--- title: "Forwarding the PSU consent (AISP)" method: PUT path: "/consents" tags: ["AISP"] --- # Forwarding the PSU consent (AISP) `PUT /consents` ## Request - Base URL: `https://www.10207.oba-bad-me-live-api.banquepopulaire.fr/stet/psd2/v1.6.2` - URL: `https://www.10207.oba-bad-me-live-api.banquepopulaire.fr/stet/psd2/v1.6.2/consents` - Auth: OAuth 2 - Authorization code: `/stet/psd2/oauth/authorize` - Token URL: `/stet/psd2/oauth/token` scopes: `aisp` ### Description In the mixed detailed consent on accounts - the AISP captures the consent of the PSU - then it forwards this consent to the ASPSP This consent replaces any prior consent that was previously sent by the AISP. ### Prerequisites - The TPP was registered by the Registration Authority for the AISP role. - The TPP and the PSU have a contract that was enrolled by the ASPSP - At this step, the ASPSP has delivered an OAUTH2 "Authorization Code" or "Resource Owner Password" access token to the TPP (cf. § 3.4.2). - The TPP and the ASPSP have successfully processed a mutual check and authentication - The TPP has presented its OAUTH2 "Authorization Code" or "Resource Owner Password" access token which allows the ASPSP to identify the relevant PSU and retrieve the linked PSU context (cf. § 3.4.2) if any. - The ASPSP takes into account the access token that establishes the link between the PSU and the AISP. ### Business Flow The PSU specifies to the AISP which of his/her accounts will be accessible and which functionalities should be available. The AISP forwards these settings to the ASPSP. The ASPSP answers by HTTP201 return code. ## Headers - `Authorization` string, required - `PSU-IP-Address` string - `PSU-IP-Port` string - `PSU-HTTP-Method` string - `PSU-Date` string - `PSU-GEO-Location` string - `PSU-User-Agent` string - `PSU-Referer` string - `PSU-Accept` string - `PSU-Accept-Charset` string - `PSU-Accept-Encoding` string - `PSU-Accept-Language` string - `PSU-Device-ID` string - `Digest` string - `Signature` string, required - `X-Request-ID` string, required ## Request body - Access: Requested access services. - `owners` AccountIdentification[], required: List of accessible accounts for one given functionality - `workspace` string: Workspace to which the account is linked. This workspace might be specified by the AISP when forwarding the consent on accounts. If not provided, the default workspace is computed from the authentication that was used for getting the OAuth2 Access Token. - `iban` string: ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer. Further specifications of the format and content of the IBAN can be found in the standard ISO 13616 "Banking and related financial services - International Bank Account Number (IBAN)" version 1997-10-01, or later revisions. - `other` GenericIdentification: ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer. API: The ASPSP will document which account reference type it will support. - `identification` string, required: API: Identifier - `schemeName` string, required: Name of the identification scheme. Possible values for the scheme name, partially based on ISO20022 external code list, are the following: | Code | Name | Description | | ---- | ---- | ----------- | | BANK | BankPartyIdentification | Unique and unambiguous assignment made by a specific bank or similar financial institution to identify a relationship as defined between the bank and its client. | | BBAN | BBANIdentifier | Basic Bank Account Number (BBAN) - identifier used nationally by financial institutions, ie, in individual countries, generally as part of a National Account Numbering Scheme(s), to uniquely identify the account of a customer. | | COID | CountryIdentificationCode) : Country authority given organisation identification (e.g., corporate registration number) | | SREN | SIREN | The SIREN number is a 9 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation in France. | | SRET | SIRET | The SIRET number is a 14 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation unit in France. It consists of the SIREN number, followed by a five digit classification number, to identify the local geographical unit of that entity. | | NIDN | NationalIdentityNumber | Number assigned by an authority to identify the national identity number of a person. | Other values are also permitted, for instance: | Code | Name | Description | | ---- | ---- | ----------- | | OAUT | OAUTH2 | OAUTH2 access token that is owned by the PISP being also an AISP and that can be used in order to identify the PSU | | CPAN | CardPan | Card PAN | | MPAN | MaskedPan | Card PAN where some digits were replaced for security reason | | TPAN | TokenizedPan | Token which was provided by a Token Service Provider (TSP) in order to obfuscate a real card PAN. The TSP must be identified in the issuer field | | TBAN | TokenizedIBAN | Token which was provided by a Token Service Provider (TSP) in order to obfuscate an IBAN. The TSP must be identified in the issuer field | Each implementation of the STET PSD2 API must specify in its own documentation which schemes can actually been used - `issuer` string: ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties - `currency` string: Specifies the currency of the amount or of the account. A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". - `balances` AccountIdentification[], required: List of accessible accounts for one given functionality - `workspace` string: Workspace to which the account is linked. This workspace might be specified by the AISP when forwarding the consent on accounts. If not provided, the default workspace is computed from the authentication that was used for getting the OAuth2 Access