zopa Accounts API

openapi: 3.0.0
info:
  title: Account and Transaction API Specification Account Access Accounts API
  description: Swagger for Account and Transaction API Specification
  termsOfService: https://www.openbanking.org.uk/terms
  contact:
    name: Service Desk
    email: ServiceDesk@openbanking.org.uk
  license:
    name: open-licence
    url: https://www.openbanking.org.uk/open-licence
  version: 4.0.0
servers:
- url: /open-banking/v4.0/aisp
tags:
- name: Accounts
paths:
  /accounts:
    get:
      tags:
      - Accounts
      summary: Get Accounts
      operationId: GetAccounts
      parameters:
      - $ref: '#/components/parameters/x-fapi-auth-date'
      - $ref: '#/components/parameters/x-fapi-customer-ip-address'
      - $ref: '#/components/parameters/x-fapi-interaction-id'
      - $ref: '#/components/parameters/Authorization'
      - $ref: '#/components/parameters/x-customer-user-agent'
      responses:
        '200':
          $ref: '#/components/responses/200AccountsRead'
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '405':
          $ref: '#/components/responses/405Error'
        '406':
          $ref: '#/components/responses/406Error'
        '429':
          $ref: '#/components/responses/429Error'
        '500':
          $ref: '#/components/responses/500Error'
      security:
      - PSUOAuth2Security:
        - accounts
  /accounts/{AccountId}:
    get:
      tags:
      - Accounts
      summary: Get Accounts
      operationId: GetAccountsAccountId
      parameters:
      - $ref: '#/components/parameters/AccountId'
      - $ref: '#/components/parameters/x-fapi-auth-date'
      - $ref: '#/components/parameters/x-fapi-customer-ip-address'
      - $ref: '#/components/parameters/x-fapi-interaction-id'
      - $ref: '#/components/parameters/Authorization'
      - $ref: '#/components/parameters/x-customer-user-agent'
      responses:
        '200':
          $ref: '#/components/responses/200AccountsAccountIdRead'
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '405':
          $ref: '#/components/responses/405Error'
        '406':
          $ref: '#/components/responses/406Error'
        '429':
          $ref: '#/components/responses/429Error'
        '500':
          $ref: '#/components/responses/500Error'
      security:
      - PSUOAuth2Security:
        - accounts
components:
  schemas:
    OBAccount6:
      type: object
      description: "Unambiguous identification of the account to which credit and debit entries are made. The following fields are optional only for accounts that are switched:\n\n  * Data.Currency  \n  * Data.AccountCategory  \n  * Data.AccountTypeCode\n\nFor all other accounts, the fields must be populated by the ASPSP."
      required:
      - AccountId
      properties:
        AccountId:
          $ref: '#/components/schemas/AccountId'
        Status:
          $ref: '#/components/schemas/OBInternalAccountStatus1Code'
        Currency:
          $ref: '#/components/schemas/ActiveOrHistoricCurrencyCode_0'
        AccountTypeCode:
          $ref: '#/components/schemas/OBExternalAccountSubType1Code'
        Account:
          type: array
          items:
            type: object
            description: Provides the details to identify an account.
            required:
            - SchemeName
            - Identification
            properties:
              SchemeName:
                $ref: '#/components/schemas/OBInternalAccountIdentification4Code'
              Identification:
                $ref: '#/components/schemas/Identification_0'
      additionalProperties: false
    OBErrorResponse1:
      description: An array of detail error codes, and messages, and URLs to documentation to help remediation.
      type: object
      properties:
        Id:
          description: A unique reference for the error instance, for audit purposes, in case of unknown/unclassified errors.
          type: string
          minLength: 1
          maxLength: 40
        Code:
          description: Deprecated <br />High level textual error code, to help categorise the errors.
