---
title: "Create a signing basket resource"
method: POST
path: "/v1/signing-baskets"
tags: ["Signing Baskets Service (SBS)"]
---

# Create a signing basket resource

`POST /v1/signing-baskets`

Create a signing basket resource for authorising several transactions with one SCA method. 
The resource identifications of these transactions are contained in the payload of this access method

## Headers

- `X-Request-ID` string, required
- `Digest` string
- `Signature` string
- `TPP-Signature-Certificate` string, byte
- `PSU-ID` string
- `PSU-ID-Type` string
- `PSU-Corporate-ID` string
- `PSU-Corporate-ID-Type` string
- `Consent-ID` string — ID of the corresponding consent object as returned by an account information consent request.
- `PSU-IP-Address` string, ipv4, required
- `TPP-Redirect-Preferred` boolean
- `TPP-Redirect-URI` string, uri
- `TPP-Nok-Redirect-URI` string, uri
- `TPP-Explicit-Authorisation-Preferred` boolean
- `TPP-Notification-URI` string
- `TPP-Notification-Content-Preferred` string
- `PSU-IP-Port` string
- `PSU-Accept` string
- `PSU-Accept-Charset` string
- `PSU-Accept-Encoding` string
- `PSU-Accept-Language` string
- `PSU-User-Agent` string
- `PSU-Http-Method` 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'
- `PSU-Device-ID` string
- `PSU-Geo-Location` string

## Request body

- SigningBasket — JSON Body of a establish signing basket request. The body shall contain at least one entry.
  - `paymentIds` PaymentId[] — A list of paymentIds.
  - `consentIds` ConsentId[] — A list of consentIds.

