The Consent Service offers the following services:
- Create and authorize consents between the PSU and the TPP for use in the AIS services
- Get status of consent and retrieve previously authorized consents
Create Consent
Creates a consent resource defining access to specific accounts for a given PSU. If recurringIndicator is set to "true" and an existing recurring consent exists, it will expire once the new consent is authorised by the PSU.
Headers
X-Request-IDID of the request, unique to the call, as determined by the initiating party.
X-BicFi[A-Z]{6,6}[A-Z2-9][A… · requiredUnique ID of the financial institution. For Banks this is the same as the SWIFT code, i.e. SWEDSESS for Swedbank SE.
PSU-IDClient ID of the PSU in the ASPSP client interface. This is typically a local social security number or another unique login ID.
TPP-Redirect-PreferredIf it equals "true", the TPP prefers a redirect over an embedded SCA approach. If it equals "false", the TPP prefers not to be redirected for SCA. The ASPSP may not support both types.
PSU-IP-AddressThe IP address of the PSU from the HTTP request between the PSU and the TPP.
PSU-User-AgentThe Agent header from the HTTP request between the PSU and the TPP, identifying the browser used by the PSU.
X-AffiliatedASPSP-IDSome ASPSPs have sub-branches. The ID of an affiliated ASPSP as related to the X-BicFi header
PSU-Corporate-IDCorporate Client ID for the ASPSP. This is typically the unique Corporate ID in the local format. E.g. Org. nummer for SE, KVK for NL. Mandatory in the corporate scope.
PSU-Corporate-ID-TypeMight be mandated in the ASPSP's documentation. Only used in a corporate context.
X-Consent-TypeWhen a special consent type is needed.
Create Consent › Request Body
Requested access services for a consent.
recurringIndicatorIf "true", the consent is for recurring access to the account data. If "false", the consent is for one-off access to the account data.
validUntilThe date until which the requested consent should be valid for. The content is the local ASPSP date in ISO Date Format, e.g. 2025-10-30. This parameter is requesting a valid until date for the requested consent.
frequencyPerDayThe number of times per day the TPP may access the account data without PSU interaction. For one-off access, the attribute is set to "1". If not otherwise agreed bilaterally between the TPP and ASPSP, the frequency is less equal to 4.
combinedServiceIndicatorIf "true" indicates that a payment initiation service will be addressed in the same "session".
Create Consent › Responses
Created
consentStatusOverall lifecycle status of the consent. See Statuses & Types documentation for full descriptions of values.
consentIdID of the corresponding consent object as returned by an Account Information Consent Request.
A list of hyperlinks to be recognised by the TPP.
Type of links admitted in this response (which might be extended by single ASPSPs as indicated in its XS2A documentation):
- 'scaRedirect': In case of an SCA Redirect Approach, the ASPSP is transmitting the link to which to redirect the PSU browser.
- 'scaOAuth': In case of an OAuth2 based Redirect Approach, the ASPSP is transmitting the link where the configuration of the OAuth2 Server is defined. The configuration follows the OAuth 2.0 Authorisation Server Metadata specification.
- 'startAuthorisation': In case, where an explicit start of the transaction authorisation is needed, but no more data needs to be updated (no authentication method to be selected, no PSU identification nor PSU authentication data to be uploaded).
- 'startAuthorisationWithPsuIdentification': The link to the authorisation end-point, where the authorisation sub-resource has to be generated while uploading the PSU identification data.
- 'startAuthorisationWithPsuAuthentication': The link to the authorisation end-point, where the authorisation sub-resource has to be generated while uploading the PSU authentication data.
- 'startAuthorisationWithEncryptedPsuAuthentication': Same as startAuthorisationWithPsuAuthentication where the authentication data need to be encrypted on application layer in uploading.
- 'startAuthorisationWithAuthenticationMethodSelection': The link to the authorisation end-point, where the authorisation sub-resource has to be generated while selecting the authentication method. This link is contained under exactly the same conditions as the data element 'scaMethods'
- 'startAuthorisationWithTransactionAuthorisation': The link to the authorisation end-point, where the authorisation sub-resource has to be generated while authorising the transaction e.g. by uploading an OTP received by SMS.
