A single-integration aggregation layer over Nordic and Baltic banks, exposing provider discovery, end-user management and aggregated XS2A operations (accounts, balances, transactions, consents, confirmation of funds and payment initiation) across many connected ASPSPs behind one contract, with a pre-step SCA service and aggregated consent creation.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/tietoevry-financial-api-aggregation"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
{
"swagger": "2.0",
"info": {
"title": "Tieto Financial API Aggregation",
"version": "1.0.0",
"description": " Tieto Financial API Aggregation solution API reference.\n\nBase API version is 1.0.0. It contains the following API groups:\n- __Providers API__, version 1.0.0\n- __End Users API__, version 1.0.0\n- __XS2A API__, version 1.0.0"
},
"host": "aggregation.api.tieto.com",
"tags": [
{
"name": "Provider information",
"description": "Retrieve information about providers."
},
{
"name": "End User management",
"description": "Operations for managing anonymous End Users."
},
{
"name": "Aggregated services",
"description": "Operations, which are executed for multiple destination providers."
},
{
"name": "Account Information Service",
"description": "Operations for managing account information."
},
{
"name": "Pre-step SCA service",
"description": "Operations for establishing Pre-step SCA"
},
{
"name": "Account consent service",
"description": "Operations for establish and managing account information consent."
},
{
"name": "Confirmation of Funds Service",
"description": "Operations for receiving funds confirmation."
},
{
"name": "Payment Initiation Service",
"description": "Operations for payments."
}
],
"schemes": [
"https"
],
"paths": {
"/v1/xs2a/v1.0/pre-auth": {
"post": {
"tags": [
"Aggregated services",
"pre-auth"
],
"summary": "Initiate a Pre-step SCA, aggregated",
"description": "Initiates a Pre-step SCA process for all providers, which are selected for the End User and support Pre-step SCA.",
"operationId": "aggregatedPreAuth",
"produces": [
"application/json"
],
"parameters": [
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "End-User-ID",
"in": "header",
"description": "The system-generated ID of an anonymous End User.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "TPP-Redirect-URI",
"in": "header",
"required": true,
"type": "string"
},
{
"name": "TPP-Nok-Redirect-URI",
"in": "header",
"required": false,
"type": "string"
}
],
"responses": {
"201": {
"description": "No errors occurred. Return list of pre-auth links for all selected providers throw the api key which requires it.",
"schema": {
"$ref": "#/definitions/JsonPreAuthProvidersResponse"
}
},
"405": {
"description": "Provider pre-auth is not available",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"500": {
"description": "Server error",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
},
"options": {
"tags": [
"Aggregated services",
"pre-auth"
],
"summary": "Check Pre-step SCA support, aggregated",
"description": "Returns links to start pre-auth endpoint for providers, which support Pre-step SCA.",
"operationId": "aggregatedPreAuthOptions",
"produces": [
"application/json"
],
"parameters": [
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "End-User-ID",
"in": "header",
"description": "The system-generated ID of an anonymous End User.",
"required": true,
"type": "string",
"format": "uuid"
}
],
"responses": {
"200": {
"description": "No errors occurred. List of links to pre-authorization for all selected providers through the API Key which requires it created.",
"schema": {
"$ref": "#/definitions/JsonPreAuthProvidersResponse"
}
},
"500": {
"description": "Server error",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
}
},
"/v1/xs2a/v1.0/providers/{provider-id}/pre-auth": {
"post": {
"tags": [
"Pre-step SCA service",
"pre-auth"
],
"summary": "Initiate a Pre-step SCA",
"description": "Initiates a Pre-step SCA process, returning SCA details, e.g. SCA redirect link.",
"operationId": "preAuth",
"produces": [
"application/json"
],
"parameters": [
{
"name": "provider-id",
"in": "path",
"required": true,
"type": "string"
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "End-User-ID",
"in": "header",
"description": "The system-generated ID of an anonymous End User.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "TPP-Redirect-URI",
"in": "header",
"required": true,
"type": "string"
},
{
"name": "TPP-Nok-Redirect-URI",
"in": "header",
"required": false,
"type": "string"
}
],
"responses": {
"201": {
"description": "No errors occurred. Pre auth link created.",
"schema": {
"$ref": "#/definitions/JsonPreAuthProviderResponse"
}
},
"500": {
"description": "Server error",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
},
"options": {
"tags": [
"Pre-step SCA service",
"pre-auth"
],
"summary": "Check, if Pre-step SCA is supported",
"description": "Returns allowed methods for the resource. If Pre-step SCA is supported by provider, then \"POST\" method is allowed. ",
"operationId": "preAuthOptions",
"produces": [
"application/json"
],
"parameters": [
{
"name": "provider-id",
"in": "path",
"required": true,
"type": "string"
},
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "End-User-ID",
"in": "header",
"description": "The system-generated ID of an anonymous End User.",
"required": true,
"type": "string",
"format": "uuid"
}
],
"responses": {
"200": {
"description": "No errors occurred. Return list of links to pre-authorization for all selected providers throw the api key which requires it.",
"headers": {
"Allow": {
"type": "string",
"description": "Returns available HTTP methods which can be used with this resource. If provider supports Pre-step SCA, then the \"POST\" method is returned among the allowed methods."