## Response `201`

Created

- SigningBasketResponse201 — Body of the JSON response for a successful create signing basket request.
  - `transactionStatus` 'ACSC' | 'ACTC' | 'PATC' | 'RCVD' | 'RJCT' | 'CANC', required — The transaction status is filled with codes of the ISO 20022 data table. Only the codes RCVD, PATC, ACTC, ACWC and RJCT are used: - 'ACSP': 'AcceptedSettlementInProcess' - All preceding checks such as technical validation and customer profile were successful and therefore the payment initiation has been accepted for execution. - 'ACTC': 'AcceptedTechnicalValidation' - Authentication and syntactical and semantical validation are successful. - 'ACWC': 'AcceptedWithChange' - Instruction is accepted but a change will be made, such as date or remittance not sent. - 'RCVD': 'Received' - Payment initiation has been received by the receiving agent. - 'RJCT': 'Rejected' - Payment initiation or individual transaction included in the payment initiation has been rejected.
  - `basketId` string, required — Resource identification of the generated signing basket resource.
  - `scaMethods` AuthenticationObject[] — This data element might be contained, if SCA is required and if the PSU has a choice between different authentication methods. Depending on the risk management of the ASPSP this choice might be offered before or after the PSU has been identified with the first relevant factor, or if an access token is transported. If this data element is contained, then there is also a hyperlink of type 'startAuthorisationWithAuthenticationMethodSelection' contained in the response body. These methods shall be presented towards the PSU for selection by the TPP.
    - `authenticationType` 'SMS_OTP' | 'CHIP_OTP' | 'PHOTO_OTP' | 'PUSH_OTP' | 'SMTP_OTP', required — Type of the authentication method. More authentication types might be added during implementation projects and documented in the ASPSP documentation. - 'SMS_OTP': An SCA method, where an OTP linked to the transaction to be authorised is sent to the PSU through a SMS channel. - 'CHIP_OTP': An SCA method, where an OTP is generated by a chip card, e.g. a TOP derived from an EMV cryptogram. To contact the card, the PSU normally needs a (handheld) device. With this device, the PSU either reads the challenging data through a visual interface like flickering or the PSU types in the challenge through the device key pad. The device then derives an OTP from the challenge data and displays the OTP to the PSU. - 'PHOTO_OTP': An SCA method, where the challenge is a QR code or similar encoded visual data which can be read in by a consumer device or specific mobile app. The device resp. the specific app than derives an OTP from the visual challenge data and displays the OTP to the PSU. - 'PUSH_OTP': An OTP is pushed to a dedicated authentication APP and displayed to the PSU. - 'SMTP_OTP': An OTP is sent via email to the PSU.
    - `authenticationVersion` string — Depending on the "authenticationType". This version can be used by differentiating authentication tools used within performing OTP generation in the same authentication type. This version can be referred to in the ASPSP?s documentation.
    - `authenticationMethodId` string, required — An identification provided by the ASPSP for the later identification of the authentication method selection.
    - `name` string — This is the name of the authentication method defined by the PSU in the Online Banking frontend of the ASPSP. Alternatively this could be a description provided by the ASPSP like "SMS OTP on phone +49160 xxxxx 28". This name shall be used by the TPP when presenting a list of authentication methods to the PSU, if available.
    - `explanation` string — Detailed information about the SCA method for the PSU.
  - `chosenScaMethod` ChosenScaMethod — Authentication object.
    - `authenticationType` 'SMS_OTP' | 'CHIP_OTP' | 'PHOTO_OTP' | 'PUSH_OTP' | 'SMTP_OTP', required — Type of the authentication method. More authentication types might be added during implementation projects and documented in the ASPSP documentation. - 'SMS_OTP': An SCA method, where an OTP linked to the transaction to be authorised is sent to the PSU through a SMS channel. - 'CHIP_OTP': An SCA method, where an OTP is generated by a chip card, e.g. a TOP derived from an EMV cryptogram. To contact the card, the PSU normally needs a (handheld) device. With this device, the PSU either reads the challenging data through a visual interface like flickering or the PSU types in the challenge through the device key pad. The device then derives an OTP from the challenge data and displays the OTP to the PSU. - 'PHOTO_OTP': An SCA method, where the challenge is a QR code or similar encoded visual data which can be read in by a consumer device or specific mobile app. The device resp. the specific app than derives an OTP from the visual challenge data and displays the OTP to the PSU. - 'PUSH_OTP': An OTP is pushed to a dedicated authentication APP and displayed to the PSU. - 'SMTP_OTP': An OTP is sent via email to the PSU.
    - `authenticationVersion` string — Depending on the "authenticationType". This version can be used by differentiating authentication tools used within performing OTP generation in the same authentication type. This version can be referred to in the ASPSP?s documentation.
    - `authenticationMethodId` string, required — An identification provided by the ASPSP for the later identification of the authentication method selection.
    - `name` string — This is the name of the authentication method defined by the PSU in the Online Banking frontend of the ASPSP. Alternatively this could be a description provided by the ASPSP like "SMS OTP on phone +49160 xxxxx 28". This name shall be used by the TPP when presenting a list of authentication methods to the PSU, if available.