- 'self': The link to the Establish Account Information Consent resource created by this request. This link can be used to retrieve the resource data.
- 'status': The link to retrieve the status of the account information consent.
- 'scaStatus': The link to retrieve the scaStatus of the corresponding authorisation sub-resource. This link is only contained, if an authorisation sub-resource has been already created.
Optional list of available Strong Customer Authentication (SCA) methods, shown if SCA is required and the user can choose a method. When this is present, a startAuthorisationWithAuthenticationMethodSelection link will also be included for starting the authorisation with method selection.
Authentication Object
Contained in addition to the data element chosenScaMethod if challenge data is needed for SCA. In rare cases, this attribute is also used in the context of the startAuthorisationWithPsuAuthentication link.
messageText to be displayed to the PSU, e.g. in a Decoupled SCA Approach.
Get Consent
Returns the content of an account information consent object. This is returning the data for the TPP especially in cases, where the consent was directly managed between ASPSP and PSU e.g. in a re-direct SCA Approach.
path Parameters
consentIdID of the corresponding consent object as returned by an Account Information Consent Request.
ID of the corresponding consent object as returned by an Account Information Consent Request.
Headers
X-Request-IDID of the request, unique to the call, as determined by the initiating party.
X-BicFi[A-Z]{6,6}[A-Z2-9][A… · requiredUnique ID of the financial institution. For Banks this is the same as the SWIFT code, i.e. SWEDSESS for Swedbank SE.
PSU-IDClient ID of the PSU in the ASPSP client interface. This is typically a local social security number or another unique login ID.
PSU-IP-AddressThe IP address of the PSU from the HTTP request between the PSU and the TPP.
TPP-Redirect-PreferredIf it equals "true", the TPP prefers a redirect over an embedded SCA approach. If it equals "false", the TPP prefers not to be redirected for SCA. The ASPSP may not support both types.
PSU-User-AgentThe Agent header from the HTTP request between the PSU and the TPP, identifying the browser used by the PSU.
PSU-Corporate-IDCorporate Client ID for the ASPSP. This is typically the unique Corporate ID in the local format. E.g. Org. nummer for SE, KVK for NL. Mandatory in the corporate scope.
PSU-Corporate-ID-TypeMight be mandated in the ASPSP's documentation. Only used in a corporate context.
Get Consent › Responses
OK
Requested access services for a consent.
recurringIndicatorIf "true", the consent is for recurring access to the account data. If "false", the consent is for one-off access to the account data.
validUntilThe date until which the requested consent should be valid for. The content is the local ASPSP date in ISO Date Format, e.g. 2025-10-30. This parameter is requesting a valid until date for the requested consent.
frequencyPerDayThe number of times per day the TPP may access the account data without PSU interaction. For one-off access, the attribute is set to "1". If not otherwise agreed bilaterally between the TPP and ASPSP, the frequency is less equal to 4.
lastActionDateThis date is containing the date of the last action on the consent object either through the XS2A interface or the PSU/ASPSP interface having an impact on the status.
consentStatusOverall lifecycle status of the consent. See Statuses & Types documentation for full descriptions of values.
A list of hyperlinks to be recognised by the TPP.
Links of type "account" and/or "cardAccount", depending on the nature of the consent.
Delete Consent
The TPP can delete an account information consent object if needed.
path Parameters
consentIdID of the corresponding consent object as returned by an Account Information Consent Request.
ID of the corresponding consent object as returned by an Account Information Consent Request.
Headers
X-Request-IDID of the request, unique to the call, as determined by the initiating party.
X-BicFi[A-Z]{6,6}[A-Z2-9][A… · requiredUnique ID of the financial institution. For Banks this is the same as the SWIFT code, i.e. SWEDSESS for Swedbank SE.
PSU-IDClient ID of the PSU in the ASPSP client interface. This is typically a local social security number or another unique login ID.
PSU-IP-AddressThe IP address of the PSU from the HTTP request between the PSU and the TPP.
TPP-Redirect-PreferredIf it equals "true", the TPP prefers a redirect over an embedded SCA approach. If it equals "false", the TPP prefers not to be redirected for SCA. The ASPSP may not support both types.
