The XS2A Confirmation of Funds Service (CoF/CBPII) from Triodos Bank UK - 9 operation(s) for card-based payment instrument issuers to check the availability of funds on a Triodos account under the Berlin Group NextGenPSD2 standard.
{
"openapi" : "3.0.1",
"info" : {
"title" : "Triodos XS2A BG service",
"description" : "Triodos XS2A BG service",
"termsOfService" : "https://www.triodos.com",
"contact" : {
"name" : "Triodos Support",
"url" : "https://www.triodos.com",
"email" : "info@triodos.com"
},
"license" : {
"name" : "Creative Commons Attribution 4.0 International Public License",
"url" : "https://creativecommons.org/licenses/by/4.0/"
},
"version" : "1.1"
},
"externalDocs" : {
"description" : "Berlin Group XS2A Implementation Version 1.3",
"url" : "https://docs.wixstatic.com/ugd/c2914b_bec5f9d0d3c94cfca2ad1b9da36dc752.pdf"
},
"servers" : [ {
"url" : "https://xs2a-sandbox.triodos.com/xs2a-bg",
"description" : "Triodos XS2A Sandbox"
} ],
"tags" : [ {
"name" : "Payment Initiation Service",
"description" : "This service may be used by a PISP to initiate a single payment on behalf of a PSU using a given account of that PSU. The account is managed by the ASPSP providing the XS2A Interface. Functionality and restrictions of this service comply with the requirements defined by article 66 of PSD2.",
"externalDocs" : {
"description" : "Berlin Group XS2A Implementation Version 1.3 - Chapter 5: Payment Initiation Service",
"url" : "https://docs.wixstatic.com/ugd/c2914b_bec5f9d0d3c94cfca2ad1b9da36dc752.pdf"
}
}, {
"name" : "Account Information Service",
"description" : "This service may be used by an AISP to request information about the account of a PSU. The account is managed by the ASPSP providing the XS2A Interface. Functionality and restrictions of this service comply with the requirements defined by article 67 of PSD2.",
"externalDocs" : {
"description" : "Berlin Group XS2A Implementation Version 1.3 - Chapter 6: Account Information Service",
"url" : "https://docs.wixstatic.com/ugd/c2914b_bec5f9d0d3c94cfca2ad1b9da36dc752.pdf"
}
}, {
"name" : "Confirmation of Funds Service",
"description" : "This service may be used by a PIISP to request a confirmation of the availability of specific funds on the account of a PSU. The account is managed by the ASPSP providing the XS2A Interface. Functionality and restrictions of this service comply with the requirements defined by article 65 of PSD2.",
"externalDocs" : {
"description" : "Berlin Group XS2A Implementation Version 1.3 - Chapter 9: Confirmation of Funds Service",
"url" : "https://docs.wixstatic.com/ugd/c2914b_bec5f9d0d3c94cfca2ad1b9da36dc752.pdf"
}
}, {
"name" : "Initial Access Token Service"
} ],
"paths" : {
"/{tenant}/onboarding/v1" : {
"get" : {
"tags" : [ "Initial Access Token Service" ],
"summary" : "Get initial access token",
"description" : "Validates the TPP's X.509 EIDAS certificate and returns an initial access token to continue onboarding procedure.",
"operationId" : "initialAccessToken",
"parameters" : [ {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
} ],
"responses" : {
"200" : {
"description" : "Initial access token returned",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/Xs2aInitialAccessTokenResponse"
}
}
}
},
"401" : {
"description" : "TLS certificate is missing or invalid/ Provided certificate contains an invalid organizationIdentifier",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
}
}
}
},
"/{tenant}/v1/accounts/{account-id}" : {
"get" : {
"tags" : [ "Account Information Service" ],
"summary" : "Get account",
"description" : "Reads details about an account, with balances where required. It is assumed that a consent of the PSU to this access is already given and stored on the ASPSP system. The addressed details of this account depends then on the stored consent addressed by consentId, respectively the OAuth2 access token.",
"operationId" : "getAccount",
"parameters" : [ {
"name" : "X-Request-ID",
"in" : "header",
"description" : "ID of the request, unique to the call, as determined by the initiating party.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
}, {
"name" : "Signature",
"in" : "header",
"description" : "A signature of the request by the TPP on application level.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "Digest",
"in" : "header",
"description" : "Digest contains a Hash of the message body, used for authentication of the request. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "PSU-IP-Address",
"in" : "header",
"description" : "IP Address of the PSU if involved in the request.",
"schema" : {
"type" : "string"
}
}, {
"name" : "Consent-ID",
"in" : "header",
"description" : "ID of registered and authorized consent.",
"required" : true,
"schema" : {
"type" : "string",
"format" : "uuid"
}
}, {
"name" : "account-id",
"in" : "path",
"description" : "ID of account.",
"required" : true,
"schema" : {
"type" : "string",