    - `explanation` string — Detailed information about the SCA method for the PSU.
  - `challengeData` ChallengeData — It is contained in addition to the data element 'chosenScaMethod' if challenge data is needed for SCA. In rare cases this attribute is also used in the context of the 'startAuthorisationWithPsuAuthentication' link.
    - `image` string, byte — PNG data (max. 512 kilobyte) to be displayed to the PSU, Base64 encoding, cp. [RFC4648]. This attribute is used only, when PHOTO_OTP or CHIP_OTP is the selected SCA method.
    - `data` string[] — A collection of strings as challenge data.
    - `imageLink` string — A link where the ASPSP will provides the challenge image for the TPP.
    - `otpMaxLength` integer — The maximal length for the OTP to be typed in by the PSU.
    - `otpFormat` 'characters' | 'integer' — The format type of the OTP to be typed in. The admitted values are "characters" or "integer".
    - `additionalInformation` string — Additional explanation for the PSU to explain e.g. fallback mechanism for the chosen SCA method. The TPP is obliged to show this to the PSU.
  - `_links` LinksSigningBasket, required — A list of hyperlinks to be recognised by the TPP. The actual hyperlinks used in the response depend on the dynamical decisions of the ASPSP when processing the request. Remark: All links can be relative or full links, to be decided by the ASPSP. Type of links admitted in this response, (further links might be added for ASPSP defined extensions): * 'scaRedirect': In case of an SCA Redirect Approach, the ASPSP is transmitting the link to which to redirect the PSU browser. * 'scaOAuth': In case of a SCA OAuth2 Approach, the ASPSP is transmitting the URI where the configuration of the Authorisation Server can be retrieved. The configuration follows the OAuth 2.0 Authorisation Server Metadata specification. * 'startAuthorisation': In case, where an explicit start of the transaction authorisation is needed, but no more data needs to be updated (no authentication method to be selected, no PSU identification nor PSU authentication data to be uploaded). * 'startAuthorisationWithPsuIdentification': The link to the authorisation end-point, where the authorisation sub-resource has to be generated while uploading the PSU identification data. * 'startAuthorisationWithPsuAuthentication': The link to the authorisation end-point, where the authorisation sub-resource has to be generated while uploading the PSU authentication data. * 'startAuthorisationWithEncryptedPsuAuthentication': The link to the authorisation end-point, where the authorisation sub-resource has to be generated while uploading the encrypted PSU authentication data. * 'startAuthorisationWithAuthenticationMethodSelection': The link to the authorisation end-point, where the authorisation sub-resource has to be generated while selecting the authentication method. This link is contained under exactly the same conditions as the data element 'scaMethods' * 'startAuthorisationWithTransactionAuthorisation': The link to the authorisation end-point, where the authorisation sub-resource has to be generated while authorising the transaction e.g. by uploading an OTP received by SMS. * 'self': The link to the payment initiation resource created by this request. This link can be used to retrieve the resource data. * 'status': The link to retrieve the transaction status of the payment initiation. * 'scaStatus': The link to retrieve the scaStatus of the corresponding authorisation sub-resource. This link is only contained, if an authorisation sub-resource has been already created.
    - `scaRedirect` HrefType — Link to a resource.
      - `href` string — Link to a resource.
    - `scaOAuth` HrefType — Link to a resource.
      - `href` string — Link to a resource.
    - `startAuthorisation` HrefType — Link to a resource.
      - `href` string — Link to a resource.
    - `startAuthorisationWithPsuIdentification` HrefType — Link to a resource.
      - `href` string — Link to a resource.
    - `startAuthorisationWithPsuAuthentication` HrefType — Link to a resource.
      - `href` string — Link to a resource.
    - `startAuthorisationWithEncryptedPsuAuthentication` HrefType — Link to a resource.
      - `href` string — Link to a resource.
    - `startAuthorisationWithAuthenticationMethodSelection` HrefType — Link to a resource.
      - `href` string — Link to a resource.
    - `startAuthorisationWithTransactionAuthorisation` HrefType — Link to a resource.
      - `href` string — Link to a resource.
    - `self` HrefType — Link to a resource.
      - `href` string — Link to a resource.
    - `status` HrefType — Link to a resource.
      - `href` string — Link to a resource.
    - `scaStatus` HrefType — Link to a resource.
      - `href` string — Link to a resource.
  - `psuMessage` string — Text to be displayed to the PSU.
  - `tppMessages` TppMessage2XX[]
    - `category` 'ERROR' | 'WARNING', required — Category of the TPP message category.
    - `code` 'WARNING', required — Message codes for HTTP Error codes 2XX.
    - `path` string
    - `text` string — Additional explaining text to the TPP.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not found
- `405` — Method Not Allowed
- `406` — Not Acceptable
- `408` — Request Timeout
- `409` — Conflict
- `415` — Unsupported Media Type
- `429` — Too Many Requests
- `500` — Internal Server Error
- `503` — Service Unavailable

---

[API](https://skmtc.net/openbankingproject-ch/apis/swiss-nextgen-banking-api-framework.md) · [All operations](https://skmtc.net/openbankingproject-ch/apis/swiss-nextgen-banking-api-framework/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openbankingproject-ch/swiss-nextgen-banking-api-framework/revisions/c32e86db40b4/schema)