PSU-User-AgentThe Agent header from the HTTP request between the PSU and the TPP, identifying the browser used by the PSU.
PSU-Corporate-IDCorporate Client ID for the ASPSP. This is typically the unique Corporate ID in the local format. E.g. Org. nummer for SE, KVK for NL. Mandatory in the corporate scope.
PSU-Corporate-ID-TypeMight be mandated in the ASPSP's documentation. Only used in a corporate context.
Delete Consent › Responses
No Content
Get Consent Status
Read the status of an account information consent resource.
path Parameters
consentIdID of the corresponding consent object as returned by an Account Information Consent Request.
ID of the corresponding consent object as returned by an Account Information Consent Request.
Headers
X-Request-IDID of the request, unique to the call, as determined by the initiating party.
X-BicFi[A-Z]{6,6}[A-Z2-9][A… · requiredUnique ID of the financial institution. For Banks this is the same as the SWIFT code, i.e. SWEDSESS for Swedbank SE.
PSU-IDClient ID of the PSU in the ASPSP client interface. This is typically a local social security number or another unique login ID.
PSU-IP-AddressThe IP address of the PSU from the HTTP request between the PSU and the TPP.
TPP-Redirect-PreferredIf it equals "true", the TPP prefers a redirect over an embedded SCA approach. If it equals "false", the TPP prefers not to be redirected for SCA. The ASPSP may not support both types.
PSU-User-AgentThe Agent header from the HTTP request between the PSU and the TPP, identifying the browser used by the PSU.
PSU-Corporate-IDCorporate Client ID for the ASPSP. This is typically the unique Corporate ID in the local format. E.g. Org. nummer for SE, KVK for NL. Mandatory in the corporate scope.
PSU-Corporate-ID-TypeMight be mandated in the ASPSP's documentation. Only used in a corporate context.
Get Consent Status › Responses
OK
consentStatusOverall lifecycle status of the consent. See Statuses & Types documentation for full descriptions of values.
Get Consent Authorisations
Return a list of all authorisation subresources IDs which have been created.
This function returns an array of hyperlinks to all generated authorisation sub-resources.
path Parameters
consentIdID of the corresponding consent object as returned by an Account Information Consent Request.
ID of the corresponding consent object as returned by an Account Information Consent Request.
Headers
X-Request-IDID of the request, unique to the call, as determined by the initiating party.
X-BicFi[A-Z]{6,6}[A-Z2-9][A… · requiredUnique ID of the financial institution. For Banks this is the same as the SWIFT code, i.e. SWEDSESS for Swedbank SE.
PSU-IDClient ID of the PSU in the ASPSP client interface. This is typically a local social security number or another unique login ID.
PSU-IP-AddressThe IP address of the PSU from the HTTP request between the PSU and the TPP.
TPP-Redirect-PreferredIf it equals "true", the TPP prefers a redirect over an embedded SCA approach. If it equals "false", the TPP prefers not to be redirected for SCA. The ASPSP may not support both types.
PSU-User-AgentThe Agent header from the HTTP request between the PSU and the TPP, identifying the browser used by the PSU.
PSU-Corporate-IDCorporate Client ID for the ASPSP. This is typically the unique Corporate ID in the local format. E.g. Org. nummer for SE, KVK for NL. Mandatory in the corporate scope.
PSU-Corporate-ID-TypeMight be mandated in the ASPSP's documentation. Only used in a corporate context.
Get Consent Authorisations › Responses
OK
authorisationIdsAn array of all authorisationIds
Create Consent Authorisation
Initiates the authorisation process for a consent by creating an authorisation sub-resource, and providing a list of available SCA methods at the ASPSP.
path Parameters
consentIdID of the corresponding consent object as returned by an Account Information Consent Request.
ID of the corresponding consent object as returned by an Account Information Consent Request.
Headers
X-Request-IDID of the request, unique to the call, as determined by the initiating party.
X-BicFi[A-Z]{6,6}[A-Z2-9][A… · requiredUnique ID of the financial institution. For Banks this is the same as the SWIFT code, i.e. SWEDSESS for Swedbank SE.
