--- title: "Initiate an AoF payment" method: POST path: "/payments/v1/account-on-file" tags: ["Payments Account On File"] --- # Initiate an AoF payment `POST /payments/v1/account-on-file` Endpoint responsible for initiating an AoF payment against an existing, authorized consent. ## Headers - `Idempotency-Key` string, required ## Request body - object - `consent_id` string, uuid, required — An id of an authorized consent that should be used to authorize this payment - `amount` number, required — The amount to be paid. - `purpose` 'FIS' | 'TCS' | 'MWP' | 'OAT' | 'IFS' | 'RNT' | 'LNC' | 'PIN' | 'GDS' — A category code that relates to the type of services or goods that corresponds to the underlying purpose of the payment. The code must conform to the payment purpose code list. **Supported values:** - `FIS` – Financial services - `TCS` – Telecommunication services - `MWP` – Mobile wallet card payments - `OAT` – Own account transfer - `IFS` – Information services - `RNT` – Rent payments - `LNC` – Loan charges - `PIN` – Personal investments - `GDS` – Goods bought or sold - `risk_details` RiskDetails, required — The Risk section is used to specify additional details for risk/fraud scoring regarding Payments - `debtor_indicators` DebtorIndicators — Debtor (User) Indicators - `authentication` Authentication — The authentication method used by the User to access their account - `authentication_channel` 'WEB' | 'MOBILE' — Where the payment has been initiated from - `possession_factor` PossessionFactor — The User's possession, that only the User possesses - `is_used` boolean — Indicates if a possession factor was used for authentication - `type` 'FIDO2_SECURITY_KEY' | 'PASSKEY' | 'OTP_DEVICE' | 'OTP_APP' | 'SMS_OTP' | 'EMAIL_OTP' | 'PUSH_NOTIFICATION' | 'WEBAUTHN_TOKEN' | 'SECURE_ENCLAVE_KEY' | 'HARDWARE_OTP_KEY' | 'TRUSTED_DEVICE' | 'OTHER' — The type of possession-based authentication method used - `knowledge_factor` KnowledgeFactor — The User's knowledge, that only the User knows - `is_used` boolean — Indicates if a knowledge factor was used for authentication - `type` 'PIN' | 'PASSWORD' | 'SECURITY_QUESTION' | 'SMS_OTP' | 'EMAIL_OTP' | 'OTP_PUSH' | 'OTHER' — The type of knowledge-based authentication method used - `inherence_factor` InherenceFactor — The User's inherence, that is unique to the User's physical characteristics - `is_used` boolean — Indicates if an inherence factor was used for authentication - `type` 'BIOMETRIC' | 'FINGERPRINT' | 'FACE_RECOGNITION' | 'IRIS_SCAN' | 'VOICE_RECOGNITION' | 'FIDO_BIOMETRIC' | 'DEVICE_BIOMETRICS' | 'OTHER' — The type of biometric or inherence-based authentication method - `challenge_outcome` 'PASS' | 'FAIL' | 'NOT_PERFORMED' — The result of the authentication challenge - `authentication_flow` 'MFA' | 'OTHER' — The type of authentication flow used - `authentication_value` string — Cryptographic proof of authentication where supported by the device and protocol - `challenge_date_time` string, date-time — The date and time when the authentication challenge was performed - `user_name` Name - `ar` string, required — Name in Arabic - `en` string, required — Name in English - `geo_location` DecimalGeoLocation — GPS to identify and track the whereabouts of the connected electronic device. - `latitude` number, double — Geographic latitude coordinate in decimal degrees - `longitude` number, double — Geographic longitude coordinate in decimal degrees - `device_information` DeviceInformation — Detailed device information - `device_id` string — IMEISV number of the connected electronic device. - `alternative_device_id` string — Alternative identifier for the connected electronic device. - `device_operating_system` string — Device operating system. - `device_operating_system_version` string — Device operating system version. - `device_binding_id` string — An identifier that associates a device uniquely with a specific application. - `last_binding_date_time` string, date-time — Date and time when the device was last bound to the application. - `binding_duration` string — ISO 8601 duration since device was last bound (e.g., P30D for 30 days). - `binding_status` 'ACTIVE' | 'EXPIRED' | 'REVOKED' | 'SUSPENDED' — Current binding status - `device_type` 'MOBILE' | 'DESKTOP' | 'TABLET' | 'WEARABLE' | 'OTHER' — The category of device being used - `device_manufacturer` DeviceManufacturer - `model` string — The device model name - `manufacturer` string — The device manufacturer name - `device_language` string — The language setting configured on the device - `device_local_date_time` string — The current date and time on the device in local timezone - `connection_type` 'WIFI' | 'CELLULAR' | 'OTHER' — The type of network connection being