The Triodos Auth service - 8 operation(s) implementing OAuth2 / OpenID Connect for XS2A third-party providers, including dynamic client registration, OpenID configuration discovery, authorization, token issuance and revocation, and UserInfo, used to obtain PSD2-scoped access to the AIS, PIS, and CoF APIs.
{
"openapi" : "3.0.1",
"info" : {
"title" : "Triodos Auth service",
"description" : "Triodos Auth service",
"termsOfService" : "https://www.triodos.com",
"contact" : {
"name" : "Triodos Support",
"url" : "https://www.triodos.com",
"email" : "info@triodos.com"
},
"license" : {
"name" : "Creative Commons Attribution 4.0 International Public License",
"url" : "https://creativecommons.org/licenses/by/4.0/"
},
"version" : "1.0"
},
"externalDocs" : {
"description" : "OpenID Connect 1.0 specifications",
"url" : "https://openid.net/connect/"
},
"servers" : [ {
"url" : "https://xs2a-sandbox.triodos.com/auth",
"description" : "Triodos Auth Sandbox"
} ],
"tags" : [ {
"name" : "Client Registration Endpoint",
"description" : "The Client Registration Endpoint performs registration of the client.",
"externalDocs" : {
"description" : "OpenID Connect Dynamic Client Registration 1.0 - Chapter 3 Client Registration Endpoint",
"url" : "https://openid.net/specs/openid-connect-registration-1_0.html"
}
}, {
"name" : "Configuration Endpoint",
"description" : "The Configuration Endpoint provides configuration information about this OpenID service.",
"externalDocs" : {
"description" : "OpenID Connect Dynamic Client Registration 1.0 - Chapter 4 Client Configuration Endpoint",
"url" : "https://openid.net/specs/openid-connect-registration-1_0.html"
}
}, {
"name" : "Authorization Endpoint",
"description" : "The Authorization Endpoint performs authentication of the end-user.",
"externalDocs" : {
"description" : "OpenID Connect Core 1.0 - Chapter 3.1.2 Authorization Endpoint",
"url" : "https://openid.net/specs/openid-connect-core-1_0.html"
}
}, {
"name" : "Token Endpoint",
"description" : "The Token Endpoint provides and revokes access tokens and refresh tokens.",
"externalDocs" : {
"description" : "OpenID Connect Core 1.0 - Chapter 3.1.3 Token Endpoint",
"url" : "https://openid.net/specs/openid-connect-core-1_0.html"
}
}, {
"name" : "UserInfo Endpoint",
"description" : "The UserInfo Endpoint provides information about the authenticated end-user.",
"externalDocs" : {
"description" : "OpenID Connect Core 1.0 - Chapter 5.3 UserInfo Endpoint",
"url" : "https://openid.net/specs/openid-connect-core-1_0.html"
}
} ],
"paths" : {
"/{tenant}/v1/auth" : {
"get" : {
"tags" : [ "Authorization Endpoint" ],
"summary" : "Authorize end-user",
"description" : "The Authorization Endpoint performs Authentication of the End-User. This is done by sending the User Agent to the Authorization Server's Authorization Endpoint for Authentication and Authorization, using request parameters defined by OAuth 2.0 and additional parameters and parameter values defined by OpenID Connect.",
"operationId" : "authorizeGet",
"parameters" : [ {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
}, {
"name" : "request",
"in" : "query",
"description" : "Not supported.",
"schema" : {
"type" : "string"
}
}, {
"name" : "request_uri",
"in" : "query",
"description" : "Not supported.",
"schema" : {
"type" : "string"
}
}, {
"name" : "registration",
"in" : "query",
"description" : "Not supported.",
"schema" : {
"type" : "string"
}
}, {
"name" : "response_type",
"in" : "query",
"description" : "Always set to \"code\".",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "client_id",
"in" : "query",
"description" : "OAuth 2.0 Client Identifier valid at the Authorization Server.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "redirect_uri",
"in" : "query",
"description" : "Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider, with the matching performed as described in Section 6.2.1 of RFC3986 (Simple String Comparison). When using this flow, the Redirection URI SHOULD use the https scheme; however, it MAY use the http scheme, provided that the Client Type is confidential, as defined in Section 2.1 of OAuth 2.0, and provided the OP allows the use of http Redirection URIs in this case. The Redirection URI MAY use an alternate scheme, such as one that is intended to identify a callback into a native application.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "scope",
"in" : "query",
