From 0efe871090f6e453b07ba95185db1e414dfe64d2 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Thu, 25 Jun 2026 10:48:58 +0100 Subject: [PATCH 01/36] Remove 404Error and Identification_0 from OpenAPI Remove unused components from the generated OpenAPI spec (dist/openapi/confirmation-funds-openapi.yaml): the 404Error response (with x-fapi-interaction-id header) and the Identification_0 schema were deleted to clean up redundant/unused definitions in the components section. --- dist/openapi/confirmation-funds-openapi.yaml | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 3c777ab..3fdbc7a 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -406,14 +406,6 @@ components: application/jose+jwe: schema: $ref: '#/components/schemas/OBErrorResponse1' - 404Error: - description: Not found - headers: - x-fapi-interaction-id: - required: true - description: An RFC4122 UID used as a correlation id. - schema: - type: string 405Error: description: Method Not Allowed headers: @@ -488,13 +480,6 @@ components: scopes: fundsconfirmations: Funds confirmation entitlement schemas: - Identification_0: - description: >- - Identification assigned by an institution to identify an account. This - identification is known by the account owner. - type: string - minLength: 1 - maxLength: 256 OBProxy1: description: >- Specifies an alternate assumed name for the identification of the From fcfbf0309a9afbb2fea68253abf3d7c0505c094d Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Thu, 25 Jun 2026 10:53:10 +0100 Subject: [PATCH 02/36] Normalize apostrophe in OpenAPI description Replace a typographic curly apostrophe with a straight ASCII apostrophe in dist/openapi/confirmation-funds-openapi.yaml to standardize encoding and formatting in the Funds Confirmation Consents delete description. --- dist/openapi/confirmation-funds-openapi.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 3fdbc7a..5beb0c7 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -96,7 +96,7 @@ paths: tags: - Funds Confirmation Consents summary: Delete a Funds Confirmation Consent - description: Enables a CBPII to inform the PSU’s ASPSP that the PSU has revoked their consent to provide funds confirmations. + description: Enables a CBPII to inform the PSU's ASPSP that the PSU has revoked their consent to provide funds confirmations. operationId: DeleteFundsConfirmationConsentsConsentId parameters: - $ref: '#/components/parameters/ConsentId' From 158348998000e405a36bff066857ca2a7948ca8f Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Thu, 25 Jun 2026 11:00:27 +0100 Subject: [PATCH 03/36] Change YAML block scalars to '|-' Replace the YAML block scalar indicator '|' with the chomp indicator '|-' in dist/openapi/confirmation-funds-openapi.yaml to strip trailing newlines and standardize formatting. Affected descriptions: info.description, components.parameters.x-idempotency-key.description, components.parameters.x-client-id.description, components.headers.RateLimit-Policy.description, and components.headers.RateLimit.description. --- dist/openapi/confirmation-funds-openapi.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 5beb0c7..3a9448f 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -1,7 +1,7 @@ openapi: 3.0.0 info: title: Confirmation of Funds API Specification - description: | + description: |- Swagger for Confirmation of Funds API Specification. **Please Note**: There are no optional fields, if a field is not marked as “Required” it is a Conditional field. @@ -225,7 +225,7 @@ components: x-idempotency-key: name: x-idempotency-key in: header - description: | + description: |- Every request will be processed only once per x-idempotency-key. The Idempotency Key will be valid for 24 hours. required: true @@ -244,7 +244,7 @@ components: in: header name: x-client-id required: false - description: | + description: |- Only used if an ASPSP requires the client ID in order to return rate limit headers. TPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements. @@ -255,7 +255,7 @@ components: headers: RateLimit-Policy: required: false - description: | + description: |- TPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements. A non-empty list of Quota Policy Items. The Item value __MUST__ be a String. @@ -270,7 +270,7 @@ components: type: string RateLimit: required: false - description: | + description: |- TPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements. A server uses the "RateLimit" response header field to communicate the current service limit for a quota policy for a particular partition key. From 6c1b37279e7139527eab4887dad5e035a438fb00 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Fri, 26 Jun 2026 11:33:27 +0100 Subject: [PATCH 04/36] Remove Authorization header param from OpenAPI Delete the Authorization parameter definition and remove its references from the confirmation-funds OpenAPI spec (dist/openapi/confirmation-funds-openapi.yaml). Cleans up the components/parameters section and path parameter lists by removing the now-unneeded Authorization header entry. --- dist/openapi/confirmation-funds-openapi.yaml | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 3a9448f..39f5296 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -25,7 +25,6 @@ paths: - $ref: '#/components/parameters/x-fapi-auth-date' - $ref: '#/components/parameters/x-fapi-customer-ip-address' - $ref: '#/components/parameters/x-fapi-interaction-id' - - $ref: '#/components/parameters/Authorization' - $ref: '#/components/parameters/x-customer-user-agent' - $ref: '#/components/parameters/x-client-id' requestBody: @@ -69,7 +68,6 @@ paths: - $ref: '#/components/parameters/x-fapi-auth-date' - $ref: '#/components/parameters/x-fapi-customer-ip-address' - $ref: '#/components/parameters/x-fapi-interaction-id' - - $ref: '#/components/parameters/Authorization' - $ref: '#/components/parameters/x-customer-user-agent' - $ref: '#/components/parameters/x-client-id' responses: @@ -103,7 +101,6 @@ paths: - $ref: '#/components/parameters/x-fapi-auth-date' - $ref: '#/components/parameters/x-fapi-customer-ip-address' - $ref: '#/components/parameters/x-fapi-interaction-id' - - $ref: '#/components/parameters/Authorization' - $ref: '#/components/parameters/x-customer-user-agent' - $ref: '#/components/parameters/x-client-id' responses: @@ -137,7 +134,6 @@ paths: - $ref: '#/components/parameters/x-fapi-auth-date' - $ref: '#/components/parameters/x-fapi-customer-ip-address' - $ref: '#/components/parameters/x-fapi-interaction-id' - - $ref: '#/components/parameters/Authorization' - $ref: '#/components/parameters/x-customer-user-agent' - $ref: '#/components/parameters/x-client-id' requestBody: @@ -180,13 +176,6 @@ components: required: true schema: type: string - Authorization: - in: header - name: Authorization - required: true - description: An Authorisation Token as per https://tools.ietf.org/html/rfc6750 - schema: - type: string x-customer-user-agent: in: header name: x-customer-user-agent From f8359f03338260dd54d9b45b76ee794c0c765981 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Mon, 6 Jul 2026 14:07:09 +0100 Subject: [PATCH 05/36] Add tags to funds confirmation OpenAPI spec Adds top-level OpenAPI tags for Funds Confirmation Consents and Funds Confirmations in the generated confirmation funds spec. This improves operation grouping and discoverability in API documentation tooling. --- dist/openapi/confirmation-funds-openapi.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 39f5296..090c1f3 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -13,6 +13,11 @@ info: name: open-licence url: https://www.openbanking.org.uk/open-licence version: 4.0.1 +tags: + - name: Funds Confirmation Consents + description: Operations related to funds confirmation consents + - name: Funds Confirmations + description: Operations related to funds confirmations paths: /funds-confirmation-consents: post: From eb998f8008ae1b846427bec57c78613e80c47be5 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 15 Jul 2026 11:41:52 +0100 Subject: [PATCH 06/36] Update confirmation-funds-openapi.yaml --- dist/openapi/confirmation-funds-openapi.yaml | 27 ++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 090c1f3..c759c6b 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -456,7 +456,19 @@ components: securitySchemes: TPPOAuth2Security: type: oauth2 - description: TPP client credential authorisation flow with the ASPSP + description: |- + TPP client credential authorisation flow with the ASPSP. + + FAPI 1 Advanced / OAuth 2.0 client credentials authorisation flow with + the ASPSP. Access tokens are sent on resource requests using the + standard HTTP Authorization header with the Bearer authentication + scheme: `Authorization: Bearer `. + + This OpenAPI security scheme represents the OAuth2 access-token + requirement. Additional Open Banking/FAPI requirements such as transport + security, client authentication method, signing, PAR/JAR, or certificate + binding are profiled by the Open Banking security profile and may not be + fully expressible in OpenAPI 3.0 securitySchemes. flows: clientCredentials: tokenUrl: https://authserver.example/token @@ -464,9 +476,20 @@ components: fundsconfirmations: Funds confirmation entitlement PSUOAuth2Security: type: oauth2 - description: >- + description: |- OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when a TPP wants to access an ASPSP resource owned by the PSU + + FAPI 1 Advanced / OAuth 2.0 client credentials authorisation flow with + the ASPSP. Access tokens are sent on resource requests using the + standard HTTP Authorization header with the Bearer authentication + scheme: `Authorization: Bearer `. + + This OpenAPI security scheme represents the OAuth2 access-token + requirement. Additional Open Banking/FAPI requirements such as transport + security, client authentication method, signing, PAR/JAR, or certificate + binding are profiled by the Open Banking security profile and may not be + fully expressible in OpenAPI 3.0 securitySchemes. flows: authorizationCode: authorizationUrl: https://authserver.example/authorization From ff37cadda839a18d26cc0eea64269e5c0b1de327 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 15 Jul 2026 11:44:57 +0100 Subject: [PATCH 07/36] Add Authorization header to CoF OpenAPI Adds a required `Authorization` header parameter to all confirmation-funds operations and defines it in `components.parameters`. This aligns the generated OpenAPI spec with RFC6750 bearer token requirements and keeps header definitions reusable and consistent. --- dist/openapi/confirmation-funds-openapi.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index c759c6b..8d36d9b 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -30,6 +30,7 @@ paths: - $ref: '#/components/parameters/x-fapi-auth-date' - $ref: '#/components/parameters/x-fapi-customer-ip-address' - $ref: '#/components/parameters/x-fapi-interaction-id' + - $ref: '#/components/parameters/Authorization' - $ref: '#/components/parameters/x-customer-user-agent' - $ref: '#/components/parameters/x-client-id' requestBody: @@ -73,6 +74,7 @@ paths: - $ref: '#/components/parameters/x-fapi-auth-date' - $ref: '#/components/parameters/x-fapi-customer-ip-address' - $ref: '#/components/parameters/x-fapi-interaction-id' + - $ref: '#/components/parameters/Authorization' - $ref: '#/components/parameters/x-customer-user-agent' - $ref: '#/components/parameters/x-client-id' responses: @@ -106,6 +108,7 @@ paths: - $ref: '#/components/parameters/x-fapi-auth-date' - $ref: '#/components/parameters/x-fapi-customer-ip-address' - $ref: '#/components/parameters/x-fapi-interaction-id' + - $ref: '#/components/parameters/Authorization' - $ref: '#/components/parameters/x-customer-user-agent' - $ref: '#/components/parameters/x-client-id' responses: @@ -139,6 +142,7 @@ paths: - $ref: '#/components/parameters/x-fapi-auth-date' - $ref: '#/components/parameters/x-fapi-customer-ip-address' - $ref: '#/components/parameters/x-fapi-interaction-id' + - $ref: '#/components/parameters/Authorization' - $ref: '#/components/parameters/x-customer-user-agent' - $ref: '#/components/parameters/x-client-id' requestBody: @@ -181,6 +185,13 @@ components: required: true schema: type: string + Authorization: + in: header + name: Authorization + required: true + description: An Authorisation Token as per https://tools.ietf.org/html/rfc6750 + schema: + type: string x-customer-user-agent: in: header name: x-customer-user-agent From 428b1df1a25a2acc0f1a00e38b6060c89ab2e2a1 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 15 Jul 2026 11:51:08 +0100 Subject: [PATCH 08/36] Add .vscode to .