--- title: "Get VRP consents" method: GET path: "/vrp-consents" tags: ["Variable Recurring Payments"] --- # Get VRP consents `GET /vrp-consents` The `GET /vrp-consents` endpoint retrieves all VRP consents created by the calling member. ## Query parameters - `limit` integer, required - `offset` string - `createdAfter` string - `createdBefore` string - `statuses` VrpConsentStatus[] - `scheme` 'VRP_SWEEPING' — Vrp scheme, only VRP_SWEEPING is supported currently. - `onBehalfOfId` string ## Response `200` Successful response - VrpConsentsResponse - `vrpConsents` VrpConsent[], required - `id` string, required — The Token.io generated VRP consent id. - `memberId` string, required — The Token.io-assigned member id of the TPP. - `initiation` VrpConsentInitiation, required — The initiation payload for the VRP consent. - `bankId` string — The Token.io id of the bank where the consent is created. **This field is required if the customer is not using Token.io's Hosted Pages for bank selection, i.e., API-only integration when `EMBEDDED_HOSTED_PAGES` is selected in `flowType`, or Hosted Pages embedded (modal) integration.** - `refId` string, required — The TPP-generated reference identifier for the token. This is not to be confused with the `requestId`. The `refId` maps to the `tppRefId` in the bank's `consentRequest`. This is needed to match/verify the originating token request with the bank's consent request.
We recommend that the `refId` should not contain special characters (the allowed characters are the 26-letter Latin alphabet, the numerical digits from 0-9 and the hyphen '-'). This field should not exceed 18 characters in length. - `remittanceInformationPrimary` string — The primary field for remittance information. This should contain a reference, as assigned by the creditor, to unambiguously refer to the payment transactions under this consent. The value of this field should appear on the bank statement and reconciliation file, irrespective of the payment network being used.
We recommend that the `remittanceInformationPrimary` field should not contain special characters (the allowed characters are the 26-letter Latin alphabet, the numerical digits from 0-9 and the hyphen '-') as banks may remove these when sending this field to the beneficiary. This field should not exceed 35 characters in length (18 characters for UK Faster Payments). - `remittanceInformationSecondary` string — The secondary field for remittance information. The information supplied should enable the reconciliation of an entry in an unstructured form. Depending on the payment network, information from this field may or may not be included in the bank statement and reconciliation file.
We recommend that the `remittanceInformationSecondary` field should not contain special characters (the allowed characters are the 26-letter Latin alphabet, the numerical digits from 0-9 and the hyphen '-') as banks may remove these when sending this field to the beneficiary. This field should not exceed 140 characters in length. - `startDateTime` string — The date and time from which payments can be made (in ISO 8601 format). Payments initiated before this time will be rejected. If not provided, the time of consent creation is used as a default. The date and time cannot be earlier than the current time. - `endDateTime` string — The date and time before which payments can be made (in ISO 8601 format). Payments initiated after this time will be rejected. - `onBehalfOfId` string — The id of the ultimate client on whose behalf the consent is created. If the consent is created on behalf of a sub-TPP, this field should contain the sub-TPP `referenceId`. This field is mandatory for unregulated TPPs. - `scheme` 'VRP_SWEEPING', required — The types of payments that can be made under this VRP consent. - `localInstrument` 'FASTER_PAYMENTS', required — The bank's payment service used for making a payment. Presently only Faster Payments are supported. - `debtor` VRPDebtorInformation — A UK or Irish account where the sort code and account number are required. - `accountNumber` string, required — The unique identifier for the bank account in the UK or Ireland. - `sortCode` string, required — The number assigned to a branch of a bank, typically containing six digits and most commonly used in the UK and Ireland. - `name` string — The owner's name for the debtor account. - `ultimateDebtorName` string — The ultimate debtor's name. - `address` Address — Address - `addressLine` string[] - `streetName` string — Street number - `buildingNumber` string — Building number - `postCode` string — Post Code - `townName` string — Town name - `state` string — State - `district` string — The district. - `country` string — Two-letter country code in upper case (ISO 3166-1 alpha-2). - `creditor` VRPCreditorInformation, required — A UK or Irish account where the sort code and account number are required. - `accountNumber` string, required — The unique identifier for the bank account in the UK or Ireland. - `sortCode` string, required — The number assigned to a branch of a bank, typically containing six digits and most commonly used in the UK and Ireland. - `name` string, required — The owner's name for the creditor account. - `ultimateCreditorName` string — The ultimate creditor's name. - `address` Address — Address - `addressLine` string[] - `streetName` string — Street number - `buildingNumber` string — Building number - `postCode` string — Post Code - `townName` string — Town name - `state` string — State - `district` string — The district. - `country` string — Two-letter country code in upper case (ISO 3166-1 alpha-2). - `bankName` string — The creditor's bank name. - `currency` string, required — The ISO 4217 three letter currency code for this VRP consent. All amounts specified in this consent are in this currency. All payments created under this consent should use this currency. - `minimumIndividualAmount` string — The minimum amount for individual payments made under this consent, with up to four digits after the decimal point It should not exceed the `maximumIndividualAmount` or any of the periodic limits `maximumAmount`. - `maximumIndividualAmount` string, required — The maximum amount for individual payments made under this consent, with up to four digits after the decimal point. - `periodicLimits` PeriodicLimit[], required — A list of periodic limits that are applied together as an intersection. At least one should be specified. - `maximumAmount` string, required — The transaction amount with up to four digits after the decimal point. - `periodType` 'DAY' | 'WEEK' | 'MONTH' | 'YEAR', required - `periodAlignment` 'CONSENT' | 'CALENDAR' — This field specifies whether the period starts on the consent start date or lines up with a calendar. If not specified, the CONSENT alignment is used.
The consent start date is defined by the `startDateTime` field of the consent (the time element is disregarded) or the date when consent is created if the startDateTime is not specified. - `maximumOccurrences` integer — The total number of payments that can be initiated under this consent. Any new payments will be rejected if the number is over this limit. This cannot be negative, 0 value is considered as not set. - `callbackUrl` string, required — The TPP's url that Token.io calls back to. This url should not be under the token.io domain and must be https/SSL secure. - `callbackState` string, required — The uniquely-generated string included as part of the URL when communicating with the bank. It is sent to the bank during payment initiation and is also returned in the callback from the bank. You can use it to identify which payment the callback refers to, ensuring that the callback can be reliably matched to the original payment request. - `returnRefundAccount` boolean — This field indicates whether the `RefundAccount` object should be included in the VRP created under this consent. - `risk` Risk — This field is used to specify additional details for the risk scoring of payments. - `psuId` string — The merchant's unique customer identifier for the user. - `paymentContextCode` 'INVALID_PAYMENT_CONTEXT_CODE' | 'BILLING_GOODS_AND_SERVICES_IN_ADVANCE' | 'BILLING_GOODS_AND_SERVICES_IN_ARREARS' | 'PISP_PAYEE' | 'ECOMMERCE_MERCHANT_INITIATED_PAYMENT' | 'FACE_TO_FACE_POINT_OF_SALE' | 'TRANSFER_TO_SELF' | 'TRANSFER_TO_THIRD_PARTY' — This field describes the context of the payment context. This field is an OBIE standard and also maps to NextGenPsd2's `purposeCode` and `categoryPurposeCode` fields. We recommend that the TPP populates this field. - `paymentPurposeCode` 'CASH' | 'CORT' | 'DVPM' | 'INTC' | 'TREA' | 'SUPP' — The category code conforming to the Recommended UK Purpose Code in the ISO 20022 Payment Messaging List, related to the type of services or goods corresponding to the underlying purpose of the payment. This list applies to all banks that follow ISO 20022. - `merchantCategoryCode` string — The category code conforming to ISO 18245, relating to the type of services or goods provided by the merchant. A list of codes can be purchased here." - `beneficiaryAccountType` 'PERSONAL' | 'JOINT_PERSONAL' | 'PERSONAL_SAVINGS_ACCOUNT' | 'BUSINESS' | 'BUSINESS_SAVINGS_ACCOUNT' | 'CHARITY' | 'COLLECTION' | 'CORPORATE' | 'GOVERNMENT' | 'EWALLET' | 'INVESTMENT' | 'ISA' | 'PREMIER' | 'WEALTH' | 