: Accept
        in: header
        required: true
        schema:
          type: string
          enum:
          - application/json
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in Sandbox.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: No errors ocurred. Returns the transactionStatus of the consent.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonGetConsentStatusResponse'
        '400':
          description: One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse_2'
        '404':
          description: Consent not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonErrorResponse_2'
    servers:
    - url: http://openbanking.api.tieto.com
    - url: https://openbanking.api.tieto.com
  /{sandbox|live}/xs2a/v1.3/consents:
    post:
      tags:
      - Account consent service
      summary: 'Account info: Establish Consent Transaction'
      description: 'Creates an account information consent resource at the ASPSP regarding access to accounts specified in this request.

        All permitted "access" attributes ("accounts", "balances" and "transactions") used in this message shall carry a non-empty array of account references, indicating the accounts where the type of access is requested. Please note that a "transactions", "balances" or "accounts" access right also gives access to the generic /accounts endpoints.

        "access" attributes can carry an empty array, indicating that TPP is asking for accessible account list.'
      operationId: postConsent
      parameters:
      - $ref: '#/components/parameters/envParam'
      - name: Content-Type
        in: header
        required: true
        schema:
          type: string
          enum:
          - application/json
      - name: X-Request-ID
        in: header
        description: ID of the request, unique to the call, as determined by the initiating party.
        required: true
        schema:
          type: string
          format: uuid
      - name: X-API-Key
        in: header
        description: Authorisation key that can be acquired in TPP developer portal.
        required: true
        schema:
          type: string
      - name: TPP-Explicit-Authorisation-Preferred
        in: header
        description: If it equals "true", the TPP prefers to start the authorisation process separately, e.g. because of the usage of a signing basket. If it equals "false" or if the parameter is not used, there is no preference of the TPP.
        schema:
          type: boolean
          default: false
      - name: TPP-Redirect-URI
        in: header
        description: URI of the TPP, where the transaction flow shall be redirected to after a Redirect. Mandated for the Redirect SCA Approach (including OAuth2 SCA approach).
        required: true
        schema:
          type: string
          format: uri
      - name: TPP-Nok-Redirect-URI
        in: header
        description: If this URI is contained, the TPP is asking to redirect the transaction flow to this address instead of the TPP-Redirect-URI in case of a negative

# --- truncated at 32 KB (112 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tietoevry/refs/heads/main/openapi/tietoevry-account-consent-service-api-openapi.yml