}
}
},
"500": {
"description": "Server error",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
}
},
"/v1/providers/v1.0/providers": {
"get": {
"tags": [
"Provider information",
"providers"
],
"summary": "Retrieve information on providers",
"description": "Returns information on providers, which are available through the API Key, specified in header",
"operationId": "getProviders",
"produces": [
"application/json"
],
"parameters": [
{
"name": "fromAgreement",
"in": "query",
"description": "If \"false\", then read providers available through the API Key specified in header. If \"true\", then read all available providers based on the agreement.",
"required": false,
"type": "boolean"
},
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
}
],
"responses": {
"200": {
"description": "No errors occurred. Return a list of providers, which are available through the API Key, which has been specified in the request header.",
"schema": {
"$ref": "#/definitions/JsonGetProvidersResponse"
}
}
}
}
},
"/v1/providers/v1.0/providers/{provider-id}": {
"get": {
"tags": [
"Provider information",
"providers"
],
"summary": "Retrieve information for a given provider",
"description": "Returns information for a given provider. The provider must be available through the API Key, specified in header",
"operationId": "getProvider",
"produces": [
"application/json"
],
"parameters": [
{
"name": "provider-id",
"in": "path",
"required": true,
"type": "string"
},
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
}
],
"responses": {
"200": {
"description": "No errors occurred. Return information about a provider.",
"schema": {
"$ref": "#/definitions/JsonGetProviderResponse"
}
}
}
}
},
"/v1/end-users/v1.0/end-users": {
"post": {
"tags": [
"End User management",
"end-users"
],
"summary": "Create an anonymous End User",
"description": "Creates an anonymous End User and returns its ID for usage in other requests",
"operationId": "createEndUser",
"produces": [
"application/json"
],
"parameters": [
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
}
],
"responses": {
"201": {
"description": "No errors occurred. End User ID is created and returned.",
"schema": {
"$ref": "#/definitions/JsonCreateEndUserResponse"
}
}
}
}
},
"/v1/end-users/v1.0/end-users/{end-user-id}": {
"delete": {
"tags": [
"End User management",
"end-users"
],
"summary": "Delete the anonymous End User record",
"description": "",
"operationId": "deleteEndUser",
"produces": [
"application/json"
],
"parameters": [
{
"name": "end-user-id",
"in": "path",
"description": "The system-issued anonymous End User ID",
"required": true,
"type": "string"
},
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
}
],
"responses": {
"200": {
"description": "No errors occurred. The End User resource is deleted."
}
}
}
},
"/v1/end-users/v1.0/end-users/{end-user-id}/providers": {
"get": {
"tags": [
"End User management",
"end-users"
],
"summary": "Retrieve the provider selection for an End User",
"description": "",
"operationId": "getEndUserProviders",
"produces": [
"application/json"
],
"parameters": [
{
"name": "end-user-id",
"in": "path",
"description": "The system-issued anonymous End User ID",
"required": true,
"type": "string"
},
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
}
],
"responses": {
"200": {
"description": "No errors occurred. Returns a list of references to the End User selected providers. Each of the referenced provider information resources is then asynchronously pushed (in case of HTTP/2) to the calling client.",
"headers": {
"Link": {
"type": "string",
"description": "Multiple 'rel=preload; as=fetch' links to provider information resources. These links correspond to the links in the response body."
}
},
"schema": {
"$ref": "#/definitions/JsonGetEndUserProvidersResponse"
}
}
}
},
"put": {
"tags": [
"End User management",
"end-users"
],
"summary": "Set the provider selection for an End User",
"description": "",
"operationId": "setEndUserProviders",
"parameters": [
{
"name": "end-user-id",
"in": "path",
"description": "The system-issued anonymous End User ID",
"required": true,
"type": "string"
},
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "body",
"in": "body",
"description": "Array of selected provider identifiers. These providers are verified against the agreement-defined provider list, not against the current API Key-defined provider list.",
"required": true,
"schema": {
"$ref": "#/definitions/JsonPutEndUserProvidersRequest"
}
}
],
"responses": {
"200": {
"description": "No errors occurred."
}
}
}
},
"/v1/xs2a/v1.0/accounts": {
"get": {
"tags": [
"Aggregated services",
"accounts"
],
"summary": "Retrieve aggregated List of Accounts",
"description": "Retrieves an aggregated List of bank Accounts from providers, which are selected for the End User.",
"operationId": "getAggregatedAccounts",
"produces": [
"application/json"
],
"parameters": [
{
"name": "withBalance",
"in": "query",
"description": "If contained, this function reads the list of accessible payment accounts including the booking balance. This call will be rejected if the withBalance parameter is used in a case, where the access right on balances is not granted in the related consent",
"required": false,
"type": "boolean"
},
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "End-User-ID",
"in": "header",
"description": "The system-generated ID of an anonymous End User.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
}
],
"responses": {
"200": {
"description": "No errors occurred. Return a list of references to Account Lists from each separate provider. In addition, the results of fetching of these per-provider Account Lists are asynchronously pushed (in case of HTTP/2) to the calling side, as soon as a reply is received from a provider.",
"headers": {
"Link": {
"type": "string",
"description": "Multiple 'rel=preload; as=fetch' links to account lists by provider. These links correspond to the links in the response body."