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index c3ca957..15e2e44 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ .DS_Store **/*.DS_Store log.csv +.vscode \ No newline at end of file From 0a491ed19973b7bc046633c56c5378cb75978a06 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 15 Jul 2026 11:51:27 +0100 Subject: [PATCH 09/36] Update .gitignore --- .gitignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 15e2e44..870af2c 100644 --- a/.gitignore +++ b/.gitignore @@ -4,4 +4,4 @@ .DS_Store **/*.DS_Store log.csv -.vscode \ No newline at end of file +.vscode From 26faef5d6fb7f2f9ea3f84a982d8cf23ea2b25c2 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 15 Jul 2026 12:57:37 +0100 Subject: [PATCH 10/36] Clarify confirmation funds endpoint docs Expand the OpenAPI descriptions for confirmation of funds consent and request endpoints. The updated docs now spell out successful response contents, explain consent status expectations, and clarify that creating, retrieving, deleting, and checking funds do not implicitly authorise, reserve, or move funds. --- dist/openapi/confirmation-funds-openapi.yaml | 30 +++++++++++++++++--- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 8d36d9b..9a45e31 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -24,7 +24,12 @@ paths: tags: - Funds Confirmation Consents summary: Create a Funds Confirmation Consent - description: Enables a CBPII to ask an ASPSP to create a new funds-confirmation-consent resource, by sending a copy of the consent to the ASPSP. + description: |- + Enables a CBPII to ask an ASPSP to create a new funds-confirmation-consent resource, by sending a copy of the consent to the ASPSP. + + On success (HTTP 201), the response contains a `ConsentId`, `CreationDateTime`, the current `Status` of the consent, `StatusUpdateDateTime`, and the `DebtorAccount` associated with the consent. The consent may initially be returned with status `AWAU` (`AwaitingAuthorisation`). + + **Note:** Creating this consent does not immediately authorise funds confirmations. The PSU will need to authenticate and authorise the consent with their ASPSP before the consent can be used for funds confirmation requests. operationId: CreateFundsConfirmationConsents parameters: - $ref: '#/components/parameters/x-fapi-auth-date' @@ -67,7 +72,12 @@ paths: tags: - Funds Confirmation Consents summary: Get a Funds Confirmation Consent - description: Enables a CBPII to retrieve the status of a Funds Confirmation Consent resource. + description: |- + Enables a CBPII to retrieve the status of a Funds Confirmation Consent resource. + + On success (HTTP 200), the response contains the consent `ConsentId`, `CreationDateTime`, current `Status`, `StatusUpdateDateTime`, optional `StatusReason`, optional `ExpirationDateTime`, and the `DebtorAccount` associated with the consent. + + **Note:** This operation is read-only. It does not change the consent status, authorise the consent, revoke the consent, or perform a funds availability check. operationId: GetFundsConfirmationConsentsConsentId parameters: - $ref: '#/components/parameters/ConsentId' @@ -101,7 +111,12 @@ paths: tags: - Funds Confirmation Consents summary: Delete a Funds Confirmation Consent - description: Enables a CBPII to inform the PSU's ASPSP that the PSU has revoked their consent to provide funds confirmations. + description: |- + Enables a CBPII to inform the PSU's ASPSP that the PSU has revoked their consent to provide funds confirmations. + + On success (HTTP 204), the response has no body. The ASPSP confirms that the funds-confirmation-consent resource identified by `ConsentId` has been deleted or revoked for future funds confirmation use. + + **Note:** After this operation succeeds, the consent can no longer be used to create funds confirmation requests. operationId: DeleteFundsConfirmationConsentsConsentId parameters: - $ref: '#/components/parameters/ConsentId' @@ -136,7 +151,14 @@ paths: tags: - Funds Confirmations summary: Create a Funds Confirmation Request - description: Enables a CBPII to check whether a PSU has sufficient available funds for a CBPII transaction. + description: |- + Enables a CBPII to check whether a PSU has sufficient available funds for a CBPII transaction. + + The request identifies the authorised funds-confirmation consent using `ConsentId`, provides a CBPII-assigned `Reference`, and specifies the `InstructedAmount` to check. + + On success (HTTP 201), the response contains a `FundsConfirmationId`, the related `ConsentId`, `CreationDateTime`, the boolean `FundsAvailable` result, the `Reference`, and the `InstructedAmount` checked. + + **Note:** This operation checks availability only; it does not reserve funds, move funds, or initiate a payment. operationId: CreateFundsConfirmations parameters: - $ref: '#/components/parameters/x-fapi-auth-date' From 8397871264fd974e75186992cfd0b7c5c8ec59f7 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 15 Jul 2026 13:16:17 +0100 Subject: [PATCH 11/36] Refine CBPII OpenAPI descriptions and