Introduction to OBIE Account Information APIs (AISP)
This module covers the APIs for the Account Information Service (OBIE Read/Write API ver. 3.1) and includes the consent management and information requests. Some OBIE conditional or optional APIs may not be included.
Click here to understand the terms and abbreviations used in describing this module.
This module covers the following interface or regulation version:
- OBIE v3.1.
Temenos Transact Account Access APIs help customers to access their account details through any authorised Third Party Provider (TPP) interface that connects to the bank. These APIs are based on the UK OBIE (Open Banking Implementation Entity) standards as defined as part of the PSD2 (Revised Payment Service Directive).
A TPP that facilitates enquires on an account is denoted AISP (Account Information Service Provider). The bank that owns the account details and shares the information through the TPP is denoted ASPSP (Account Servicing Payment Service Provider). The customer who uses the TPP is denoted PSU (Payment Services User).
The Payment Service User has to create a consent in order to access his or her account details through a TPP.
When a Payment Service User (PSU) requests account information with Accounts information Service Provider (AISP), the AISP invokes the related API request to ASPSP which holds the account. AISP is permitted to access only the accounts information approved by the PSU in the consent. For this purpose the TPP must raise a consent request prior to the account information request that needs to be authorised by the PSU.
The ASPSP has to check that the consent given by the PSU of the requesting TPP has not expired or has been granted with the necessary permissions, in order to provide the requested account information. Also ASPSP has to check that the PSU is still allowed to access the account and this right has not been revoked since the consent request has been authorized.
The ASPSP connects to Infinity Spotlight database to validate the PSU login. Once the authentication is successful, the unique user Id of the PSU will be received in the response from the Spotlight. Now the PSU is now known by the ASPSP.
This module provides a set of APIs to support the Temenos client offering account information services for the TPPs according to the UK standards.
The APIs allows a TPP to create a consent resource and request account information. The APIs follow version v3.1 of the OBIE standard.
Please note that only the APIs listed in the APIs section are currently supported.
The following components, including the third party software, are required in addition to this module for the implementation of an end-to-end infrastructure:
- The UK OBIE Account Information API Gateway (e.g. SaltEdge Gateway), is an application that interface the APIs to the internet. It needs to covers the TPP registration, fraud detection and security.
- The Identity provider (such as HID Global), performs Strong Customer Authentication (SCA) to identify a PSU at the Account Servicing Payment Service Provider (ASPSP).
- The User Agent- online screens that allows account selection and leads the PSU through the process of consent authorisation.
- Access Dashboard - PSU must have to possibility to view and manage the connections and the consent given to Account Service Providers. The Access Dashboard should be an integrated part of the ASPSP.
The PSU is an online banking user in the Infinity Spotlight, during the consent creation as well as during the execution of the GET APIs the system will check in the Spotlight if the PSU has still permission to access the account.
Those components does not come with this module and have to acquired separately by the Temenos client. The additional integration effort should be considered for implementation.
Account Information APIs Integration with Infinity
Temenos Transact modules help customers to accomplish their role as an Account Servicing Payment Service Provider (ASPSP) to comply with the PDS2 (Revised Payment Service Directive) regulation.
The scope of this module, depends on the online banking features, offered by the respective financial institution. As a common rule, all the services offered for payment accounts to customers have to be available through APIs to Third Party Providers. Payments accounts are basically DDA accounts hence savings and loan accounts are excluded as well as wealth management products.
Third Party Providers (TPPs) can access the service through APIs based on the UK OBIE (Open Banking Implementation Entity) standards as defined as part of the PSD2.
This module provides a set of APIs to support the Temenos client offering Account Information Services (AIS) according to the standards.
These modules do not provide an end-to-end solution and additional components are required for the implementation.
The figure below is a high-level functional overview of the Temenos scope and the additional components that are required. The Restful APIs are used for interfacing between those components. While the boxes and arrows in blue show the functionalities and interfaces in scope of the OBIE Account Information APIs (AISP) and OBIE Payment Initiation APIs (PISP) modules, boxes and arrows in yellow are the additional components and interfaces.
Components
The components below are required for the OBIE Account Information APIs (AISP) module:
Core Banking System -Temenos Transact/ IRIS Integration Framework
The Core Banking system store the static and transactional data. The data is published by restful APIs through IRIS Interaction Framework. This module provides the interface functionality for the consent creation, accessing data and payment initiation.
Online Banking System -Temenos Infinity/ Fabric Framework
This module interface with Temenos Infinity for the user permission check and payment initiation. The integration of different Online Banking Systems requires a customisation.
The Consent Access Dashboards (AIS and CoF) and payment initiation APIs are not available as Infinity Core developments. Those have to be implemented as client specific enhancement during the implementation.
API Gateway
Before TPPs are eligible to invoke the APIs request, they have to be certified and onboarded as per requested services and APIs by the ASPSP. The ASPSP will ensure that only the APIs requests of the registered TPPs are accepted and processed. The payload of the APIs have to match with the respective OBIE specification.