}
},
"schema": {
"$ref": "#/definitions/JsonGetAggregatedAccountsResponse"
}
}
}
}
},
"/v1/xs2a/v1.0/providers/{provider-id}/accounts": {
"get": {
"tags": [
"Account Information Service",
"accounts"
],
"summary": "Read Account List",
"description": "Reads a list of bank accounts, with balances where required.",
"operationId": "getAccounts",
"produces": [
"application/json"
],
"parameters": [
{
"name": "provider-id",
"in": "path",
"description": "Identifier of an ASPSP, previously returned by the system",
"required": true,
"type": "string"
},
{
"name": "withBalance",
"in": "query",
"description": "If contained, this function reads the list of accessible payment accounts including the booking balance. This call will be rejected if the withBalance parameter is used in a case, where the access right on balances is not granted in the related consent",
"required": false,
"type": "boolean"
},
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "End-User-ID",
"in": "header",
"description": "The system-generated ID of an anonymous End User.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "Consent-ID",
"in": "header",
"description": "Shall be contained since “Establish Consent Transaction” was performed via this API before. If absent, then the system will attempt to use the consent tied to the End User ID.",
"required": false,
"type": "string",
"format": "uuid"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
}
],
"responses": {
"200": {
"description": "No errors occurred. Return a list of accounts. Each account's _links section is using viewBalances and viewTransactions links.",
"headers": {
"myheader": {
"type": "string"
}
},
"schema": {
"$ref": "#/definitions/JsonGetAccountsResponse"
}
},
"400": {
"description": "One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"401": {
"description": "Consent expired, consent is not valid for requested resource",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"403": {
"description": "Consent absent, consent not authorized by user",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"429": {
"description": "Consent access exceeded",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
}
},
"/v1/xs2a/v1.0/providers/{provider-id}/accounts/{account-id}": {
"get": {
"tags": [
"Account Information Service",
"accounts"
],
"summary": "Read Account Details",
"description": "Reads details about an account, with balances where required.",
"operationId": "getAccount",
"produces": [
"application/json"
],
"parameters": [
{
"name": "provider-id",
"in": "path",
"description": "Identifier of an ASPSP, previously returned by the system",
"required": true,
"type": "string"
},
{
"name": "account-id",
"in": "path",
"description": "This identification is denoting the addressed account. The account-id is retrieved by using a “Read Account List” call. The account-id is the “id” attribute of the account structure. Its value is constant at least throughout the lifecycle of a given consent.",
"required": true,
"type": "string"
},
{
"name": "withBalance",
"in": "query",
"description": "If contained, this function reads the list of accessible payment accounts including the booking balance. This call will be rejected if the withBalance parameter is used in a case, where the access right on balances is not granted in the related consent",
"required": false,
"type": "boolean"
},
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "End-User-ID",
"in": "header",
"description": "The system-generated ID of an anonymous End User.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "Consent-ID",
"in": "header",
"description": "Shall be contained since “Establish Consent Transaction” was performed via this API before. If absent, then the system will attempt to use the consent tied to the End User ID.",
"required": false,
"type": "string",
"format": "uuid"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
}
],
"responses": {
"200": {
"description": "No errors occurred. Returns an account. In _links section viewBalances and viewTransactions links will be used",
"schema": {
"$ref": "#/definitions/JsonGetAccountResponse"
}
},
"400": {
"description": "One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"401": {
"description": "Consent expired, consent is not valid for requested resource",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"403": {
"description": "Consent absent, consent not authorized by user",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"404": {
"description": "Account not found",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"429": {
"description": "Consent access exceeded",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
}
},
"/v1/xs2a/v1.0/providers/{provider-id}/accounts/{account-id}/balances": {
"get": {
"tags": [
"Account Information Service",
"accounts"
],
"summary": "Read Balance",
"description": "Reads account data from a given account addressed by 'account-id'.",
"operationId": "getAccountBalances",
"produces": [
"application/json"
],
"parameters": [
{
"name": "provider-id",
"in": "path",
"description": "Identifier of an ASPSP, previously returned by the system",
"required": true,
"type": "string"
},
{
"name": "account-id",
"in": "path",
"description": "This identification is denoting the addressed account. The account-id is retrieved by using a “Read Account List” call. The account-id is the “id” attribute of the account structure. Its value is constant at least throughout the lifecycle of a given consent.",
"required": true,
"type": "string"
},
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "End-User-ID",
"in": "header",
"description": "The system-generated ID of an anonymous End User.",
"required": true,
# --- truncated at 32 KB (132 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tietoevry/refs/heads/main/openapi/tietoevry-financial-api-aggregation-swagger.json