          type: string
          minLength: 1
          example: 400 BadRequest
          maxLength: 40
        Message:
          description: Deprecated <br />Brief Error message
          type: string
          minLength: 1
          example: There is something wrong with the request parameters provided
          maxLength: 500
        Errors:
          items:
            $ref: '#/components/schemas/OBError1'
          type: array
          minItems: 1
      required:
      - Errors
      additionalProperties: false
    OBReadAccount6:
      type: object
      required:
      - Data
      properties:
        Data:
          type: object
          properties:
            Account:
              type: array
              items:
                $ref: '#/components/schemas/OBAccount6'
        Links:
          $ref: '#/components/schemas/Links'
        Meta:
          $ref: '#/components/schemas/Meta'
      additionalProperties: false
    OBInternalAccountStatus1Code:
      description: 'Specifies the status of account resource in code form. <br />

        For a full list of enumeration values refer to `OBInternalAccountStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)'
      type: string
      example: Enabled
      enum:
      - Deleted
      - Disabled
      - Enabled
      - Pending
      - ProForma
    ActiveOrHistoricCurrencyCode_0:
      description: "Identification of the currency in which the account is held. \nUsage: Currency should only be used in case one and the same account number covers several currencies\nand the initiating party needs to identify which currency needs to be used for settlement on the account."
      type: string
      pattern: ^[A-Z]{3,3}$
      example: GBP
    Meta:
      title: MetaData
      type: object
      description: Meta Data relevant to the payload
      properties:
        TotalPages:
          type: integer
          format: int32
        FirstAvailableDateTime:
          $ref: '#/components/schemas/ISODateTime'
        LastAvailableDateTime:
          $ref: '#/components/schemas/ISODateTime'
      additionalProperties: false
    OBError1:
      type: object
      properties:
        ErrorCode:
          $ref: '#/components/schemas/OBExternalStatusReason1Code'
        Message:
          description: 'A description of the error that occurred. e.g., ''A mandatory field isn''t supplied'' or ''RequestedExecutionDateTime must be in future''

            OBL doesn''t standardise this field'
          type: string
          minLength: 1
          maxLength: 500
        Path:
          description: Recommended but optional reference to the JSON Path of the field with error, e.g., Data.Initiation.InstructedAmount.Currency
          type: string
          minLength: 1
          maxLength: 500
        Url:
          description: URL to help remediate the problem, or provide more information, or to API Reference, or help etc
          type: string
      required:
      - ErrorCode
      additionalProperties: false
      minProperties: 1
    Identification_0:
      description: Identification assigned by an institution to identify an account. This identification is known by the account owner.
      type: string
      example: '80200112344562'
      minLength: 1
      maxLength: 256
    OBExternalStatusReason1Code:
      description: Low level textual error code, for all enum values see `ExternalReason1Code` [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)
      type: string
      minLength: 4
      maxLength: 4
      example: AC17
    OBInternalAccountIdentification4Code:
      description: Name of the identification scheme, in a coded form as published in an external list. <br /> For a full list of enumeration values refer to `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)
      type: string
      x-namespaced-enum:
      - UK.OBIE.BBAN
      - UK.OBIE.IBAN
      - UK.OBIE.PAN
      - UK.OBIE.Paym
      - UK.OBIE.SortCodeAccountNumber
      - UK.OBIE.Wallet
    OBExternalAccountSubType1Code:
      description: Specifies the sub type of account (product family group) <br /> For a full list of enumeration values refer to `OBExternalCashAccountType1Code` *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)
      type: string
      enum:
      - CACC
      - CARD
      - CASH
      - CHAR
      - CISH
      - COMM
      - CPAC
      - LLSV
      - LOAN
      - MGLD
      - MOMA
      - NREX
      - ODFT
      - ONDP
      - OTHR
      - SACC
      - SLRY
      - SVGS
      - TAXE
      - TRAN
      - TRAS
      - VACC
      - NFCA
      - MORT
      - WALT
    Links:
      type: object
      description: Links relevant to the payload
      properties:
        Self:
          type: string
          format: uri
        First:
          type: string
          format: uri
        Prev:
          type: string
          format: uri
        Next:
          type: string
          format: uri
        Last:
          type: string
          format: uri
      additionalProperties: false
      required:
      - Self
    ISODateTime:
      description: "All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00"
      type: string
      format: date-time
    AccountId:
      description: A unique and immutable identifier used to identify the account resource. This identifier has no meaning to the account owner.
