--- title: "Start the authorisation process for a consent" method: POST path: "/v1/consents/{consentId}/authorisations" tags: ["Account Information Service (AIS)", "Common Services"] --- # Start the authorisation process for a consent `POST /v1/consents/{consentId}/authorisations` Create an authorisation sub-resource and start the authorisation process of a consent. The message might in addition transmit authentication and authorisation related data. his method is iterated n times for a n times SCA authorisation in a corporate context, each creating an own authorisation sub-endpoint for the corresponding PSU authorising the consent. The ASPSP might make the usage of this access method unnecessary, since the related authorisation resource will be automatically created by the ASPSP after the submission of the consent data with the first POST consents call. The start authorisation process is a process which is needed for creating a new authorisation or cancellation sub-resource. This applies in the following scenarios: * The ASPSP has indicated with an 'startAuthorisation' hyperlink in the preceding Payment initiation response that an explicit start of the authorisation process is needed by the TPP. The 'startAuthorisation' hyperlink can transport more information about data which needs to be uploaded by using the extended forms: * 'startAuthorisationWithPsuIdentfication', * 'startAuthorisationWithPsuAuthentication' * 'startAuthorisationWithEncryptedPsuAuthentication' * 'startAuthorisationWithAuthentciationMethodSelection' * The related payment initiation cannot yet be executed since a multilevel SCA is mandated. * The ASPSP has indicated with an 'startAuthorisation' hyperlink in the preceding payment cancellation response that an explicit start of the authorisation process is needed by the TPP. The 'startAuthorisation' hyperlink can transport more information about data which needs to be uploaded by using the extended forms as indicated above. * The related payment cancellation request cannot be applied yet since a multilevel SCA is mandate for executing the cancellation. * The signing basket needs to be authorised yet. ## Path parameters - `consentId` string, required — ID of the corresponding consent object as returned by an account information consent request. ## Headers - `X-Request-ID` string, required - `Digest` string - `Signature` string - `TPP-Signature-Certificate` string, byte - `PSU-ID` string - `PSU-ID-Type` string - `PSU-Corporate-ID` string - `PSU-Corporate-ID-Type` string - `TPP-Redirect-Preferred` boolean - `TPP-Redirect-URI` string, uri - `TPP-Nok-Redirect-URI` string, uri - `TPP-Notification-URI` string - `TPP-Notification-Content-Preferred` string - `PSU-IP-Address` string, ipv4 - `PSU-IP-Port` string - `PSU-Accept` string - `PSU-Accept-Charset` string - `PSU-Accept-Encoding` string - `PSU-Accept-Language` string - `PSU-User-Agent` string - `PSU-Http-Method` 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' - `PSU-Device-ID` string - `PSU-Geo-Location` string ## Request body - union - unknown - UpdatePsuAuthentication — Content of the body of a Update PSU authentication request Password subfield is used. - `psuData` PsuData, required — PSU Data for Update PSU authentication. - `password` string — Password. - `encryptedPassword` string — Encrypted password. - `additionalPassword` string — Additional password in plaintext. - `additionalEncryptedPassword` string — Additional encrypted password. - SelectPsuAuthenticationMethod — Content of the body of a Select PSU authentication method request - `authenticationMethodId` string, required — An identification provided by the ASPSP for the later identification of the authentication method selection. - TransactionAuthorisation — Content of the body of a transaction authorisation request - `scaAuthenticationData` string, required — SCA authentication data, depending on the chosen authentication method. If the data is binary, then it is base64 encoded. ## Response `201` Created - StartScaprocessResponse — Body of the JSON response for a Start SCA authorisation request. - `scaStatus` 'received' | 'psuIdentified' | 'psuAuthenticated' | 'scaMethodSelected' | 'started' | 'unconfirmed' | 'finalised' | 'failed' | 'exempted', required — This data element is containing information about the status of the SCA method applied. The following codes are defined for this data type. * 'received': An authorisation or cancellation-authorisation resource has been created successfully. * 'psuIdentified': The PSU related to the authorisation or cancellation-authorisation resource has been identified. * 'psuAuthenticated': The PSU related to the authorisation or cancellation-authorisation resource has been identified and authenticated e.g. by a password or by an access token. * 'scaMethodSelected': The PSU/TPP has selected the related SCA routine. If the SCA method is chosen implicitly since only one SCA method is available, then this is the first status to be reported instead of 'received'. * 'unconfirmed': SCA is technically successfully finalised by the PSU, but the authorisation resource needs a