"format" : "uuid"
}
}, {
"name" : "withBalance",
"in" : "query",
"description" : "Not supported, should be unset",
"schema" : {
"type" : "boolean"
}
} ],
"responses" : {
"200" : {
"description" : "Account returned",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/Xs2aAccountResponse"
}
}
}
},
"400" : {
"description" : "ConsentID invalid/ AccountID invalid",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"401" : {
"description" : "Invalid scope/ Invalid consent/ Given access token is not coupled to the given consent/ User has no access to the given account/ Consented product is blocked",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"403" : {
"description" : "ConsentID not found, or not registered for this TPP",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"404" : {
"description" : "AccountID not found",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
}
}
}
},
"/{tenant}/v1/accounts" : {
"get" : {
"tags" : [ "Account Information Service" ],
"summary" : "Get accounts",
"description" : "Reads a list of bank accounts, with balances where required. It is assumed that a consent of the PSU to this access is already given and stored on the ASPSP system. The addressed list of accounts depends then on the PSU ID and the stored consent addressed by consentId, respectively the OAuth2 access token.",
"operationId" : "getAccounts",
"parameters" : [ {
"name" : "X-Request-ID",
"in" : "header",
"description" : "ID of the request, unique to the call, as determined by the initiating party.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
}, {
"name" : "Signature",
"in" : "header",
"description" : "A signature of the request by the TPP on application level.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "Digest",
"in" : "header",
"description" : "Digest contains a Hash of the message body, used for authentication of the request. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "PSU-IP-Address",
"in" : "header",
"description" : "IP Address of the PSU if involved in the request.",
"schema" : {
"type" : "string"
}
}, {
"name" : "Consent-ID",
"in" : "header",
"description" : "ID of registered and authorized consent.",
"required" : true,
"schema" : {
"type" : "string",
"format" : "uuid"
}
}, {
"name" : "withBalance",
"in" : "query",
"description" : "Not supported, should be unset",
"schema" : {
"type" : "boolean"
}
} ],
"responses" : {
"200" : {
"description" : "Accounts returned",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/Xs2aAccountsResponse"
}
}
}
},
"400" : {
"description" : "ConsentID invalid",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"401" : {
"description" : "Invalid scope/ Invalid consent/ Given access token is not coupled to the given consent/ User does not have access to the consented accounts/ Consented products are blocked",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"403" : {
"description" : "ConsentID not found, or not registered for this TPP",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
}
}
}
},
"/{tenant}/v1/accounts/{account-id}/balances" : {
"get" : {
"tags" : [ "Account Information Service" ],
"summary" : "Get account balances",
"description" : "Reads account data from a given account addressed by \"account-id\".",
"operationId" : "getBalances",
"parameters" : [ {
"name" : "X-Request-ID",
"in" : "header",
"description" : "ID of the request, unique to the call, as determined by the initiating party.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
}, {
"name" : "Signature",
"in" : "header",
"description" : "A signature of the request by the TPP on application level.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "Digest",
"in" : "header",
"description" : "Digest contains a Hash of the message body, used for authentication of the request. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "PSU-IP-Address",
"in" : "header",
"description" : "IP Address of the PSU if involved in the request.",
"schema" : {
"type" : "string"
}
}, {
"name" : "Consent-ID",
"in" : "header",
"description" : "ID of registered and authorized consent.",
"required" : true,
"schema" : {
"type" : "string",
"format" : "uuid"
}
}, {
"name" : "account-id",
"in" : "path",
"description" : "ID of account.",
"required" : true,
"schema" : {
"type" : "string",
"format" : "uuid"
}
} ],
"responses" : {
"200" : {
"description" : "Balances returned",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/Xs2aBalancesResponse"
}
}
}
},
"400" : {
"description" : "ConsentUUID invalid/ AccountID invalid",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"401" : {
"description" : "Invalid scope/ Invalid consent/ Given access token is not coupled to the given consent/ User has no access to the given account/ Consented product is blocked/ Given consent does not provide access to balance of account",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"403" : {