"description" : "OpenID Connect requests MUST contain the openid scope value. Scope values used that are not understood by an implementation SHOULD be ignored. See OpenID Connect Core 1.0 - Sections 5.4 and 11 for additional scope values defined by this specification.",
"required" : true,
"schema" : {
"$ref" : "#/components/schemas/OAuthScope"
}
}, {
"name" : "state",
"in" : "query",
"description" : "Opaque value used to maintain state between the request and the callback. Typically, Cross-Site Request Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the value of this parameter with a browser cookie.",
"schema" : {
"type" : "string"
}
}, {
"name" : "nonce",
"in" : "query",
"description" : "String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values. For implementation notes, see Section 15.5.2.",
"schema" : {
"type" : "string"
}
}, {
"name" : "response_mode",
"in" : "query",
"description" : "Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint. This use of this parameter is NOT RECOMMENDED when the Response Mode that would be requested is the default mode specified for the Response Type.",
"schema" : {
"type" : "string"
}
}, {
"name" : "prompt",
"in" : "query",
"description" : "Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.",
"schema" : {
"type" : "string"
}
}, {
"name" : "max_age",
"in" : "query",
"description" : "Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. If the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User. (The max_age request parameter corresponds to the OpenID 2.0 PAPE max_auth_age request parameter.) When max_age is used, the ID Token returned MUST include an auth_time Claim Value.",
"schema" : {
"type" : "string"
}
}, {
"name" : "code_challenge",
"in" : "query",
"description" : "Code challenge, see RFC7636 for more information.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "code_challenge_method",
"in" : "query",
"description" : "Always set to \"S256\".",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "id_token_hint",
"in" : "query",
"description" : "ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response; otherwise, it returns an error. When possible, an id_token_hint SHOULD be present when prompt=none is used and an invalid_request error MAY be returned if it is not; however, the server SHOULD respond successfully when possible, even if it is not present. The Authorization Server need not be listed as an audience of the ID Token when it is used as an id_token_hint value. If the ID Token received by the RP from the OP is encrypted, to use it as an id_token_hint, the Client MUST decrypt the signed ID Token contained within the encrypted ID Token. The Client MAY re-encrypt the signed ID token to the Authentication Server using a key that enables the server to decrypt the ID Token, and use the re-encrypted ID token as the id_token_hint value.",
"schema" : {
"type" : "string"
}
} ],
"responses" : {
"302" : {
"description" : "An Authentication Response is an OAuth 2.0 Authorization Response message returned from the OP's Authorization Endpoint in response to the Authorization Request message sent by the RP."
},
"400" : {
"description" : "Invalid client id, TPP with client id not found, TPP with client id not found, invalid redirect uri, unregistered redirect_uri, invalid subject in id_token_hint, invalid_request, consent_required, unsupported_response_type, request_not_supported, request_uri_not_supported, registration_not_supported or invalid_scope"
}
}
},
"post" : {
"tags" : [ "Authorization Endpoint" ],
"summary" : "Authorize end-user",
"description" : "The Authorization Endpoint performs Authentication of the End-User. This is done by sending the User Agent to the Authorization Server's Authorization Endpoint for Authentication and Authorization, using request parameters defined by OAuth 2.0 and additional parameters and parameter values defined by OpenID Connect.",
"operationId" : "authorizePost",
"parameters" : [ {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
} ],
"requestBody" : {
"content" : {
"*/*" : {
"schema" : {
"required" : [ "client_id", "code_challenge", "code_challenge_method", "redirect_uri", "response_type", "scope" ],
"type" : "object",
"properties" : {
"request" : {
"type" : "string",
"description" : "Not supported."
},
"request_uri" : {
"type" : "string",
"description" : "Not supported."
},
"registration" : {
"type" : "string",
"description" : "Not supported."
},
"response_type" : {
"type" : "string",
"description" : "Always set to \"code\"."
},
"client_id" : {
"type" : "string",
"description" : "OAuth 2.0 Client Identifier valid at the Authorization Server."
