Every API here is available over the APIs.io API and to AI agents over MCP.
{
"swagger": "2.0",
"info": {
"description": "Tieto OpenBanking XS2A apis description",
"version": "1.3.4",
"title": "Tieto OpenBanking XS2A apis"
},
"host": "openbanking.api.tieto.com",
"tags": [
{
"name": "Account information service",
"description": "Operations for managing account information."
},
{
"name": "Confirmation of Funds Service",
"description": "Operations for receiving funds confirmation."
},
{
"name": "Account consent service",
"description": "Operations for establish and managing account information consent."
},
{
"name": "Payment Initiation Service",
"description": "Operations for payments."
},
{
"name": "Confirmation of Funds Service consent",
"description": "Operations for establish and managing confirmation of funds consent."
}
],
"schemes": [
"http",
"https"
],
"paths": {
"/sandbox/xs2a/v1.3/accounts": {
"get": {
"tags": [
"Account information service",
"accounts"
],
"summary": "Read Account List",
"description": "Reads a list of bank accounts, with balances where required.",
"operationId": "getAccounts",
"produces": [
"application/json"
],
"parameters": [
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "Consent-ID",
"in": "header",
"description": "Shall be contained since “Establish Consent Transaction” was performed via this API before.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "PSU-IP-Address",
"in": "header",
"description": "The forwarded IP Address header field consists of the corresponding HTTP request IP Address field between PSU and TPP.",
"required": true,
"type": "string"
},
{
"name": "withBalance",
"in": "query",
"description": "If contained, this function reads the list of accessible payment accounts including the booking balance. This call will be rejected if the withBalance parameter is used in a case, where the access right on balances is not granted in the related consent",
"required": false,
"type": "boolean"
}
],
"responses": {
"200": {
"description": "No errors ocurred. Return a list of accounts. Each account's _links section is using viewBalances and viewTransactions links.",
"schema": {
"$ref": "#/definitions/JsonGetAccountsResponse"
}
},
"400": {
"description": "One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"401": {
"description": "Consent expired, consent is not valid for requested resource",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"403": {
"description": "Consent absent, consent not authorized by user",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"429": {
"description": "Consent access exceeded",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
}
},
"/sandbox/xs2a/v1.3/accounts/{account-id}": {
"get": {
"tags": [
"Account information service",
"accounts"
],
"summary": "Read Account Details",
"description": "Reads details about an account, with balances where required.",
"operationId": "getAccount",
"produces": [
"application/json"
],
"parameters": [
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "account-id",
"in": "path",
"description": "This identification is denoting the addressed account. The account-id is retrieved by using a “Read Account List” call. The account-id is the “id” attribute of the account structure. Its value is constant at least throughout the lifecycle of a given consent.",
"required": true,
"type": "string"
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "Consent-ID",
"in": "header",
"description": "Shall be contained since “Establish Consent Transaction” was performed via this API before.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "PSU-IP-Address",
"in": "header",
"description": "The forwarded IP Address header field consists of the corresponding HTTP request IP Address field between PSU and TPP.",
"required": true,
"type": "string"
},
{
"name": "withBalance",
"in": "query",
"description": "If contained, this function reads the list of accessible payment accounts including the booking balance. This call will be rejected if the withBalance parameter is used in a case, where the access right on balances is not granted in the related consent",
"required": false,
"type": "boolean"
}
],
"responses": {
"200": {
"description": "No errors ocurred. Returns an account. In _links section viewBalances and viewTransactions links will be used",
"schema": {
"$ref": "#/definitions/JsonGetAccountResponse"
}
},
"400": {
"description": "One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"401": {
"description": "Consent expired, consent is not valid for requested resource",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"403": {
"description": "Consent absent, consent not authorized by user",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"404": {
"description": "Account not found",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"429": {