headers Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- dist/openapi/confirmation-funds-openapi.yaml | 287 +++++++------------ 1 file changed, 102 insertions(+), 185 deletions(-) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 9a45e31..623c5a3 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -3,7 +3,7 @@ info: title: Confirmation of Funds API Specification description: |- Swagger for Confirmation of Funds API Specification. - + **Please Note**: There are no optional fields, if a field is not marked as “Required” it is a Conditional field. termsOfService: https://www.openbanking.org.uk/terms contact: @@ -232,11 +232,10 @@ components: in: header name: x-fapi-auth-date required: false - description: >- - The time when the PSU last logged in with the TPP. + description: |- + The time when the PSU last logged in with the TPP. - All dates in the HTTP headers are represented as RFC 7231 Full Dates. An - example is below: + All dates in the HTTP headers are represented as RFC 7231 Full Dates. An example is below: Sun, 10 Sep 2017 19:43:31 UTC schema: @@ -272,8 +271,8 @@ components: name: x-client-id required: false description: |- - Only used if an ASPSP requires the client ID in order to return rate limit headers. - + Only used if an ASPSP requires the client ID in order to return rate limit headers. + TPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements. This header __must not__ be used for client authentication @@ -492,16 +491,9 @@ components: description: |- TPP client credential authorisation flow with the ASPSP. - FAPI 1 Advanced / OAuth 2.0 client credentials authorisation flow with - the ASPSP. Access tokens are sent on resource requests using the - standard HTTP Authorization header with the Bearer authentication - scheme: `Authorization: Bearer `. + FAPI 1 Advanced / OAuth 2.0 client credentials authorisation flow with the ASPSP. Access tokens are sent on resource requests using the standard HTTP Authorization header with the Bearer authentication scheme: `Authorization: Bearer `. - This OpenAPI security scheme represents the OAuth2 access-token - requirement. Additional Open Banking/FAPI requirements such as transport - security, client authentication method, signing, PAR/JAR, or certificate - binding are profiled by the Open Banking security profile and may not be - fully expressible in OpenAPI 3.0 securitySchemes. + This OpenAPI security scheme represents the OAuth2 access-token requirement. Additional Open Banking/FAPI requirements such as transport security, client authentication method, signing, PAR/JAR, or certificate binding are profiled by the Open Banking security profile and may not be fully expressible in OpenAPI 3.0 securitySchemes. flows: clientCredentials: tokenUrl: https://authserver.example/token @@ -510,19 +502,11 @@ components: PSUOAuth2Security: type: oauth2 description: |- - OAuth flow, it is required when the PSU needs to perform SCA with the - ASPSP when a TPP wants to access an ASPSP resource owned by the PSU + OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when a TPP wants to access an ASPSP resource owned by the PSU - FAPI 1 Advanced / OAuth 2.0 client credentials authorisation flow with - the ASPSP. Access tokens are sent on resource requests using the - standard HTTP Authorization header with the Bearer authentication - scheme: `Authorization: Bearer `. + FAPI 1 Advanced / OAuth 2.0 authorisation code flow with the ASPSP. Access tokens are sent on resource requests using the standard HTTP Authorization header with the Bearer scheme: `Authorization: Bearer ` - This OpenAPI security scheme represents the OAuth2 access-token - requirement. Additional Open Banking/FAPI requirements such as transport - security, client authentication method, signing, PAR/JAR, or certificate - binding are profiled by the Open Banking security profile and may not be - fully expressible in OpenAPI 3.0 securitySchemes. + This OpenAPI security scheme represents the OAuth2 access-token requirement. Additional Open Banking/FAPI requirements such as transport security, client authentication method, signing, PAR/JAR, or certificate binding are profiled by the Open Banking security profile and may not be fully expressible in OpenAPI 3.0 securitySchemes. flows: authorizationCode: authorizationUrl: https://authserver.example/authorization @@ -531,18 +515,14 @@ components: fundsconfirmations: Funds confirmation entitlement schemas: OBProxy1: - description: >- - Specifies an alternate assumed name for the identification of the - account. + description: Specifies an alternate assumed name for the identification of the account. type: object required: - Identification - Code properties: Identification: - description: >- - Identification used to indicate the account identification under - another specified name. + description: Identification used to indicate the account identification under another specified name. type: string minLength: 1 maxLength: 2048 @@ -554,10 +534,10 @@ components: minLength: 1 maxLength: 35 ExternalProxyAccountType1Code: - description: >- - Specifies the external proxy account type code, as published in the - proxy account type external code set.