Token. - `iban` string: ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer. Further specifications of the format and content of the IBAN can be found in the standard ISO 13616 "Banking and related financial services - International Bank Account Number (IBAN)" version 1997-10-01, or later revisions. - `other` GenericIdentification: ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer. API: The ASPSP will document which account reference type it will support. - `identification` string, required: API: Identifier - `schemeName` string, required: Name of the identification scheme. Possible values for the scheme name, partially based on ISO20022 external code list, are the following: | Code | Name | Description | | ---- | ---- | ----------- | | BANK | BankPartyIdentification | Unique and unambiguous assignment made by a specific bank or similar financial institution to identify a relationship as defined between the bank and its client. | | BBAN | BBANIdentifier | Basic Bank Account Number (BBAN) - identifier used nationally by financial institutions, ie, in individual countries, generally as part of a National Account Numbering Scheme(s), to uniquely identify the account of a customer. | | COID | CountryIdentificationCode) : Country authority given organisation identification (e.g., corporate registration number) | | SREN | SIREN | The SIREN number is a 9 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation in France. | | SRET | SIRET | The SIRET number is a 14 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation unit in France. It consists of the SIREN number, followed by a five digit classification number, to identify the local geographical unit of that entity. | | NIDN | NationalIdentityNumber | Number assigned by an authority to identify the national identity number of a person. | Other values are also permitted, for instance: | Code | Name | Description | | ---- | ---- | ----------- | | OAUT | OAUTH2 | OAUTH2 access token that is owned by the PISP being also an AISP and that can be used in order to identify the PSU | | CPAN | CardPan | Card PAN | | MPAN | MaskedPan | Card PAN where some digits were replaced for security reason | | TPAN | TokenizedPan | Token which was provided by a Token Service Provider (TSP) in order to obfuscate a real card PAN. The TSP must be identified in the issuer field | | TBAN | TokenizedIBAN | Token which was provided by a Token Service Provider (TSP) in order to obfuscate an IBAN. The TSP must be identified in the issuer field | Each implementation of the STET PSD2 API must specify in its own documentation which schemes can actually been used - `issuer` string: ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties - `currency` string: Specifies the currency of the amount or of the account. A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". - `transactions` AccountIdentification[], required: List of accessible accounts for one given functionality - `workspace` string: Workspace to which the account is linked. This workspace might be specified by the AISP when forwarding the consent on accounts. If not provided, the default workspace is computed from the authentication that was used for getting the OAuth2 Access Token. - `iban` string: ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer. Further specifications of the format and content of the IBAN can be found in the standard ISO 13616 "Banking and related financial services - International Bank Account Number (IBAN)" version 1997-10-01, or later revisions. - `other` GenericIdentification: ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer. API: The ASPSP will document which account reference type it will support. - `identification` string, required: API: Identifier - `schemeName` string, required: Name of the identification scheme. Possible values for the scheme name, partially based on ISO20022 external code list, are the following: | Code | Name | Description | | ---- | ---- | ----------- | | BANK | BankPartyIdentification | Unique and unambiguous assignment made by a specific bank or similar financial institution to identify a relationship as defined between the bank and its client. | | BBAN | BBANIdentifier | Basic Bank Account Number (BBAN) - identifier used nationally by financial institutions, ie, in individual countries, generally as part of a National Account Numbering Scheme(s), to uniquely identify the account of a customer. | | COID | CountryIdentificationCode) : Country authority given organisation identification (e.g., corporate registration number) | | SREN | SIREN | The SIREN number is a 9 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation in France. | | SRET | SIRET | The SIRET number is a 14 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation unit in France. It consists of the SIREN number, followed by a five digit classification number, to identify the local geographical unit of that entity. | | NIDN | NationalIdentityNumber | Number assigned by an authority to identify the national identity number of a person. | Other values are also permitted, for instance: | Code | Name | Description | | ---- | ---- | ----------- | | OAUT | OAUTH2 | OAUTH2 access token that is owned by the PISP being also an AISP and that can be used in order to identify the PSU | | CPAN | CardPan | Card PAN | | MPAN | MaskedPan | Card PAN where some digits were replaced for security reason | | TPAN | TokenizedPan | Token which was provided by a Token Service Provider (TSP) in order to obfuscate a real card PAN. The TSP must be identified in the issuer field | | TBAN | TokenizedIBAN | Token which was provided by a Token Service Provider (TSP) in order to obfuscate an IBAN. The