"description" : "ConsentID not found, or not registered for this TPP",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"404" : {
"description" : "AccountID not found",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"429" : {
"description" : "Too many requests - number of requests exceeds FrequencyPerDay of consent",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
}
}
}
},
"/{tenant}/v1/accounts/{account-id}/transactions" : {
"get" : {
"tags" : [ "Account Information Service" ],
"summary" : "Get account transactions",
"description" : "Reads account data from a given account addressed by \"account-id\".",
"operationId" : "getTransactions",
"parameters" : [ {
"name" : "X-Request-ID",
"in" : "header",
"description" : "ID of the request, unique to the call, as determined by the initiating party.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
}, {
"name" : "Signature",
"in" : "header",
"description" : "A signature of the request by the TPP on application level.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "Digest",
"in" : "header",
"description" : "Digest contains a Hash of the message body, used for authentication of the request. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "PSU-IP-Address",
"in" : "header",
"description" : "IP Address of the PSU if involved in the request.",
"schema" : {
"type" : "string"
}
}, {
"name" : "Consent-ID",
"in" : "header",
"description" : "ID of registered and authorized consent.",
"required" : true,
"schema" : {
"type" : "string",
"format" : "uuid"
}
}, {
"name" : "account-id",
"in" : "path",
"description" : "ID of account.",
"required" : true,
"schema" : {
"type" : "string",
"format" : "uuid"
}
}, {
"name" : "bookingStatus",
"in" : "query",
"description" : "Permitted codes are \"booked\", \"pending\" and \"both\", mandated if no delta access is required.",
"schema" : {
"type" : "string",
"enum" : [ "booked", "pending", "both", "information", "all" ]
}
}, {
"name" : "dateFrom",
"in" : "query",
"description" : "Starting date (inclusive the date dateFrom) of the transaction list, mandated if no delta access is required.",
"schema" : {
"type" : "string",
"format" : "date"
}
}, {
"name" : "dateTo",
"in" : "query",
"description" : "End date (inclusive the date dateTo) of the transaction list, default is now if not given.",
"schema" : {
"type" : "string",
"format" : "date"
}
}, {
"name" : "withBalance",
"in" : "query",
"description" : "Not supported, should be unset",
"schema" : {
"type" : "boolean"
}
}, {
"name" : "entryReferenceFrom",
"in" : "query",
"description" : "Not supported, should be unset",
"schema" : {
"type" : "string"
}
}, {
"name" : "deltaList",
"in" : "query",
"description" : "Not supported, should be unset",
"schema" : {
"type" : "boolean"
}
}, {
"name" : "edgeToken",
"in" : "query",
"description" : "Pagination edge token, to be used when paging through transactions",
"schema" : {
"$ref" : "#/components/schemas/Xs2aTransactionSearchCriteriaEdgeToken"
}
} ],
"responses" : {
"200" : {
"description" : "Transactions returned",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/Xs2aTransactionsResponse"
}
}
}
},
"400" : {
"description" : "ConsentID invalid/ AccountID invalid",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"401" : {
"description" : "Invalid scope/ Invalid consent/ Given access token is not coupled to the given consent/ User has no access to the given account/ Consented product is blocked/ Given consent does not provide access to transactions of account",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"403" : {
"description" : "ConsentID not found, or not registered for this TPP",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"404" : {
"description" : "AccountID not found",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"429" : {
"description" : "Too many requests - number of requests exceeds FrequencyPerDay of consent",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
}
}
}
},
"/{tenant}/v1/accounts/{account-id}/transactions/page" : {
"get" : {
"tags" : [ "Account Information Service" ],
"summary" : "Paginate account transactions (deprecated, pass edge token to transactions endpoint instead)",
"description" : "Reads account data from a given account addressed by \"account-id\".",
"operationId" : "getTransactionsPage",
"parameters" : [ {
"name" : "X-Request-ID",
"in" : "header",
"description" : "ID of the request, unique to the call, as determined by the initiating party.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
}, {
"name" : "Signature",
"in" : "header",
"description" : "A signature of the request by the TPP on application level.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "Digest",
"in" : "header",
"description" : "Digest contains a Hash of the message body, used for authentication of the request. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "PSU-IP-Address",
"in" : "header",