For a full list of values refer to - `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) + description: |- + Specifies the external proxy account type code, as published in the proxy account type external code set. + + For a full list of values refer to `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) type: string enum: - TELE @@ -582,12 +562,10 @@ components: - VIPN - BIID ISODateTime: - description: >- - All dates in the JSON payloads are represented in ISO 8601 date-time - format. + description: |- + All dates in the JSON payloads are represented in ISO 8601 date-time format. - All date-time fields in responses must include the timezone. An example - is below: + All date-time fields in responses must include the timezone. An example is below: 2017-04-05T10:43:07+00:00 type: string @@ -633,53 +611,48 @@ components: ErrorCode: $ref: '#/components/schemas/OBExternalStatusReason1Code' Message: - description: >- - A description of the error that occurred. e.g., 'A mandatory field - isn't supplied' or 'RequestedExecutionDateTime must be in future' + description: |- + A description of the error that occurred. e.g., 'A mandatory field isn't supplied' or 'RequestedExecutionDateTime must be in future' - OBL doesn't standardise this field + OBL doesn't standardise this field. type: string minLength: 1 maxLength: 500 Path: - description: >- - Recommended but optional reference to the JSON Path of the field - with error, e.g., Data.Initiation.InstructedAmount.Currency + description: Recommended but optional reference to the JSON Path of the field with error, e.g., Data.Initiation.InstructedAmount.Currency type: string minLength: 1 maxLength: 500 Url: - description: >- - URL to help remediate the problem, or provide more information, or - to API Reference, or help etc + description: URL to help remediate the problem, or provide more information, or to API Reference, or help etc type: string required: - ErrorCode additionalProperties: false minProperties: 1 OBErrorResponse1: - description: >- - An array of detail error codes, and messages, and URLs to documentation - to help remediation. + description: An array of detail error codes, and messages, and URLs to documentation to help remediation. type: object properties: Id: - description: >- - A unique reference for the error instance, for audit purposes, in - case of unknown/unclassified errors. + description: A unique reference for the error instance, for audit purposes, in case of unknown/unclassified errors. type: string minLength: 1 maxLength: 40 Code: - description: >- - Deprecated
High level textual error code, to help categorise the - errors. + description: |- + Deprecated + + High level textual error code, to help categorise the errors. type: string minLength: 1 example: 400 BadRequest maxLength: 40 Message: - description: Deprecated
Brief Error message + description: |- + Deprecated + + Brief Error message type: string minLength: 1 example: There is something wrong with the request parameters provided @@ -705,16 +678,12 @@ components: - InstructedAmount properties: ConsentId: - description: >- - Unique identification as assigned by the ASPSP to uniquely - identify the funds confirmation consent resource. + description: Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation consent resource. type: string minLength: 1 maxLength: 128 Reference: - description: >- - Unique reference, as assigned by the CBPII, to unambiguously - refer to the request related to the payment transaction. + description: Unique reference, as assigned by the CBPII, to unambiguously refer to the request related to the payment transaction. type: string minLength: 1 maxLength: 35 @@ -723,23 +692,14 @@ components: required: - Amount - Currency - description: >- - Amount of money to be confirmed as available funds in the debtor - account. Contains an Amount and a Currency. + description: Amount of money to be confirmed as available funds in the debtor account. Contains an Amount and a Currency. properties: Amount: - description: >- - A number of monetary units specified in an active currency - where the unit of currency is explicit and compliant with - ISO 4217. + description: A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217. type: string pattern: '^\d{1,13}$|^\d{1,13}\.\d{1,5}$' Currency: - description: >- - A code allocated to a currency by a Maintenance Agency under - an international identification scheme, as described in the - latest edition of the international standard ISO 4217 "Codes - for the representation of currencies and funds". + description: A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". type: string pattern: '^[A-Z]{3,3}$' additionalProperties: false @@ -754,12 +714,12 @@ components: - DebtorAccount properties: ExpirationDateTime: - description: >- - Specified date and time the funds confirmation authorisation - will expire. - If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. - All date-time fields in responses must include the timezone. An - example is below: + description: |- + Specified date and time the funds confirmation authorisation will expire. + + If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. + + All date-time fields in responses must include the timezone. An example is below: 2017-04-05T10:43:07+00:00 type: string @@ -769,14 +729,13 @@ components: required: - SchemeName - Identification - description: >- - Unambiguous identification of the account of the debtor to which - a confirmation of funds consent will be applied. + description: Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied. properties: SchemeName: - description: >- - Name of the identification scheme, in a coded form as - published in an external list. For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) + description: |- + Name of the identification scheme, in a coded form as published in an external list. + + For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) type: string x-namespaced-enum: - UK.OBIE.BBAN @@ -786,31 +745,23 @@ components: - UK.OBIE.SortCodeAccountNumber - UK.OBIE.Wallet Identification: - description: >- - Identification assigned by an institution to identify an - account. This identification is known by the account owner. + description: Identification assigned by an institution to identify an account. This identification is known by the account owner. type: string minLength: 1 maxLength: 256 Name: - description: >- - Name of the account, as assigned by the account servicing - institution. + description: |- + Name of the account, as assigned by the account servicing institution. - Usage: The