used - `screen_information` ScreenInformation - `pixel_density` number, double — The screen pixel density in pixels per inch (PPI) - `orientation` 'PORTRAIT' | 'LANDSCAPE' — The current screen orientation - `battery_status` BatteryStatus - `level` number, double — The battery level as a percentage from 0.0 to 100.0 - `is_charging` boolean — Indicates whether the device is currently charging - `touch_support` TouchSupport - `supported` boolean — Indicates whether the device supports touch input - `max_touch_points` integer — The maximum number of simultaneous touch points supported - `motion_sensors` MotionSensors - `status` 'IN_MOTION' | 'STATIONARY' — The current motion state of the device - `accelerometer` boolean — Indicates whether the device has an accelerometer sensor - `gyroscope` boolean — Indicates whether the device has a gyroscope sensor - `device_environment_context` DeviceEnvironmentContext[] - `biometric_capabilities` BiometricCapabilities - `supports_biometric` boolean — Indicates whether the device supports biometric authentication - `biometric_types` BiometricType[] — List of biometric authentication types supported by the device - `app_information` AppInformation — Mobile application specific information. - `app_version` string — Version of the mobile application. - `package_name` string — Application package identifier. - `build_number` string — Application build number. - `browser_information` BrowserInformation — Browser-specific information - `user_agent` string — Complete browser user agent string - `is_cookies_enabled` boolean — Whether cookies are enabled in the browser. - `available_fonts` string[] — List of available fonts. - `plugins` string[] — List of installed browser plugins. - `pixel_ratio` number, double — Device pixel ratio for scaling. - `user_behavior` UserBehavior - `scroll_behavior` ScrollBehavior - `direction` 'UP' | 'DOWN' | 'BOTH' — The primary direction of scrolling behavior - `speed` number, double — Average scroll speed in pixels per second - `frequency` number, double — Number of scroll events per minute - `account_risk_indicators` AccountRiskIndicators — Risk indicators related to the account. - `user_onboarding_date_time` string, date-time — The exact date and time when the User account was activated. - `last_account_change_date` string — Date that the User's account was last changed. - `last_password_change_date` string — Date of the last password change by the User. - `suspicious_activity` 'NO_SUSPICIOUS_ACTIVITY' | 'SUSPICIOUS_ACTIVITY_DETECTED' — Indicating whether suspicious activity was detected - `transaction_history` TransactionHistory - `last_day` integer — Total transactions made by the account in the last 24 hours. - `last_year` integer — Total transactions made by the account in the past year. - `supplementary_data` object — Additional information that cannot be captured in the structured fields and/or any other specific block. This may include information that is not available in the structured fields, such as a user's behavioural data like their typing speed and typing patterns. - `destination_delivery_address` DestinationDeliveryAddress - `recipient_type` 'INDIVIDUAL' | 'CORPORATE' — The type of recipient receiving the delivery - `recipient_name` Name - `ar` string, required — Name in Arabic - `en` string, required — Name in English - `national_address` Address[] — List of addresses for the delivery recipient - `address_line` string — Full address line as retrieved from bank - `address_type` string — The type of address (e.g., residential, business). - `building_type` string — The type of building, apartments or villa for example. - `apartment_or_villa_number` string — The apartment or villa/house number. - `building_name` string — The name of the building. - `street` string — The street name. - `area` string — The area or neighborhood. - `street_address` string — Street address which may include house number, street name and PO Box - `post_code` string — The Zip or postal code associated with the address. - `town_name` string — The town or city name where the address is located. - `region` string — The region of the address. State, province, prefecture, or region - `po_box` string — The post office box number. - `country` string — The country where the address is located. - `transaction_indicators` TransactionIndicators - `is_customer_present` boolean — This field differentiates between automatic and manual initiation. - `is_contract_present` boolean — Indicates if the Creditor has a contractual relationship. - `channel` 'WEB' | 'MOBILE', required — Where the payment has been initiated from - `channel_type` 'ECOMMERCE' | 'IN_STORE' | 'IN_APP' | 'TELEPHONE' | 'MAIL' | 'RECURRING_PAYMENT' | 