"description": "Consent access exceeded",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
}
},
"/sandbox/xs2a/v1.3/accounts/{account-id}/balances": {
"get": {
"tags": [
"Account information service",
"accounts"
],
"summary": "Read Balance",
"description": "Reads account data from a given account addressed by 'account-id'.",
"operationId": "getAccountBalances",
"produces": [
"application/json"
],
"parameters": [
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "account-id",
"in": "path",
"description": "This identification is denoting the addressed account. The account-id is retrieved by using a “Read Account List” call. The account-id is the “id” attribute of the account structure. Its value is constant at least throughout the lifecycle of a given consent.",
"required": true,
"type": "string"
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "Consent-ID",
"in": "header",
"description": "Shall be contained since “Establish Consent Transaction” was performed via this API before.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "PSU-IP-Address",
"in": "header",
"description": "The forwarded IP Address header field consists of the corresponding HTTP request IP Address field between PSU and TPP.",
"required": true,
"type": "string"
}
],
"responses": {
"200": {
"description": "No errors ocurred. Returns the account's balances",
"schema": {
"$ref": "#/definitions/JsonGetAccountBalancesResponse"
}
},
"400": {
"description": "One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"401": {
"description": "Consent expired, consent is not valid for requested resource",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"403": {
"description": "Consent absent, consent not authorized by user",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"404": {
"description": "Account not found",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"429": {
"description": "Consent access exceeded",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
}
},
"/sandbox/xs2a/v1.3/accounts/{account-id}/transactions": {
"get": {
"tags": [
"Account information service",
"accounts"
],
"summary": "Read Transaction List",
"description": "Reads account data from a given account addressed by 'account-id'.",
"operationId": "getAccountTransactions",
"produces": [
"application/json"
],
"parameters": [
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "account-id",
"in": "path",
"description": "This identification is denoting the addressed account. The account-id is retrieved by using a “Read Account List” call. The account-id is the “id” attribute of the account structure. Its value is constant at least throughout the lifecycle of a given consent.",
"required": true,
"type": "string"
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "Consent-ID",
"in": "header",
"description": "Shall be contained since “Establish Consent Transaction” was performed via this API before.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "PSU-IP-Address",
"in": "header",
"description": "The forwarded IP Address header field consists of the corresponding HTTP request IP Address field between PSU and TPP.",
"required": true,
"type": "string"
},
{
"name": "dateFrom",
"in": "query",
"description": "ISODate\nStarting date of the transaction list",
"required": true,
"type": "string",
"format": "date-time"
},
{
"name": "dateTo",
"in": "query",
"description": "ISODate\nEnd date of the transaction list, default is now if not given",
"required": false,
"type": "string",
"format": "date-time"
},
{
"name": "bookingStatus",
"in": "query",
"description": "Filter by transaction booking status",
"required": true,
"type": "string",
"enum": [
"booked",
"pending",
"both"
]
},
{
"name": "withBalance",
"in": "query",
"description": "If contained, this function reads the list of accessible payment accounts including the booking balance. This call will be rejected if the withBalance parameter is used in a case, where the access right on balances is not granted in the related consent",
"required": false,
"type": "boolean"
}
],
"responses": {
"200": {
"description": "No errors ocurred. Returns account's transactions. In _links section viewAccount link will be used.",
"schema": {
"$ref": "#/definitions/JsonGetAccountTransactionsResponse"
}
},
"400": {
"description": "One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"401": {
"description": "Consent expired, consent is not valid for requested resource",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"403": {
"description": "Consent absent, consent not authorized by user",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"404": {
"description": "Account not found",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"429": {
"description": "Consent access exceeded",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
