v1

latestOpenAPI 3.0.1Creative Commons Attribution 4.0 International Public License2026-07-1334289536.7 KB

Account Information Service (AIS)

Get consent request

Returns the content of an account information consent object. This is returning the data for the TPP especially in cases, where the consent was directly managed between ASPSP and PSU e.g. in a redirect SCA Approach.

get/v1/consents/{consentId}

Path parameters

consentIdstring required

ID of the corresponding consent object as returned by an account information consent request.

Headers

X-Request-IDstring required

ID of the request, unique to the call, as determined by the initiating party.

Digeststring

Is contained if and only if the "Signature" element is contained in the header of the request.

Signaturestring

A signature of the request by the TPP on application level. This might be mandated by ASPSP.

TPP-Signature-Certificatestring byte

The certificate used for signing the request, in base64 encoding. Must be contained if a signature is contained.

PSU-IP-Addressstring ipv4

The forwarded IP Address header field consists of the corresponding HTTP request IP Address field between PSU and TPP. It shall be contained if and only if this request was actively initiated by the PSU.

PSU-IP-Portstring

The forwarded IP Port header field consists of the corresponding HTTP request IP Port field between PSU and TPP, if available.

PSU-Acceptstring

The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.

PSU-Accept-Charsetstring

The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.

PSU-Accept-Encodingstring

The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.

PSU-Accept-Languagestring

The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.

PSU-User-Agentstring

The forwarded Agent header field of the HTTP request between PSU and TPP, if available.

PSU-Http-Method'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'

HTTP method used at the PSU ? TPP interface, if available. Valid values are:

GET
POST
PUT
PATCH
DELETE

PSU-Device-IDstring

UUID (Universally Unique Identifier) for a device, which is used by the PSU, if available. UUID identifies either a device or a device dependant application installation. In case of an installation identification this ID needs to be unaltered until removal from device.

PSU-Geo-Locationstring

The forwarded Geo Location of the corresponding http request between PSU and TPP if available.

Response

recurringIndicatorboolean required

"true", if the consent is for recurring access to the account data.

"false", if the consent is for one access to the account data.

validUntilstring date required

This parameter is defining a valid until date (including the mentioned date) for the requested consent. The content is the local ASPSP date in ISO-Date format, e.g. 2017-10-30.

Future dates might get adjusted by ASPSP.

If a maximal available date is requested, a date in far future is to be used: "9999-12-31".

In both cases the consent object to be retrieved by the get consent request will contain the adjusted date.

frequencyPerDayinteger required

This field indicates the requested maximum frequency for an access without PSU involvement per day. For a one-off access, this attribute is set to "1".

The frequency needs to be greater equal to one.

If not otherwise agreed bilaterally between TPP and ASPSP, the frequency is less equal to 4.

lastActionDatestring date required

This date is containing the date of the last action on the consent object either through the XS2A interface or the PSU/ASPSP interface having an impact on the status.

This is the overall lifecycle status of the consent.

Valid values are:

'received': The consent data have been received and are technically correct. The data is not authorised yet.
'rejected': The consent data have been rejected e.g. since no successful authorisation has taken place.
'valid': The consent is accepted and valid for GET account data calls and others as specified in the consent object.
'revokedByPsu': The consent has been revoked by the PSU towards the ASPSP.
'expired': The consent expired.
'terminatedByTpp': The corresponding TPP has terminated the consent by applying the DELETE method to the consent resource.
'partiallyAuthorised': The consent is due to a multi-level authorisation, some but not all mandated authorisations have been performed yet.

The ASPSP might add further codes. These codes then shall be contained in the ASPSP's documentation of the XS2A interface and has to be added to this API definition as well.

Example response

{
  "access": {
    "accounts": [
      {
        "iban": "FR7612345987650123456789014",
        "otherAccountIdentification": "90-100100-0",
        "currency": "EUR"
      }
    ],
    "balances": [
      {
        "iban": "FR7612345987650123456789014",
        "otherAccountIdentification": "90-100100-0",
        "currency": "EUR"
      }
    ],
    "transactions": [
      {
        "iban": "FR7612345987650123456789014",
        "otherAccountIdentification": "90-100100-0",
        "currency": "EUR"
      }
    ],
    "additionalInformation": {
      "ownerName": [
        {
          "iban": "FR7612345987650123456789014",
          "otherAccountIdentification": "90-100100-0",
          "currency": "EUR"
        }
      ],
      "trustedBeneficiaries": [
        {
          "iban": "FR7612345987650123456789014",
          "otherAccountIdentification": "90-100100-0",
          "currency": "EUR"
        }
      ]
    }
  },
  "validUntil": "2020-12-31",
  "frequencyPerDay": 4,
  "lastActionDate": "2018-07-01",
  "_links": {
    "account": {
      "href": "/v1/payments/swiss-sepa-credit-transfers/1234-wertiq-983"
    },
    "card-account": {
      "href": "/v1/payments/swiss-sepa-credit-transfers/1234-wertiq-983"
    }
  }
}