account name is the name or names of the account - owner(s) represented at an account level. The account name - is not the product name or the nickname of the account. + Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account. type: string minLength: 1 maxLength: 350 SecondaryIdentification: - description: >- - This is secondary identification of the account, as assigned - by the account servicing institution. + description: |- + This is secondary identification of the account, as assigned by the account servicing institution. - This can be used by building societies to additionally - identify accounts with a roll number (in addition to a sort - code and account number combination). + This can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination). type: string minLength: 1 maxLength: 34 @@ -832,19 +783,15 @@ components: - DebtorAccount properties: ConsentId: - description: >- - Unique identification as assigned to identify the funds - confirmation consent resource. + description: Unique identification as assigned to identify the funds confirmation consent resource. type: string minLength: 1 maxLength: 128 CreationDateTime: - description: >- - Date and time at which the resource was created. All dates in the - JSON payloads are represented in ISO 8601 date-time format. + description: |- + Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. - All date-time fields in responses must include the timezone. An - example is below: + All date-time fields in responses must include the timezone. An example is below: 2017-04-05T10:43:07+00:00 type: string @@ -856,28 +803,21 @@ components: items: $ref: '#/components/schemas/OBStatusReason' StatusUpdateDateTime: - description: >- - Date and time at which the resource status was updated. All dates - in the JSON payloads are represented in ISO 8601 date-time - format. + description: |- + Date and time at which the resource status was updated. All dates in the JSON payloads are represented in ISO 8601 date-time format. - All date-time fields in responses must include the timezone. An - example is below: + All date-time fields in responses must include the timezone. An example is below: 2017-04-05T10:43:07+00:00 type: string format: date-time ExpirationDateTime: - description: >- - Specified date and time the funds confirmation authorisation - will expire. + description: |- + Specified date and time the funds confirmation authorisation will expire. - If this is not populated, the authorisation will be open - ended. All dates in the JSON payloads are represented in ISO 8601 - date-time format. + If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. - All date-time fields in responses must include the timezone. An - example is below: + All date-time fields in responses must include the timezone. An example is below: 2017-04-05T10:43:07+00:00 type: string @@ -887,14 +827,13 @@ components: required: - SchemeName - Identification - description: >- - Unambiguous identification of the account of the debtor to which - a confirmation of funds consent will be applied. + description: Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied. properties: SchemeName: - description: >- - Name of the identification scheme, in a coded form as - published in an external list. For a full list of values refer to `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) + description: |- + Name of the identification scheme, in a coded form as published in an external list. + + For a full list of values refer to `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) type: string x-namespaced-enum: - UK.OBIE.BBAN @@ -904,31 +843,23 @@ components: - UK.OBIE.SortCodeAccountNumber - UK.OBIE.Wallet Identification: - description: >- - Identification assigned by an institution to identify an - account. This identification is known by the account owner. + description: Identification assigned by an institution to identify an account. This identification is known by the account owner. type: string minLength: 1 maxLength: 256 Name: - description: >- - Name of the account, as assigned by the account servicing - institution. + description: |- + Name of the account, as assigned by the account servicing institution. - Usage: The account name is the name or names of the account - owner(s) represented at an account level. The account name - is not the product name or the nickname of the account. + Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account. type: string minLength: 1 maxLength: 350 SecondaryIdentification: - description: >- - This is secondary identification of the account, as assigned - by the account servicing institution. + description: |- + This is secondary identification of the account, as assigned by the account servicing institution. - This can be used by building societies to additionally - identify accounts with a roll number (in addition to a sort - code and account number combination). + This can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination). type: string minLength: 1 maxLength: 34 @@ -940,7 +871,10 @@ components: $ref: '#/components/schemas/Meta' additionalProperties: false OBInternalConsentStatus1Code: - description: Specifies the status of consent resource in code form. For a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) + description: |- + Specifies the status of consent resource in code form. + + For a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) type: string enum: - AWAU @@ -964,26 +898,20 @@ components: - InstructedAmount properties: FundsConfirmationId: - description: >- - Unique identification as assigned by the ASPSP to uniquely - identify the funds confirmation resource. + description: Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation resource. type: string minLength: 1 maxLength: 40 ConsentId: - description: >- - Unique identification as assigned by the ASPSP to uniquely - identify the funds