PSU-IDClient ID of the PSU in the ASPSP client interface. This is typically a local social security number or another unique login ID.
TPP-Redirect-PreferredIf it equals "true", the TPP prefers a redirect over an embedded SCA approach. If it equals "false", the TPP prefers not to be redirected for SCA. The ASPSP may not support both types.
PSU-IP-AddressThe IP address of the PSU from the HTTP request between the PSU and the TPP.
PSU-User-AgentThe Agent header from the HTTP request between the PSU and the TPP, identifying the browser used by the PSU.
PSU-Corporate-IDCorporate Client ID for the ASPSP. This is typically the unique Corporate ID in the local format. E.g. Org. nummer for SE, KVK for NL. Mandatory in the corporate scope.
PSU-Corporate-ID-TypeMight be mandated in the ASPSP's documentation. Only used in a corporate context.
Create Consent Authorisation › Responses
Created
scaStatusContains information about the status of the SCA method applied. See Statuses & Types documentation for full descriptions of values.
authorisationIdResource identification of the related SCA
A list of hyperlinks to be recognised by the TPP. The actual hyperlinks used in the response depend on the dynamical decisions of the ASPSP when processing the request.
Remark: All links can be relative or full links, to be decided by the ASPSP.
Type of links admitted in this response, (further links might be added for ASPSP defined extensions):
- 'scaRedirect': In case of an SCA Redirect Approach, the ASPSP is transmitting the link to which to redirect the PSU browser.
- 'scaOAuth': In case of a SCA OAuth2 Approach, the ASPSP is transmitting the URI where the configuration of the Authorisation Server can be retrieved. The configuration follows the OAuth 2.0 Authorisation Server Metadata specification.
- 'updatePsuIdentification': The link to the authorisation or cancellation authorisation sub-resource, where PSU identification data needs to be uploaded.
- 'startAuthorisationWithPsuAuthentication':
The link to the authorisation or cancellation authorisation sub-resource,
where PSU authentication data needs to be uploaded.
- 'startAuthorisationWithEncryptedPsuAuthentication': Same as startAuthorisationWithPsuAuthentication where the authentication data need to be encrypted on application layer in uploading.
- 'selectAuthenticationMethod': The link to the authorisation or cancellation authorisation sub-resource, where the selected authentication method needs to be uploaded. This link is contained under exactly the same conditions as the data element 'scaMethods'.
- 'authoriseTransaction': The link to the authorisation or cancellation authorisation sub-resource, where the authorisation data has to be uploaded, e.g. the TOP received by SMS.
- 'scaStatus': The link to retrieve the scaStatus of the corresponding authorisation sub-resource.
Optional list of available Strong Customer Authentication (SCA) methods, shown if SCA is required and the user can choose a method. When this is present, a startAuthorisationWithAuthenticationMethodSelection link will also be included for starting the authorisation with method selection.
Authentication Object
Contained in addition to the data element chosenScaMethod if challenge data is needed for SCA. In rare cases, this attribute is also used in the context of the startAuthorisationWithPsuAuthentication link.
psuMessageText to be displayed to the PSU
Get Consent Authorisation SCA Status
This method returns the SCA status of a consent initiation's authorisation sub-resource.
path Parameters
consentIdID of the corresponding consent object as returned by an Account Information Consent Request.
ID of the corresponding consent object as returned by an Account Information Consent Request.
authorisationIdResource identification of the related SCA.
Resource identification of the related SCA
Headers
X-Request-IDID of the request, unique to the call, as determined by the initiating party.
X-BicFi[A-Z]{6,6}[A-Z2-9][A… · requiredUnique ID of the financial institution. For Banks this is the same as the SWIFT code, i.e. SWEDSESS for Swedbank SE.
PSU-IDClient ID of the PSU in the ASPSP client interface. This is typically a local social security number or another unique login ID.
PSU-IP-AddressThe IP address of the PSU from the HTTP request between the PSU and the TPP.
TPP-Redirect-PreferredIf it equals "true", the TPP prefers a redirect over an embedded SCA approach. If it equals "false", the TPP prefers not to be redirected for SCA. The ASPSP may not support both types.