},
"redirect_uri" : {
"type" : "string",
"description" : "Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider, with the matching performed as described in Section 6.2.1 of RFC3986 (Simple String Comparison). When using this flow, the Redirection URI SHOULD use the https scheme; however, it MAY use the http scheme, provided that the Client Type is confidential, as defined in Section 2.1 of OAuth 2.0, and provided the OP allows the use of http Redirection URIs in this case. The Redirection URI MAY use an alternate scheme, such as one that is intended to identify a callback into a native application."
},
"scope" : {
"$ref" : "#/components/schemas/OAuthScope"
},
"state" : {
"type" : "string",
"description" : "Opaque value used to maintain state between the request and the callback. Typically, Cross-Site Request Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the value of this parameter with a browser cookie."
},
"nonce" : {
"type" : "string",
"description" : "String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values. For implementation notes, see Section 15.5.2."
},
"response_mode" : {
"type" : "string",
"description" : "Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint. This use of this parameter is NOT RECOMMENDED when the Response Mode that would be requested is the default mode specified for the Response Type."
},
"prompt" : {
"type" : "string",
"description" : "Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent."
},
"max_age" : {
"type" : "string",
"description" : "Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. If the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User. (The max_age request parameter corresponds to the OpenID 2.0 PAPE max_auth_age request parameter.) When max_age is used, the ID Token returned MUST include an auth_time Claim Value."
},
"code_challenge" : {
"type" : "string",
"description" : "Code challenge, see RFC7636 for more information."
},
"code_challenge_method" : {
"type" : "string",
"description" : "Always set to \"S256\"."
},
"id_token_hint" : {
"type" : "string",
"description" : "ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response; otherwise, it returns an error. When possible, an id_token_hint SHOULD be present when prompt=none is used and an invalid_request error MAY be returned if it is not; however, the server SHOULD respond successfully when possible, even if it is not present. The Authorization Server need not be listed as an audience of the ID Token when it is used as an id_token_hint value. If the ID Token received by the RP from the OP is encrypted, to use it as an id_token_hint, the Client MUST decrypt the signed ID Token contained within the encrypted ID Token. The Client MAY re-encrypt the signed ID token to the Authentication Server using a key that enables the server to decrypt the ID Token, and use the re-encrypted ID token as the id_token_hint value."
}
}
}
}
}
},
"responses" : {
"302" : {
"description" : "An Authentication Response is an OAuth 2.0 Authorization Response message returned from the OP's Authorization Endpoint in response to the Authorization Request message sent by the RP."
},
"400" : {
"description" : "Invalid client id, TPP with client id not found, TPP with client id not found, invalid redirect uri, unregistered redirect_uri, invalid subject in id_token_hint, invalid_request, consent_required, unsupported_response_type, request_not_supported, request_uri_not_supported, registration_not_supported or invalid_scope"
}
}
}
},
"/{tenant}/.well-known/openid-configuration" : {
"get" : {
"tags" : [ "Configuration Endpoint" ],
"summary" : "Get configuration",
"description" : "The Configuration Endpoint allows the OpenID Provider's configuration information to be retrieved.",
"operationId" : "configuration",
"parameters" : [ {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
} ],
"responses" : {
"200" : {
"description" : "The response is a set of Claims about the OpenID Provider's configuration, including all necessary endpoints and public key location information. Contains a set of Claims as its members that are a subset of the Metadata values defined in OpenID Connect Discovery 1.0 - Section 3. Other Claims MAY also be returned.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/ConfigResponse"
}
}
}
}
}
}
},
"/{tenant}/v1/registration" : {
"post" : {
"tags" : [ "Client Registration Endpoint" ],
"summary" : "Register client",
"description" : "The Client Registration Endpoint is an OAuth 2.0 Protected Resource through which a new Client registration can be requested. The OpenID Provider requires an Initial Access Token that is provisioned in the service the client wants to access, to restrict registration requests to only authorized Clients or developers.",
"operationId" : "authorizePost_1",
"parameters" : [ {
"name" : "Authorization",
"in" : "header",
"description" : "Bearer access token.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
} ],
"requestBody" : {
"content" : {
"*/*" : {
"schema" : {
"required" : [ "redirect_uris" ],
"type" : "object",
"properties" : {
"sector_identifier_uri" : {
"type" : "string",
"description" : "This parameter defines the sector identifier URI."