      type: string
      example: '22289'
      minLength: 1
      maxLength: 40
  responses:
    400Error:
      description: Bad request
      headers:
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          required: true
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
        application/json:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
        application/jose+jwe:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
    405Error:
      description: Method Not Allowed
      headers:
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          required: true
          schema:
            type: string
    500Error:
      description: Internal Server Error
      headers:
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          required: true
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
        application/json:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
        application/jose+jwe:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
    200AccountsAccountIdRead:
      description: Accounts Read
      headers:
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          required: true
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/OBReadAccount6'
        application/json:
          schema:
            $ref: '#/components/schemas/OBReadAccount6'
        application/jose+jwe:
          schema:
            $ref: '#/components/schemas/OBReadAccount6'
    403Error:
      description: Forbidden
      headers:
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          required: true
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
        application/json:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
        application/jose+jwe:
          schema:
            $ref: '#/components/schemas/OBErrorResponse1'
    429Error:
      description: Too Many Requests
      headers:
        Retry-After:
          description: Number in seconds to wait
          schema:
            type: integer
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          schema:
            type: string
    406Error:
      description: Not Acceptable
      headers:
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          required: true
          schema:
            type: string
    200AccountsRead:
      description: Accounts Read
      headers:
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          required: true
          schema:
            type: string
      content:
        application/json; charset=utf-8:
          schema:
            $ref: '#/components/schemas/OBReadAccount6'
        application/json:
          schema:
            $ref: '#/components/schemas/OBReadAccount6'
        application/jose+jwe:
          schema:
            $ref: '#/components/schemas/OBReadAccount6'
    401Error:
      description: Unauthorised
      headers:
        x-fapi-interaction-id:
          description: An RFC4122 UID used as a correlation id.
          required: true
          schema:
            type: string
  parameters:
    x-customer-user-agent:
      in: header
      name: x-customer-user-agent
      description: Indicates the user-agent that the PSU is using.
      required: false
      schema:
        type: string
    x-fapi-auth-date:
      in: header
      name: x-fapi-auth-date
      required: false
      description: "The time when the PSU last logged in with the TPP. \nAll dates in the HTTP headers are represented as RFC 7231 Full Dates. An example is below: \nSun, 10 Sep 2017 19:43:31 UTC"
      schema:
        type: string
        pattern: ^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} (GMT|UTC)$
    Authorization:
      in: header
      name: Authorization
      required: true
      description: An Authorisation Token as per https://tools.ietf.org/html/rfc6750
      schema:
        type: string
    AccountId:
      name: AccountId
      in: path
      description: AccountId
      required: true
      schema:
        type: string
    x-fapi-customer-ip-address:
      in: header
      name: x-fapi-customer-ip-address
      required: false
      description: The PSU's IP address if the PSU is currently logged in with the TPP.
      schema:
        type: string
    x-fapi-interaction-id:
      in: header
      name: x-fapi-interaction-id
      required: false
      description: An RFC4122 UID used as a correlation id.
      schema:
        type: string
  securitySchemes:
    TPPOAuth2Security:
      type: oauth2
      description: TPP client credential authorisation flow with the ASPSP
      flows:
        clientCredentials:
          tokenUrl: https://authserver.example/token
          scopes:
            accounts: Ability to read Accounts information
    PSUOAuth2Security:
      type: oauth2
      description: OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when a TPP wants to access an ASPSP resource owned by the PSU
      flows:
        authorizationCode:
          authorizationUrl: https://authserver.example/authorization
          tokenUrl: https://authserver.example/token
          scopes:
            accounts: Ability to read Accounts information