confirmation consent resource. + description: Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation consent resource. type: string minLength: 1 maxLength: 128 CreationDateTime: - description: >- - Date and time at which the resource was created. All dates in the - JSON payloads are represented in ISO 8601 date-time format. + description: |- + Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. - All date-time fields in responses must include the timezone. An - example is below: + All date-time fields in responses must include the timezone. An example is below: 2017-04-05T10:43:07+00:00 type: string @@ -992,9 +920,7 @@ components: description: Flag to indicate the result of a confirmation of funds check. type: boolean Reference: - description: >- - Unique reference, as assigned by the CBPII, to unambiguously - refer to the request related to the payment transaction. + description: Unique reference, as assigned by the CBPII, to unambiguously refer to the request related to the payment transaction. type: string minLength: 1 maxLength: 35 @@ -1003,23 +929,14 @@ components: required: - Amount - Currency - description: >- - Amount of money to be confirmed as available funds in the debtor - account. Contains an Amount and a Currency. + description: Amount of money to be confirmed as available funds in the debtor account. Contains an Amount and a Currency. properties: Amount: - description: >- - A number of monetary units specified in an active currency - where the unit of currency is explicit and compliant with - ISO 4217. + description: A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217. type: string pattern: '^\d{1,13}$|^\d{1,13}\.\d{1,5}$' Currency: - description: >- - A code allocated to a currency by a Maintenance Agency under - an international identification scheme, as described in the - latest edition of the international standard ISO 4217 "Codes - for the representation of currencies and funds". + description: A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". type: string pattern: '^[A-Z]{3,3}$' Links: @@ -1028,10 +945,10 @@ components: $ref: '#/components/schemas/Meta' additionalProperties: false OBExternalStatusReason1Code: - description: >- - Low level textual error code, for all enum values see - `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* - [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) + description: |- + Low level textual error code. + + For all enum values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) type: string minLength: 4 maxLength: 4 @@ -1042,8 +959,9 @@ components: StatusReasonCode: type: string description: |- - Specifies the status reason in a code form. - For a full list of values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) + Specifies the status reason in a code form. + + For a full list of values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) minLength: 1 maxLength: 4 example: ERIN @@ -1054,7 +972,6 @@ components: maxLength: 500 Path: type: string - description: >- - Optional reference to the JSON Path of the field when status reason refers to an object/field, e.g., Data.DebtorAccount.SchemeName + description: Optional reference to the JSON Path of the field when status reason refers to an object/field, e.g., Data.DebtorAccount.SchemeName minLength: 1 maxLength: 500 From 56e2b139d80c99625e8d6025fed8dac7a68a6426 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 15 Jul 2026 14:47:22 +0100 Subject: [PATCH 12/36] Polish description formatting in CBPII spec Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- dist/openapi/confirmation-funds-openapi.yaml | 36 ++++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 623c5a3..9b384de 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -203,7 +203,7 @@ components: ConsentId: name: ConsentId in: path - description: ConsentId + description: '`ConsentId`' required: true schema: type: string @@ -211,7 +211,7 @@ components: in: header name: Authorization required: true - description: An Authorisation Token as per https://tools.ietf.org/html/rfc6750 + description: An Authorisation Token as per schema: type: string x-customer-user-agent: @@ -237,7 +237,7 @@ components: All dates in the HTTP headers are represented as RFC 7231 Full Dates. An example is below: - Sun, 10 Sep 2017 19:43:31 UTC + `Sun, 10 Sep 2017 19:43:31 UTC` schema: type: string pattern: '^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} (GMT|UTC)$' @@ -252,7 +252,7 @@ components: name: x-idempotency-key in: header description: |- - Every request will be processed only once per x-idempotency-key. The + Every request will be processed only once per `x-idempotency-key`. The Idempotency Key will be valid for 24 hours. required: true schema: @@ -567,7 +567,7 @@ components: All date-time fields in responses must include the timezone. An example is below: - 2017-04-05T10:43:07+00:00 + `2017-04-05T10:43:07+00:00` type: string format: date-time Links: @@ -612,14 +612,14 @@ components: $ref: '#/components/schemas/OBExternalStatusReason1Code' Message: description: |- - A description of the error that occurred. e.g., 'A mandatory field isn't supplied' or 'RequestedExecutionDateTime must be in future' + A description of the error that occurred. e.g., `'A mandatory field isn't supplied'` or `'RequestedExecutionDateTime must be in future'` OBL doesn't standardise this field. type: string minLength: 1 maxLength: 500 Path: - description: Recommended but optional reference to the JSON Path of the field with error, e.g., Data.Initiation.InstructedAmount.Currency + description: Recommended but optional reference to the JSON Path of the field with error, e.g., `Data.Initiation.InstructedAmount.Currency` type: string minLength: 1 maxLength: 500 @@ -641,7 +641,7 @@ components: maxLength: 40 Code: description: |- - Deprecated + **Deprecated** High level textual error code, to help categorise the