TSP must be identified in the issuer field | Each implementation of the STET PSD2 API must specify in its own documentation which schemes can actually been used - `issuer` string: ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties - `currency` string: Specifies the currency of the amount or of the account. A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". - `overdrafts` AccountIdentification[]: List of accessible accounts for one given functionality - `workspace` string: Workspace to which the account is linked. This workspace might be specified by the AISP when forwarding the consent on accounts. If not provided, the default workspace is computed from the authentication that was used for getting the OAuth2 Access Token. - `iban` string: ISO20022: International Bank Account Number (IBAN) - identification used internationally by financial institutions to uniquely identify the account of a customer. Further specifications of the format and content of the IBAN can be found in the standard ISO 13616 "Banking and related financial services - International Bank Account Number (IBAN)" version 1997-10-01, or later revisions. - `other` GenericIdentification: ISO20022: Unique identification of an account, a person or an organisation, as assigned by an issuer. API: The ASPSP will document which account reference type it will support. - `identification` string, required: API: Identifier - `schemeName` string, required: Name of the identification scheme. Possible values for the scheme name, partially based on ISO20022 external code list, are the following: | Code | Name | Description | | ---- | ---- | ----------- | | BANK | BankPartyIdentification | Unique and unambiguous assignment made by a specific bank or similar financial institution to identify a relationship as defined between the bank and its client. | | BBAN | BBANIdentifier | Basic Bank Account Number (BBAN) - identifier used nationally by financial institutions, ie, in individual countries, generally as part of a National Account Numbering Scheme(s), to uniquely identify the account of a customer. | | COID | CountryIdentificationCode) : Country authority given organisation identification (e.g., corporate registration number) | | SREN | SIREN | The SIREN number is a 9 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation in France. | | SRET | SIRET | The SIRET number is a 14 digit code assigned by INSEE, the French National Institute for Statistics and Economic Studies, to identify an organisation unit in France. It consists of the SIREN number, followed by a five digit classification number, to identify the local geographical unit of that entity. | | NIDN | NationalIdentityNumber | Number assigned by an authority to identify the national identity number of a person. | Other values are also permitted, for instance: | Code | Name | Description | | ---- | ---- | ----------- | | OAUT | OAUTH2 | OAUTH2 access token that is owned by the PISP being also an AISP and that can be used in order to identify the PSU | | CPAN | CardPan | Card PAN | | MPAN | MaskedPan | Card PAN where some digits were replaced for security reason | | TPAN | TokenizedPan | Token which was provided by a Token Service Provider (TSP) in order to obfuscate a real card PAN. The TSP must be identified in the issuer field | | TBAN | TokenizedIBAN | Token which was provided by a Token Service Provider (TSP) in order to obfuscate an IBAN. The TSP must be identified in the issuer field | Each implementation of the STET PSD2 API must specify in its own documentation which schemes can actually been used - `issuer` string: ISO20022: Entity that assigns the identification. this could a country code or any organisation name or identifier that can be recognized by both parties - `currency` string: Specifies the currency of the amount or of the account. A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". - `trustedBeneficiaries` boolean: Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU - true: the access was granted - false: the access was not granted - `trustedWorkspaceBeneficiaries` AccessibleTrustedBeneficiaries[]: Indicator, for each given workspace, that access to the trusted beneficiaries list was granted or not to the AISP by the PSU - `workspace` string: Identification of the workspace. If not provided, the default workspace is computed from the authentication that was used for getting the OAuth2 Access Token. - `access` boolean: Indicator that access to the trusted beneficiaries list was granted or not to the AISP by the PSU for the default workspace - true: the access was granted - false: the access was not granted - `psuIdentity` boolean, required: Indicator that access to the PSU identity, first name and last name, was granted or not to the AISP by the PSU - true: the access was granted - false: the access was not granted ## Response `201` Created ## Other responses - `400`: Invalid status value - `401`: Unauthorized, authentication failure. - `403`: Forbidden, authentication successful but access to resource is not allowed. - `405`: Method Not Allowed. - `406`: Not Acceptable. - `408`: Request Timeout. - `429`: Too many requests. - `500`: Internal server error. - `501`: Not Implemented. This code should be used when the entry point is implemented but cannot provide a result, given the context. When the entry point is not implemented at all, HTTP400 will be returned. - `503`: Service unavailable. --- [API](https://skmtc.dev/groupebpce/apis/accounts-information.md) - [All operations](https://skmtc.dev/groupebpce/apis/accounts-information/llms.txt) - [OpenAPI document](https://skmtc.dev/groupebpce/apis/accounts-information/revisions/1e8366574497?raw)