confirmation command by the TPP yet. * 'started': The addressed SCA routine has been started. * 'finalised': The SCA routine has been finalised successfully (including a potential confirmation command). This is a final status of the authorisation resource. * 'failed': The SCA routine failed. This is a final status of the authorisation resource. * 'exempted': SCA was exempted for the related transaction, the related authorisation is successful. This is a final status of the authorisation resource. - `authorisationId` string, required — Resource identification of the related SCA. - `scaMethods` AuthenticationObject[] — This data element might be contained, if SCA is required and if the PSU has a choice between different authentication methods. Depending on the risk management of the ASPSP this choice might be offered before or after the PSU has been identified with the first relevant factor, or if an access token is transported. If this data element is contained, then there is also a hyperlink of type 'startAuthorisationWithAuthenticationMethodSelection' contained in the response body. These methods shall be presented towards the PSU for selection by the TPP. - `authenticationType` 'SMS_OTP' | 'CHIP_OTP' | 'PHOTO_OTP' | 'PUSH_OTP' | 'SMTP_OTP', required — Type of the authentication method. More authentication types might be added during implementation projects and documented in the ASPSP documentation. - 'SMS_OTP': An SCA method, where an OTP linked to the transaction to be authorised is sent to the PSU through a SMS channel. - 'CHIP_OTP': An SCA method, where an OTP is generated by a chip card, e.g. a TOP derived from an EMV cryptogram. To contact the card, the PSU normally needs a (handheld) device. With this device, the PSU either reads the challenging data through a visual interface like flickering or the PSU types in the challenge through the device key pad. The device then derives an OTP from the challenge data and displays the OTP to the PSU. - 'PHOTO_OTP': An SCA method, where the challenge is a QR code or similar encoded visual data which can be read in by a consumer device or specific mobile app. The device resp. the specific app than derives an OTP from the visual challenge data and displays the OTP to the PSU. - 'PUSH_OTP': An OTP is pushed to a dedicated authentication APP and displayed to the PSU. - 'SMTP_OTP': An OTP is sent via email to the PSU. - `authenticationVersion` string — Depending on the "authenticationType". This version can be used by differentiating authentication tools used within performing OTP generation in the same authentication type. This version can be referred to in the ASPSP?s documentation. - `authenticationMethodId` string, required — An identification provided by the ASPSP for the later identification of the authentication method selection. - `name` string — This is the name of the authentication method defined by the PSU in the Online Banking frontend of the ASPSP. Alternatively this could be a description provided by the ASPSP like "SMS OTP on phone +49160 xxxxx 28". This name shall be used by the TPP when presenting a list of authentication methods to the PSU, if available. - `explanation` string — Detailed information about the SCA method for the PSU. - `chosenScaMethod` ChosenScaMethod — Authentication object. - `authenticationType` 'SMS_OTP' | 'CHIP_OTP' | 'PHOTO_OTP' | 'PUSH_OTP' | 'SMTP_OTP', required — Type of the authentication method. More authentication types might be added during implementation projects and documented in the ASPSP documentation. - 'SMS_OTP': An SCA method, where an OTP linked to the transaction to be authorised is sent to the PSU through a SMS channel. - 'CHIP_OTP': An SCA method, where an OTP is generated by a chip card, e.g. a TOP derived from an EMV cryptogram. To contact the card, the PSU normally needs a (handheld) device. With this device, the PSU either reads the challenging data through a visual interface like flickering or the PSU types in the challenge through the device key pad. The device then derives an OTP from the challenge data and displays the OTP to the PSU. - 'PHOTO_OTP': An SCA method, where the challenge is a QR code or similar encoded visual data which can be read in by a consumer device or specific mobile app. The device resp. the specific app than derives an OTP from the visual challenge data and displays the OTP to the PSU. - 'PUSH_OTP': An OTP is pushed to a dedicated authentication APP and displayed to the PSU. - 'SMTP_OTP': An OTP is sent via email to the PSU. - `authenticationVersion` string — Depending on the "authenticationType". This version can be used by differentiating authentication tools used within performing OTP generation in the same authentication type. This version can be referred to in the ASPSP?s documentation. - `authenticationMethodId` string, required — An identification provided by the ASPSP for the later identification of the authentication method selection. - `name` string — This is the name of the authentication method defined by the PSU in the Online Banking frontend of the ASPSP. Alternatively this could be a description provided