YAyapily
Authorisations

Create Embedded Account Authorisation

Used to initiate the embedded authorisation process for an Institution that contains the INITIATE_EMBEDDED_ACCOUNT_REQUEST feature in order to obtain the the user's authorisation to access their account information.

Feature: INITIATE_EMBEDDED_ACCOUNT_REQUEST

post/embedded-account-auth-requests

Request

  • Base URL
    https://api.yapily.com
  • Auth
    HTTP basic

Headers

psu-idstring

Conditional. Represents the user's login ID for the Institution to a personal account.

See PSU identifiers to see if this header is required.

psu-corporate-idstring

Conditional. Represents the user's login ID for the Institution to a business account.

See PSU identifiers to see if this header is required.

psu-ip-addressstring

Conditional. The IP address of the PSU.

See PSU identifiers to see if this header is required.

sub-applicationstring uuid

The sub-application ID to which event type is being subscribed to

Request body

userUuidstring uuid

User for which the authorisation request was created.

applicationUserIdstring

Conditional. The user-friendly reference to the User that will authorise the authorisation request. If a User with the specified applicationUserId exists, it will be used otherwise, a new User with the specified applicationUserId will be created and used. Either the userUuid or applicationUserId must be provided.

forwardParametersstring[]

Extra parameters the TPP may want to get forwarded in the callback request after the PSU redirect.

institutionIdstring required

Mandatory. The reference to the Institution which identifies which institution the authorisation request is sent to.

callbackstring

Optional. The server to redirect the user to after the user complete the authorisation at the Institution.

See Using a callback (Optional) for more information.

oneTimeTokenboolean

Conditional. Used to receive a oneTimeToken rather than a consentToken at the callback for additional security. This can only be used when the callback is set.

See Using a callback with an OTT (Optional) for more information.

scaCodestring

Conditional. Used to update the authorisation with the sca code received by the user from the Institution using the embedded account authorisation flow.

This is the penultimate step required in the embedded account authorisation flow to authorise the Consent. After sending the sca code, to obtain an authorised consent, the last step is to poll Get Consent until the Institution authorises the request and the Consent status transitions to AUTHORIZED.

Example request

{
  "applicationUserId": "user-234562290",
  "institutionId": "yapily-mock",
  "callback": "https://display-parameters.com",
  "userCredentials": {
    "id": "6154057725",
    "corporateId": "6345898763",
    "password": "PISPWD12"
  },
  "selectedScaMethod": {
    "id": "944",
    "type": "PUSH_OTP",
    "description": "SecureSIGN"
  },
  "scaCode": "325614",
  "accountRequest": {
    "transactionFrom": "2020-01-01T00:00:00Z",
    "transactionTo": "2021-01-01T00:00:00Z",
    "expiresAt": "2025-01-01T00:00:00Z",
    "accountIdentifiers": {
      "accountId": "500000000000000000000001",
      "accountIdentification": {
        "type": "SORT_CODE",
        "identification": "401016"
      }
    },
    "accountIdentifiersForTransaction": [
      {
        "accountId": "500000000000000000000001",
        "accountIdentification": {
          "type": "SORT_CODE",
          "identification": "401016"
        }
      }
    ],
    "accountIdentifiersForBalance": [
      {
        "accountId": "500000000000000000000001",
        "accountIdentification": {
          "type": "SORT_CODE",
          "identification": "401016"
        }
      }
    ]
  }
}

Response

Created

linksobject
tracingIdstring

Example response

{
  "data": {
    "scaMethods": [
      {
        "id": "944",
        "type": "PUSH_OTP",
        "description": "SecureSIGN"
      }
    ],
    "selectedScaMethod": {
      "id": "944",
      "type": "PUSH_OTP",
      "description": "SecureSIGN"
    }
  }
}

Changes

No recorded changes to this operation across all 4 revisions of this API.