PSU-User-AgentThe Agent header from the HTTP request between the PSU and the TPP, identifying the browser used by the PSU.
PSU-Corporate-IDCorporate Client ID for the ASPSP. This is typically the unique Corporate ID in the local format. E.g. Org. nummer for SE, KVK for NL. Mandatory in the corporate scope.
PSU-Corporate-ID-TypeMight be mandated in the ASPSP's documentation. Only used in a corporate context.
Get Consent Authorisation SCA Status › Responses
OK
scaStatusContains information about the status of the SCA method applied. See Statuses & Types documentation for full descriptions of values.
Contained in addition to the data element chosenScaMethod if challenge data is needed for SCA. In rare cases, this attribute is also used in the context of the startAuthorisationWithPsuAuthentication link.
Start Consent Authorisation
Starts the authorisation resource for the consent, using the selection of an authentication method to initiate SCA.
path Parameters
consentIdID of the corresponding consent object as returned by an Account Information Consent Request.
ID of the corresponding consent object as returned by an Account Information Consent Request.
authorisationIdResource identification of the related SCA.
Resource identification of the related SCA
Headers
X-Request-IDID of the request, unique to the call, as determined by the initiating party.
X-BicFi[A-Z]{6,6}[A-Z2-9][A… · requiredUnique ID of the financial institution. For Banks this is the same as the SWIFT code, i.e. SWEDSESS for Swedbank SE.
PSU-IDClient ID of the PSU in the ASPSP client interface. This is typically a local social security number or another unique login ID.
PSU-IP-AddressThe IP address of the PSU from the HTTP request between the PSU and the TPP.
TPP-Redirect-PreferredIf it equals "true", the TPP prefers a redirect over an embedded SCA approach. If it equals "false", the TPP prefers not to be redirected for SCA. The ASPSP may not support both types.
PSU-User-AgentThe Agent header from the HTTP request between the PSU and the TPP, identifying the browser used by the PSU.
PSU-Authoriser-IDID provided by certain ASPSPs to uniquely identify the authorising PSU, e.g. a customer ID. Only relevant if supported by the ASPSP.
PSU-Corporate-IDCorporate Client ID for the ASPSP. This is typically the unique Corporate ID in the local format. E.g. Org. nummer for SE, KVK for NL. Mandatory in the corporate scope.
PSU-Corporate-ID-TypeMight be mandated in the ASPSP's documentation. Only used in a corporate context.
Start Consent Authorisation › Request Body
authenticationMethodIdAn identification provided by the ASPSP for the later identification of the authentication method selection.
Start Consent Authorisation › Responses
OK
scaStatusContains information about the status of the SCA method applied. See Statuses & Types documentation for full descriptions of values.
Authentication Object
Contained in addition to the data element chosenScaMethod if challenge data is needed for SCA. In rare cases, this attribute is also used in the context of the startAuthorisationWithPsuAuthentication link.
A list of hyperlinks to be recognised by the TPP. The actual hyperlinks used in the response depend on the dynamical decisions of the ASPSP when processing the request.
Remark: All links can be relative or full links, to be decided by the ASPSP.
Remark: This method can be applied before or after PSU identification. This leads to many possible hyperlink responses. Type of links admitted in this response, (further links might be added for ASPSP defined extensions):
- "scaRedirect": In case of an SCA Redirect Approach, the ASPSP is transmitting the link to which to redirect the PSU browser.
- "scaOAuth": In case of a SCA OAuth2 Approach, the ASPSP is transmitting the URI where the configuration of the Authorisation Server can be retrieved. The configuration follows the OAuth 2.0 Authorisation Server Metadata specification.
- "updatePsuIdentification": The link to the authorisation or cancellation authorisation sub-resource, where PSU identification data needs to be uploaded.
- "updatePsuAuthentication": The link to the authorisation or cancellation authorisation sub-resource, where PSU authentication data needs to be uploaded. "authoriseTransaction": The link to the authorisation or cancellation authorisation sub-resource, where the authorisation data has to be uploaded, e.g. the TOP received by SMS. "scaStatus": The link to retrieve the scaStatus of the corresponding authorisation sub-resource.
psuMessageText to be displayed to the PSU