'OTHER' — The channel through which the transaction is being conducted. - `sub_channel_type` 'WEB_BROWSER' | 'MOBILE_APP' | 'SMART_TV' | 'WEARABLE_DEVICE' | 'POS_TERMINAL' | 'ATM' | 'KIOSK_TERMINAL' | 'OTHER' — More specific classification of the transaction channel. - `merchant_risk` MerchantRisk - `delivery_timeframe` 'ELECTRONIC_DELIVERY' | 'SAME_DAY_SHIPPING' | 'OVERNIGHT_SHIPPING' | 'MORE_THAN_1_DAY_SHIPPING', required — Timeframe for the delivery of purchased items - `reorder_items_indicator` 'FIRST_TIME_ORDER' | 'REORDER', required — Indicates if the transaction is a reorder - `pre_order_purchase_indicator` 'MERCHANDISE_AVAILABLE' | 'FUTURE_AVAILABILITY', required — Indicates if this is a pre-ordered item - `is_gift_card_purchase` boolean, required — Indicates if the transaction includes a gift card - `is_delivery_address_matches_billing` boolean, required — Indicates if delivery address matches billing address - `address_match_level` 'FULL_MATCH' | 'PARTIAL_MATCH' | 'NO_MATCH' | 'NOT_APPLICABLE', required — Level of match between delivery and billing addresses - `supplementary_data` object — Additional information that cannot be captured in the structured fields and/or any other specific block. - `reference` string, nullable — The reference submitted to the bank as a reference when initiating a payment. Can be used for reconciliation. - `creditor_reference` string, nullable — Clients identifier that can be used in their ERP systems ## Response `200` Indicates that request was processed and payment initiation request was sent to the bank. This does not mean that the payment was successful! - InitiateAccountOnFilePaymentResponse - `id` string, uuid, required — The unique identifier for the payment. - `account_id` string, uuid, required — The account id that the payment is being made to. - `application_id` string, required — The application id that the payment is being made to. - `consent_id` string, uuid, required — The consent id that the payment is being made under. - `status` 'CREATED' | 'PROCESSING' | 'PROCESSED' | 'FAILED', required — Reflects the latest known state of processing in Lean’s systems and bank. **Possible values:** - **`CREATED`** — An internal transaction record has been created, but **no interaction with the bank has occurred yet**. This includes any validation steps required before initiation. Detailed progress within the approval flow may be represented through *sub-statuses*. - **`PROCESSING`** — The transaction has been **submitted or is being attempted at the bank**. Multiple initiation attempts may occur under this state. More granular progress can be indicated by *sub-statuses*. - **`PROCESSED`** — The **final successful** state. The payment has been confirmed as completed by the payment status tracking process. Sub-statuses or other technology-specific codes may appear to indicate settlement details. - **`FAILED`** — The **final unsuccessful** state. Failure may occur: - before any bank initiation (e.g. validation issues), - after repeated unsuccessful initiation attempts (e.g. bank unavailable, other technical issues), or - even after an initially successful initiation followed by a **reversal detected by payment status tracking** before final reporting. --- **Notes:** - `CREATED` and `PROCESSING` are transitional states. - `PROCESSED` and `FAILED` are terminal states. - Sub-statuses provide additional context. - `sub_status` string — Provides additional detail about the current lifecycle stage of the payment. It can represent intermediate workflow steps, bank-specific responses or system conditions that further qualify the main status. - `reference` string — A reason or reference in relation to a payment. Passed as a part of OF `creditor_reference`. This value will be used as default reference for payments made with this consent. - `amount` CurrencyAmount, required - `currency` string, required — The ISO 3 letter currency code - `amount` number, required — The amount of money in the currency specified. - `type` 'ACCOUNT_ON_FILE', required — Product type - `sender_customer_id` string, uuid, required — The customer id of the sender. - `created_at` string, date-time, required — The date and time when the payment was created. - `last_modified_at` string, date-time, required — The date and time when the payment was last modified. - `failure_details` FailureDetails, nullable - `code` string, required — The code related to this failure - `details` string, required — A human readable description of this failure --- [API](https://skmtc.net/leantech/apis/auth.md) · [All operations](https://skmtc.net/leantech/apis/auth/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/leantech/auth/revisions/c2e46d54d886/schema)