by the ASPSP like "SMS OTP on phone +49160 xxxxx 28". This name shall be used by the TPP when presenting a list of authentication methods to the PSU, if available. - `explanation` string — Detailed information about the SCA method for the PSU. - `challengeData` ChallengeData — It is contained in addition to the data element 'chosenScaMethod' if challenge data is needed for SCA. In rare cases this attribute is also used in the context of the 'startAuthorisationWithPsuAuthentication' link. - `image` string, byte — PNG data (max. 512 kilobyte) to be displayed to the PSU, Base64 encoding, cp. [RFC4648]. This attribute is used only, when PHOTO_OTP or CHIP_OTP is the selected SCA method. - `data` string[] — A collection of strings as challenge data. - `imageLink` string — A link where the ASPSP will provides the challenge image for the TPP. - `otpMaxLength` integer — The maximal length for the OTP to be typed in by the PSU. - `otpFormat` 'characters' | 'integer' — The format type of the OTP to be typed in. The admitted values are "characters" or "integer". - `additionalInformation` string — Additional explanation for the PSU to explain e.g. fallback mechanism for the chosen SCA method. The TPP is obliged to show this to the PSU. - `_links` LinksStartScaProcess, required — A list of hyperlinks to be recognised by the TPP. The actual hyperlinks used in the response depend on the dynamical decisions of the ASPSP when processing the request. **Remark:** All links can be relative or full links, to be decided by the ASPSP. Type of links admitted in this response, (further links might be added for ASPSP defined extensions): - 'scaRedirect': In case of an SCA Redirect Approach, the ASPSP is transmitting the link to which to redirect the PSU browser. - 'scaOAuth': In case of a SCA OAuth2 Approach, the ASPSP is transmitting the URI where the configuration of the Authorisation Server can be retrieved. The configuration follows the OAuth 2.0 Authorisation Server Metadata specification. * 'confirmation': Might be added by the ASPSP if either the "scaRedirect" or "scaOAuth" hyperlink is returned in the same response message. This hyperlink defines the URL to the resource which needs to be updated with * a confirmation code as retrieved after the plain redirect authentication process with the ASPSP authentication server or * an access token as retrieved by submitting an authorization code after the integrated OAuth based authentication process with the ASPSP authentication server. - 'updatePsuIdentification': The link to the authorisation or cancellation authorisation sub-resource, where PSU identification data needs to be uploaded. - 'startAuthorisationWithPsuAuthentication': The link to the authorisation or cancellation authorisation sub-resource, where PSU authentication data needs to be uploaded. - 'startAuthorisationWithEncryptedPsuAuthentication': Same as startAuthorisactionWithPsuAuthentication where the authentication data need to be encrypted on application layer in uploading. - 'selectAuthenticationMethod': The link to the authorisation or cancellation authorisation sub-resource, where the selected authentication method needs to be uploaded. This link is contained under exactly the same conditions as the data element 'scaMethods'. - 'authoriseTransaction': The link to the authorisation or cancellation authorisation sub-resource, where the authorisation data has to be uploaded, e.g. the TOP received by SMS. - 'scaStatus': The link to retrieve the scaStatus of the corresponding authorisation sub-resource. - `scaRedirect` HrefType — Link to a resource. - `href` string — Link to a resource. - `scaOAuth` HrefType — Link to a resource. - `href` string — Link to a resource. - `confirmation` HrefType — Link to a resource. - `href` string — Link to a resource. - `updatePsuIdentification` HrefType — Link to a resource. - `href` string — Link to a resource. - `startAuthorisationWithPsuAuthentication` HrefType — Link to a resource. - `href` string — Link to a resource. - `startAuthorisationWithEncryptedPsuAuthentication` HrefType — Link to a resource. - `href` string — Link to a resource. - `selectAuthenticationMethod` HrefType — Link to a resource. - `href` string — Link to a resource. - `authoriseTransaction` HrefType — Link to a resource. - `href` string — Link to a resource. - `scaStatus` HrefType — Link to a resource. - `href` string — Link to a resource. - `psuMessage` string — Text to be displayed to the PSU. ## Other responses - `400` — Bad Request - `401` — Unauthorized - `403` — Forbidden - `404` — Not found - `405` — Method Not Allowed - `406` — Not Acceptable - `408` — Request Timeout - `409` — Conflict - `415` — Unsupported Media Type - `429` — Too Many Requests - `500` — Internal Server Error - `503` — Service Unavailable --- [API](https://skmtc.net/openbankingproject-ch/apis/swiss-nextgen-banking-api-framework.md) · [All operations](https://skmtc.net/openbankingproject-ch/apis/swiss-nextgen-banking-api-framework/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openbankingproject-ch/swiss-nextgen-banking-api-framework/versions/c32e86db40b4/schema)