'PENSION' — This information should be provided if the `AccountType` is known. - `contractPresentIndicator` boolean — This field indicates whether a Payee has a contractual relationship with the Payment Initiation Service Provider (PISP). - `beneficiaryPrepopulatedIndicator` boolean — This field indicates whether the Payment Initiation Service Provider (PISP) has immutably prepopulated payment details for the user. - `deliveryAddress` DeliveryAddress — Specifies the recipient's delivery address details. - `addressLine` string[] — Specifies the delivery address using multiple lines, as necessary. - `addressType` 'INVALID_ADDRESS_TYPE' | 'BUSINESS' | 'CORRESPONDENCE' | 'DELIVERYTO' | 'MAILTO' | 'POBOX' | 'POSTAL' | 'RESIDENTIAL' | 'STATEMENT' — Specifies the type of address. - `buildingNumber` string — The building number within the delivery address. - `country` string — Two-letter country code in upper case (ISO 3166-1 alpha-2). - `countrySubDivision` string[] — Identifies a subdivision of a country; for instance, a state, region, or county. - `department` string — This OBIE specification maps to house number. - `postCode` string — An identifier consisting of a group of letters and/or numbers that is added to a postal address to assist the sorting of mail. - `streetName` string — The name of the respective street or thoroughfare in which the dwelling or business is located or where mail is received. - `subDepartment` string — This OBIE specification maps to flats. - `townName` string — The name of a built-up area with defined boundaries and a local government. - `flowType` 'API_ONLY' | 'FULL_HOSTED_PAGES' — The integration option requested by the TPP. - `createdDateTime` string, required — The time this VRP consent object was created (in ISO 8601 format). - `updatedDateTime` string, required — The last time this VRP consent object was updated (in ISO 8601 format). - `status` 'PENDING' | 'PENDING_MORE_INFO' | 'PENDING_REDIRECT_AUTH' | 'PENDING_REDIRECT_AUTH_VERIFICATION' | 'AUTHORIZED' | 'REJECTED' | 'REVOKED' | 'FAILED', required — The Token.io VRP consent status.
- `bankVrpConsentId` string — The VRP consent id from the bank. This field can be empty if the consent id isn't available on the bank side. - `bankVrpConsentStatus` string — The raw bank status. This field can be empty if the consent status isn't available on the bank side. - `statusReasonInformation` string — A human-readable description of the reason for the reported status, which may include a message from the bank. This value should not exceed 256 characters in length. - `authentication` Authentication — The authentication operation required to proceed with consent creation. This is present when the consent initiation request has been created at the bank, but the consent hasn't been authorized or rejected yet. - `redirectUrl` string, required — This URL redirects the user in order to authorize the consent creation. - `pageInfo` PageInfo, required — The information about the current page, which also indicates whether the next page exists. - `limit` integer, required — The limit (maximum number of objects to return) applied to this page.
The default and maximum allowed limit is 200. If this limit is exceeded, was not set or was set to 0, it will be set to 200. - `offset` string — The offset for the current page. If the offset has been provided in the request, this offset will be equal to the provided one. But if no offset is provided in the request (i.e. this is the first page) and the page is not empty, this field will be populated with a non-empty string. This may be helpful for loading the same page again, which might not always be possible with an empty offset due to the dynamic nature of the data.
The offset is opaque to a user and should not be parsed and/or understood in any way. - `nextOffset` string — The offset for the next page. If the page is empty, it is equal to this page offset. If the page is not empty, but there are no more objects to load (haveMore = false), it will be empty.
The offset is opaque to a user and should not be parsed and/or understood in any way. - `haveMore` boolean — This field indicates whether there are more objects to load, i.e. whether the next page exists. ## Other responses - `400` — Bad request - `401` — The authorization information is missing or invalid - `500` — An unexpected or internal server error --- [API](https://skmtc.net/token/apis/token-io-s-open-banking-api-for-tpps.md) · [All operations](https://skmtc.net/token/apis/token-io-s-open-banking-api-for-tpps/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/token/token-io-s-open-banking-api-for-tpps/versions/5e8d6d2c24a1/schema)