As Temenos does not provide this functionality hence the implementation of an API Gateway is required. The API Gateway acts like a proxy and will be the technical point of contact for the TPP. It must only forward well-formed requests to Temenos that come from registered TPP and active TPPs.
User Agent
The User Agent provides the workflow and screens for the consent creation. TPPs will redirect the user to the User Agent for authentication by the ASPSP and providing consent to the requested operation (i.e. account and transactions enquiry, payment initiation or funds confirmation).
Identity Provider-HID
An Identity Provider (IDP) is a software component, that ensures that the user is the person he or she claims to be. PSD2 rules and the UK banking rules require a Strong Customer Authentication (SCA) to ensure the confidentiality and integrity of the security personalised credentials of the Payment Service User.
Interfaces
The interfaces details are provided below:
- Interface between Online Banking and the Core Banking system: There is already an existing interface between the OBS and Temenos Transact. The interface has to cover at least the following functionalities:
- Linking Temenos Transact customers and accounts to OLB users.
- Handover the account details, balances and transactions for online enquiry by the user.
- Creation of payment orders in the Temenos Payment Order (PO) module based on online payment initiations.
Optionally the interface can also enable the OBL to enquire or manage the beneficiaries, standing orders, direct debits or future payments.
- Permission Check and Payment Interface: This modules offer APIs for the user permission check, consent management and payment initiation by Interaction Framework (IRIS) orchestration. The API based payments are routed to the OLB for further validation (e.g. online payment limits) and multi-authorisation.
The OLB will “place” any authorised API initiated payment as a payment order through interface (1) after the full validation and authorisation.
- User Agent Interface to API Gateway: The client has to implement an interface between the User Agent and the API Gateway to retrieve the details of the AIS/PIS/CoF consent creation requests, once the TPP has redirected the user to the User Agent. After the user has provided or denied consent, the User Agent must update the API Gateway about the success or failure of the Consent Resources creation.
- Consent and Payment Resources Creation Interface: This module provides various APIs that allows the User Agent to create the consent and payment resources in Temenos Transact. A payment resource is used to store the payment details that comes with the payment consent creation request after user has made a payment at the TPP.
- User Authentication Interface: The user has to be authenticated by SCA before approving the creation of a Consent Resource.
The IDP solution is already in place which protects and secures the online banking access.
- User and Account Details Interface: Once the user has been authenticated, the User Agent must retrieve the additional information from the OLB like the username and eligible (according to the respective service) accounts. Temenos Infinity provides the respective Fabric APIs that can be used by the User Agent for this purpose.
- OBIE Account Information APIs Request Interface: Published Temenos IRIS APIs according to the OBIE API specification. These APIs come with this module. The API Gateway will forward the TPP request according to the supported OBIE API version. If the API Gateway manages and publishes its own ConsentId, then it must be translated into Temenos ConsentId. The Temenos APIs expects an authorisation token in the request header that has been issued to the API Gateway during consent creation.
Capture the External Consent ID and Consent Deletion API
Once the PSU provides the consent, the Account Information Service Provider (AISP) can request the account information from the Account Servicing Payment Service Provider (ASPSP). The validity of the consent can has-the current or an expiry date.If the consent expired the AISP will no longer have access to it.
If the PSU decides to revoke the consent before it expires, then the consent will be marked as a consent deletion. However, the consent resources held by the ASPSP are never physically deleted, their status will be changed to Revoked instead to allow enquiry of historic data.
User Agent provides the Salt Edge ConsentId to Temenos during the creation of the Temenos Consent Resource. The Salt Edge ConsentId is stored in the AA consent arrangement for the purpose of the consent deletion at the Online Banking Access Dashboard. Temenos returns the Temenos ConsentId to Salt Edge after is created in Temenos Transact.
Whenever a PSU deletes the consent at the AISP, the AISP must send an OBIE consent request deletion to the ASPSP. The ConsentId received by the AISP from the ASPSP during the consent creation is used for the identification as a path parameter.
Temenos clients acting as an ASPSP using the Salt Edge as an API Gateway will allow the AISP Open Banking access. The API Gateway is liable for the TPP onboarding and validation of the TPP requests.
Both system, the Salt Edge and Temenos, maintain their own consent resources hence uses different ConsentIds for the same connection. The TPP, in this case AISP, will only use the Salt Edge ConsentId for communication. For forwarding requests to Temenos, Salt Edge needs to translate the Salt Edge ConsentId into the Temenos ConsentId.
Whenever the AISP invokes a deletion of a consent request at Salt Edge, Salt Edge will forward the request by translating the Salt Edge ConsentId into the Temenos ConsentId and invoking the appropriate OBIE API at Temenos IRIS.
This functionality allows the Payment Service User (PSU) to view and revoke consent at the Account Information Service Provider (AISP).
In this topic