}
},
"/sandbox/xs2a/v1.3/accounts/{account-id}/transactions/{transactionId}": {
"get": {
"tags": [
"Account information service",
"accounts"
],
"summary": "Read Transaction detail",
"description": "Reads transaction data from a given account addressed by 'account-id' and 'transactionId'. This call is only available on transactions as reported in a JSON format.",
"operationId": "getAccountTransaction",
"produces": [
"application/json"
],
"parameters": [
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "account-id",
"in": "path",
"description": "This identification is denoting the addressed account. The account-id is retrieved by using a “Read Account List” call. The account-id is the “id” attribute of the account structure. Its value is constant at least throughout the lifecycle of a given consent.",
"required": true,
"type": "string"
},
{
"name": "transactionId",
"in": "path",
"description": "This identification is denoting the addressed transaction. The transactionId is retrieved by using a “Read Transaction List” call. The transactionId is the “id” attribute of the transaction structure. Its value is constant at least throughout the lifecycle of a given consent.",
"required": true,
"type": "string"
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "Consent-ID",
"in": "header",
"description": "Shall be contained since “Establish Consent Transaction” was performed via this API before.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "PSU-IP-Address",
"in": "header",
"description": "The forwarded IP Address header field consists of the corresponding HTTP request IP Address field between PSU and TPP.",
"required": true,
"type": "string"
}
],
"responses": {
"200": {
"description": "No errors ocurred. Returns transaction details.",
"schema": {
"$ref": "#/definitions/JsonGetAccountTransactionDetailsResponse"
}
},
"400": {
"description": "One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"401": {
"description": "Consent expired, consent is not valid for requested resource",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"403": {
"description": "Consent absent, consent not authorized by user",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"404": {
"description": "Account not found",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"429": {
"description": "Consent access exceeded",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
}
},
"/sandbox/xs2a/v1.3/consents": {
"post": {
"tags": [
"Account consent service",
"consents"
],
"summary": "Establish Consent Transaction",
"description": "Creates an account information consent resource at the ASPSP regarding access to accounts specified in this request.\nAll permitted \"access\" attributes (\"accounts\", \"balances\" and \"transactions\") used in this message shall carry a non-empty array of account references, indicating the accounts where the type of access is requested. Please note that a \"transactions\", \"balances\" or \"accounts\" access right also gives access to the generic /accounts endpoints, i.e. is implicitly supporting also the \"accounts\" access.",
"operationId": "postConsent",
"consumes": [
"application/json"
],
"produces": [
"application/json"
],
"parameters": [
{
"in": "body",
"name": "body",
"required": false,
"schema": {
"$ref": "#/definitions/JsonPostConsentsRequest"
}
},
{
"name": "Content-Type",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "TPP-Explicit-Authorisation-Preferred",
"in": "header",
"description": "If it equals \"true\", the TPP prefers to start the authorisation process separately, e.g. because of the usage of a signing basket. If it equals \"false\" or if the parameter is not used, there is no preference of the TPP. This especially indicates that the TPP assumes a direct authorisation of the transaction in the next step, without using a signing basket.",
"type": "boolean",
"default": false
},
{
"name": "TPP-Redirect-URI",
"in": "header",
"description": "URI of the TPP, where the transaction flow shall be redirected to after a Redirect. Mandated for the Redirect SCA Approach (including OAuth2 SCA approach).",
"type": "string",
"format": "uri",
"required": true
},
{
"name": "TPP-Nok-Redirect-URI",
"in": "header",
"description": "If this URI is contained, the TPP is asking to redirect the transaction flow to this address instead of the TPP-Redirect-URI in case of a negative result of the redirect SCA method.",
"type": "string",
"format": "uri"
}
],
"responses": {
"200": {
"description": "successful operation",
"schema": {
"$ref": "#/definitions/JsonPostConsentsResponse"
}
},
"201": {
"description": "No errors occurred. In _links section self link is used.",
"headers": {
"Location": {
"type": "string",
"format": "uri",
"description": "Hyperlink for the status of the resource."