"description" : "IP Address of the PSU if involved in the request.",
"schema" : {
"type" : "string"
}
}, {
"name" : "Consent-ID",
"in" : "header",
"description" : "ID of registered and authorized consent.",
"required" : true,
"schema" : {
"type" : "string",
"format" : "uuid"
}
}, {
"name" : "account-id",
"in" : "path",
"description" : "ID of account.",
"required" : true,
"schema" : {
"type" : "string",
"format" : "uuid"
}
}, {
"name" : "edgeToken",
"in" : "query",
"description" : "Pagination edge token.",
"required" : true,
"schema" : {
"type" : "string"
}
} ],
"responses" : {
"200" : {
"description" : "Transactions returned",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/Xs2aTransactionsResponse"
}
}
}
},
"400" : {
"description" : "ConsentID invalid/ AccountID invalid",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"401" : {
"description" : "Invalid scope/ Invalid consent/ Given access token is not coupled to the given consent/ User has no access to the given account/ Consented product is blocked/ Given consent does not provide access to transactions of account",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"403" : {
"description" : "ConsentID not found, or not registered for this TPP",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"404" : {
"description" : "AccountID not found",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"429" : {
"description" : "Too many requests - number of requests exceeds FrequencyPerDay of consent",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
}
},
"deprecated" : true
}
},
"/{tenant}/v1/bulk-payments/sepa-credit-transfers/{resource-id}/authorisations" : {
"get" : {
"tags" : [ "Payment Initiation Service" ],
"summary" : "Get authorisations",
"description" : "Will deliver an array of resource ids of all generated authorisation sub-resources.",
"operationId" : "getAuthorisations",
"parameters" : [ {
"name" : "X-Request-ID",
"in" : "header",
"description" : "ID of the request, unique to the call, as determined by the initiating party.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
}, {
"name" : "Signature",
"in" : "header",
"description" : "A signature of the request by the TPP on application level.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "Digest",
"in" : "header",
"description" : "Digest contains a Hash of the message body, used for authentication of the request. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "resource-id",
"in" : "path",
"description" : "ID of the payment.",
"required" : true,
"schema" : {
"type" : "string",
"format" : "uuid"
}
} ],
"responses" : {
"200" : {
"description" : "Authorisations returned",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/Xs2aAuthorisationsRequestResponse"
}
}
}
},
"400" : {
"description" : "PaymentID is invalid",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
},
"403" : {
"description" : "PaymentID not found, or not registered for this TPP",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/TppMessages"
}
}
}
}
}
},
"post" : {
"tags" : [ "Payment Initiation Service" ],
"summary" : "Create authorisation",
"description" : "Creates a payment authorisation sub-resource.",
"operationId" : "createAuthorisation",
"parameters" : [ {
"name" : "X-Request-ID",
"in" : "header",
"description" : "ID of the request, unique to the call, as determined by the initiating party.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "tenant",
"in" : "path",
"description" : "Branch of the request.",
"required" : true,
"schema" : {
"type" : "string",
"enum" : [ "uk", "nl", "be_fr", "be_nl" ]
}
}, {
"name" : "Signature",
"in" : "header",
"description" : "A signature of the request by the TPP on application level.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "Digest",
"in" : "header",
"description" : "Digest contains a Hash of the message body, used for authentication of the request. The only hash algorithms that may be used to calculate the Digest within the context of this specification are SHA-256 and SHA-512.",
"required" : true,
"schema" : {
"type" : "string"
}
}, {
"name" : "resource-id",
"in" : "path",
"description" : "ID of the payment to create authorisation sub-resource for.",
"required" : true,
"schema" : {
"type" : "string",
"format" : "uuid"
}
}, {
"name" : "TPP-Redirect-URI",
"in" : "header",
"description" : "URI of the TPP, where the transaction flow shall be redirected to after a Redirect.",
"required" : true,
"schema" : {
"type" : "string"
}
} ],
"responses" : {
"201" : {
"description" : "Payment authorisation created",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/Xs2aAuthorisationRequestResponse"
}
}
}
},
"400" : {
"description" : "PaymentID is invalid",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas
# --- truncated at 32 KB (324 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/triodos-bank-uk/refs/heads/main/openapi/triodos-bank-uk-xs2a-openapi.json