},
"redirect_uris" : {
"type" : "array",
"description" : "This parameter defines the used redirect URIs.",
"items" : {
"type" : "string"
}
}
}
}
}
}
},
"responses" : {
"201" : {
"description" : "Upon successful registration, the Client Registration Endpoint returns the newly-created Client Identifier and a Client Secret, along with all registered Metadata about this Client, including any fields provisioned by the Authorization Server itself. The Authorization Server MAY reject or replace any of the Client's requested field values and substitute them with suitable values. If this happens, the Authorization Server MUST include these fields in the response to the Client. An Authorization Server MAY ignore values provided by the client, and MUST ignore any fields sent by the Client that it does not understand.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/OIDCClientInformation"
}
}
}
},
"401" : {
"description" : "invalid_request, access_denied or invalid_token"
}
}
}
},
"/{tenant}/v1/token" : {
"post" : {
"tags" : [ "Token Endpoint" ],
"summary" : "Get token",
"description" : "To obtain an Access Token and a Refresh Token, the RP (Client) sends a Token Request to the Token Endpoint to obtain a Token Response, as described in Section 3.2 of OAuth 2.0.",
"operationId" : "token",
"parameters" : [ {
"name" : "Authorization",
"in" : "header",
"description" : "Client secret basic authentication.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
} ],
"requestBody" : {
"content" : {
"*/*" : {
"schema" : {
"required" : [ "grant_type" ],
"type" : "object",
"properties" : {
"redirect_uri" : {
"type" : "string",
"description" : "Must be identical to the \"redirect_uri\" parameter that was included in the authorization request. Not needed when requesting a refresh token."
},
"code" : {
"type" : "string",
"description" : "The authorization code received from the authorization server. Not needed when requesting a refresh token."
},
"refresh_token" : {
"type" : "string",
"description" : "The refresh token received from the authorization server. Not needed when using an authorization code."
},
"grant_type" : {
"type" : "string",
"description" : "Specify \"authorization_code\" when an authorization code is provided or \"refresh_token\" when a refresh token is provided.",
"enum" : [ "IMPLICIT", "AUTHORIZATION_CODE", "REFRESH_TOKEN", "PASSWORD", "CLIENT_CREDENTIALS", "JWT_BEARER" ]
},
"code_verifier" : {
"type" : "string",
"description" : "Client provided code verifier for additional challenge-response verification, see RFC7636 for more information. Not needed when requesting a refresh token."
}
}
}
}
}
},
"responses" : {
"200" : {
"description" : "After receiving and validating a valid and authorized Token Request from the Client, the Authorization Server returns a successful response that includes an ID Token, an Access Token and a Refresh Token.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/OIDCClientInformation"
}
}
}
},
"400" : {
"description" : "unsupported_grant_type, invalid_request, invalid_grant or unauthorized_client"
}
}
}
},
"/{tenant}/v1/token/revoke" : {
"post" : {
"tags" : [ "Token Endpoint" ],
"summary" : "Revoke token",
"description" : "The client requests the revocation of a particular token by making an HTTP POST request to the token revocation endpoint URL. See RFC7009 for more information.",
"operationId" : "tokenRevocation",
"parameters" : [ {
"name" : "Authorization",
"in" : "header",
"description" : "Client secret basic authentication.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
} ],
"requestBody" : {
"content" : {
"*/*" : {
"schema" : {
"required" : [ "token" ],
"type" : "object",
"properties" : {
"token" : {
"type" : "string",
"description" : "The token that the client wants to get revoked."
},
"token_type_hint" : {
"type" : "string",
"description" : "A hint about the type of the token submitted for revocation."