}
}
},
"400": {
"description": "One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format;\nFrequencyPerDay isn't 1 when recurringIndicator is false;\nCombinedServiceIndicator is true",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
}
},
"/sandbox/xs2a/v1.3/consents/{consent-id}": {
"get": {
"tags": [
"Account consent service",
"consents"
],
"summary": "Get Consent Request",
"description": "Returns the content of an account information consent object.",
"operationId": "getConsent",
"produces": [
"application/json"
],
"parameters": [
{
"name": "Accept",
"in": "header",
"required": true,
"type": "string",
"enum": [
"application/json"
]
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "consent-id",
"in": "path",
"description": "Shall be contained since “Establish Consent Transaction” was performed via this API before.",
"required": true,
"type": "string",
"format": "uuid"
}
],
"responses": {
"200": {
"description": "No errors ocurred. Returns consent. In _links section viewAccounts link is used.",
"schema": {
"$ref": "#/definitions/JsonGetConsentResponse"
}
},
"400": {
"description": "One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"404": {
"description": "Consent not found",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
},
"delete": {
"tags": [
"Account consent service",
"consents"
],
"summary": "Delete an Account Information Consent Object",
"description": "The TPP can delete an account information consent object.",
"operationId": "deleteConsent",
"produces": [
"application/json"
],
"parameters": [
{
"name": "consent-id",
"in": "path",
"description": "Shall be contained since “Establish Consent Transaction” was performed via this API before.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
}
],
"responses": {
"204": {
"description": "No errors ocurred. Deleted consent"
},
"400": {
"description": "One of mandatory parameters(headers, request body or query parameters) missing or in incorrect format",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
},
"404": {
"description": "Consent not found",
"schema": {
"$ref": "#/definitions/JsonErrorResponse"
}
}
}
}
},
"/sandbox/xs2a/v1.3/consents/{consent-id}/authorisations": {
"get": {
"tags": [
"Account consent service",
"consents"
],
"summary": "Get authorisation sub-resources request",
"description": "Will deliver an array of resource identifications of all generated authorisation sub-resources.",
"operationId": "consentsGetAuthorizations",
"produces": [
"application/json"
],
"parameters": [
{
"name": "consent-id",
"in": "path",
"description": "Identification of the related resource",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
}
],
"responses": {
"200": {
"description": "Returns array of authorisation sub-resources.",
"schema": {
"$ref": "#/definitions/JsonGetAuthorisationsResponse"
}
}
}
},
"post": {
"tags": [
"Account consent service",
"consents"
],
"summary": "Start authorisation process",
"description": "Starts an authorisation process in for establishing account information consent data on the server.",
"operationId": "consentsStartAuthorization",
"produces": [
"application/json"
],
"parameters": [
{
"name": "consent-id",
"in": "path",
"description": "Identification of the related resource",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-Request-ID",
"in": "header",
"description": "ID of the request, unique to the call, as determined by the initiating party.",
"required": true,
"type": "string",
"format": "uuid"
},
{
"name": "X-API-Key",
"in": "header",
"description": "Authorisation key that can be acquired in Sandbox.",
"required": true,
"type": "string"
},
{
"name": "TPP-Redirect-URI",
"in": "header",
"description": "URI of the TPP, where the transaction flow shall be redirected to after a Redirect. Mandated for the Redirect SCA Approach (including OAuth2 SCA approach).",
"type": "string",
"format": "uri",
"required": true
},
{
"name": "TPP-Nok-Redirect-URI",
"in": "header",
"description": "If this URI is contained, the TPP is asking to redirect the transaction flow to this address instead of the TPP-Redirect-URI in case of a negative result of the redirect SCA method.",
"type": "string",
"format": "uri"
}
],
"responses": {
"201": {
"description": "Created authorisation sub-resource.",
"schema": {
"$ref": "#/definitions/JsonPostAuthorisationsResponse"
}
}
}
}
},
"/sandbox/xs2a/v1.3/consents/{consent-id}/authorisations/{authorisation-id}": {
"get": {
"tags": [
"Account consent service",
"consents"
],
"summary": "Get SCA status request",
"description": "Checks the SCA status of a authorisation sub-resource.",
"opera
# --- truncated at 32 KB (85 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tietoevry/refs/heads/main/openapi/tietoevry-openbanking-xs2a-swagger.json