}
}
}
}
}
},
"responses" : {
"200" : {
"description" : "If the request is technically correct, regardless of the token was actually found or revoked.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/OIDCClientInformation"
}
}
}
},
"400" : {
"description" : "unauthorized_client"
},
"401" : {
"description" : "access_denied"
}
}
}
},
"/{tenant}/v1/userinfo" : {
"get" : {
"tags" : [ "UserInfo Endpoint" ],
"summary" : "Get UserInfo",
"description" : "The UserInfo Endpoint is an OAuth 2.0 Protected Resource that returns Claims about the authenticated End-User. To obtain the requested Claims about the End-User, the Client makes a request to the UserInfo Endpoint using an Access Token obtained through OpenID Connect Authentication. These Claims are normally represented by a JSON object that contains a collection of name and value pairs for the Claims.",
"operationId" : "doGet",
"parameters" : [ {
"name" : "Authorization",
"in" : "header",
"description" : "Bearer access token.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
} ],
"responses" : {
"200" : {
"description" : "The UserInfo Claims MUST be returned as the members of a JSON object unless a signed or encrypted response was requested during Client Registration. The Claims defined in OpenID Connect Core 1.0 - Section 5.1 can be returned, as can additional Claims not specified there.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/SignedJWT"
}
}
}
},
"400" : {
"description" : "invalid_token or access_denied"
}
}
},
"post" : {
"tags" : [ "UserInfo Endpoint" ],
"summary" : "Get UserInfo",
"description" : "The UserInfo Endpoint is an OAuth 2.0 Protected Resource that returns Claims about the authenticated End-User. To obtain the requested Claims about the End-User, the Client makes a request to the UserInfo Endpoint using an Access Token obtained through OpenID Connect Authentication. These Claims are normally represented by a JSON object that contains a collection of name and value pairs for the Claims.",
"operationId" : "doPost",
"parameters" : [ {
"name" : "Authorization",
"in" : "header",
"description" : "Bearer access token.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
} ],
"responses" : {
"200" : {
"description" : "The UserInfo Claims MUST be returned as the members of a JSON object unless a signed or encrypted response was requested during Client Registration. The Claims defined in OpenID Connect Core 1.0 - Section 5.1 can be returned, as can additional Claims not specified there.",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/SignedJWT"
}
}
}
},
"400" : {
"description" : "invalid_token or access_denied"
}
}
}
}
},
"components" : {
"schemas" : {
"OAuthScope" : {
"type" : "object",
"properties" : {
"types" : {
"uniqueItems" : true,
"type" : "array",
"items" : {
"type" : "string",
"enum" : [ "OPENID", "OFFLINE_ACCESS", "ACCESS_ACCOUNTS", "EXECUTE_PAYMENTS", "CANCEL_PAYMENTS", "CONFIRMATION_OF_FUNDS" ]
}
},
"applicationValue" : {
"type" : "string"
},
"applicationType" : {
"type" : "string",
"enum" : [ "OPENID", "OFFLINE_ACCESS", "ACCESS_ACCOUNTS", "EXECUTE_PAYMENTS", "CANCEL_PAYMENTS", "CONFIRMATION_OF_FUNDS" ]
}
}
},
"ConfigResponse" : {
"type" : "object",
"properties" : {
"issuer" : {
"type" : "string"
},
"mutual_tls_sender_constrained_access_tokens" : {
"type" : "boolean"
},
"request_parameter_supported" : {
"type" : "boolean"
},
"authorization_endpoint" : {
"type" : "string"
},
"token_endpoint" : {
"type" : "string"
},
"userinfo_endpoint" : {
"type" : "string"
},
"revocation_endpoint" : {
"type" : "string"
},
"registration_endpoint" : {
"type" : "string"
},
"jwks_uri" : {
"type" : "string"
},
"request_uri_parameter_supported" : {
"type" : "boolean"
},
"claims_parameter_supported" : {
"type" : "boolean"
},
"require_request_uri_registration" : {
"type" : "boolean"
},
"response_types_supported" : {
"uniqueItems" : true,
"type" : "array",
"items" : {
"type" : "string"
}
},
"response_modes_supported" : {
"uniqueItems" : true,
"type" : "array",
"items" : {
"type" : "string"
}
},
"display_values_supported" : {
"uniqueItems" : true,
"type" : "array",
"items" : {
"t
# --- truncated at 32 KB (70 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/triodos-bank-uk/refs/heads/main/openapi/triodos-bank-uk-auth-openapi.json