errors. type: string @@ -650,7 +650,7 @@ components: maxLength: 40 Message: description: |- - Deprecated + **Deprecated** Brief Error message type: string @@ -692,7 +692,7 @@ components: required: - Amount - Currency - description: Amount of money to be confirmed as available funds in the debtor account. Contains an Amount and a Currency. + description: Amount of money to be confirmed as available funds in the debtor account. Contains an `Amount` and a `Currency`. properties: Amount: description: A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217. @@ -721,7 +721,7 @@ components: All date-time fields in responses must include the timezone. An example is below: - 2017-04-05T10:43:07+00:00 + `2017-04-05T10:43:07+00:00` type: string format: date-time DebtorAccount: @@ -793,7 +793,7 @@ components: All date-time fields in responses must include the timezone. An example is below: - 2017-04-05T10:43:07+00:00 + `2017-04-05T10:43:07+00:00` type: string format: date-time Status: @@ -808,7 +808,7 @@ components: All date-time fields in responses must include the timezone. An example is below: - 2017-04-05T10:43:07+00:00 + `2017-04-05T10:43:07+00:00` type: string format: date-time ExpirationDateTime: @@ -819,7 +819,7 @@ components: All date-time fields in responses must include the timezone. An example is below: - 2017-04-05T10:43:07+00:00 + `2017-04-05T10:43:07+00:00` type: string format: date-time DebtorAccount: @@ -913,7 +913,7 @@ components: All date-time fields in responses must include the timezone. An example is below: - 2017-04-05T10:43:07+00:00 + `2017-04-05T10:43:07+00:00` type: string format: date-time FundsAvailable: @@ -929,7 +929,7 @@ components: required: - Amount - Currency - description: Amount of money to be confirmed as available funds in the debtor account. Contains an Amount and a Currency. + description: Amount of money to be confirmed as available funds in the debtor account. Contains an `Amount` and a `Currency`. properties: Amount: description: A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217. @@ -966,12 +966,12 @@ components: maxLength: 4 example: ERIN StatusReasonDescription: - description: Description supporting the StatusReasonCode. + description: Description supporting the `StatusReasonCode`. type: string minLength: 1 maxLength: 500 Path: type: string - description: Optional reference to the JSON Path of the field when status reason refers to an object/field, e.g., Data.DebtorAccount.SchemeName + description: Optional reference to the JSON Path of the field when status reason refers to an object/field, e.g., `Data.DebtorAccount.SchemeName` minLength: 1 maxLength: 500 From 18e3dd2d2b45ecab43f0314315c4d2dad8f1a984 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 15 Jul 2026 15:18:59 +0100 Subject: [PATCH 13/36] Make x-jws-signature optional across CBPII Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- dist/openapi/confirmation-funds-openapi.yaml | 35 +++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 9b384de..5e86375 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -37,6 +37,7 @@ paths: - $ref: '#/components/parameters/x-fapi-interaction-id' - $ref: '#/components/parameters/Authorization' - $ref: '#/components/parameters/x-customer-user-agent' + - $ref: '#/components/parameters/x-jws-signature' - $ref: '#/components/parameters/x-client-id' requestBody: content: @@ -86,6 +87,7 @@ paths: - $ref: '#/components/parameters/x-fapi-interaction-id' - $ref: '#/components/parameters/Authorization' - $ref: '#/components/parameters/x-customer-user-agent' + - $ref: '#/components/parameters/x-jws-signature' - $ref: '#/components/parameters/x-client-id' responses: '200': @@ -125,6 +127,7 @@ paths: - $ref: '#/components/parameters/x-fapi-interaction-id' - $ref: '#/components/parameters/Authorization' - $ref: '#/components/parameters/x-customer-user-agent' + - $ref: '#/components/parameters/x-jws-signature' - $ref: '#/components/parameters/x-client-id' responses: '204': @@ -166,6 +169,7 @@ paths: - $ref: '#/components/parameters/x-fapi-interaction-id' - $ref: '#/components/parameters/Authorization' - $ref: '#/components/parameters/x-customer-user-agent' + - $ref: '#/components/parameters/x-jws-signature' - $ref: '#/components/parameters/x-client-id' requestBody: content: @@ -262,7 +266,7 @@ components: x-jws-signature: in: header name: x-jws-signature - required: true + required: false description: A detached JWS signature of the body of the payload. schema: type: string @@ -309,6 +313,11 @@ components: The **OPTIONAL** "t" parameter value conveys the time window reset time for the identified policy. schema: type: string + x-jws-signature: + required: false + description: A detached JWS signature of the body of the payload. + schema: + type: string responses: 201FundsConfirmationConsentsCreated: description: Funds Confirmation Consent Created @@ -322,6 +331,8 @@ components: $ref: '#/components/headers/RateLimit-Policy' RateLimit: $ref: '#/components/headers/RateLimit' + x-jws-signature: + $ref: '#/components/headers/x-jws-signature' content: application/json; charset=utf-8: schema: @@ -344,6 +355,8 @@ components: $ref: '#/components/headers/RateLimit-Policy' RateLimit: $ref: '#/components/headers/RateLimit' + x-jws-signature: + $ref: '#/components/headers/x-jws-signature' content: application/json; charset=utf-8: schema: @@ -366,6 +379,8 @@ components: $ref: '#/components/headers/RateLimit-Policy' RateLimit: $ref: '#/components/headers/RateLimit' + x-jws-signature: + $ref: '#/components/headers/x-jws-signature' 201FundsConfirmationsCreated: description: Funds Confirmation Created headers: @@ -378,6 +393,8 @@ components: $ref: '#/components/headers/RateLimit-Policy' RateLimit: $ref: '#/components/headers/RateLimit' + x-jws-signature: + $ref: '#/components/headers/x-jws-signature' content: application/json; charset=utf-8: schema: @@ -396,6 +413,8 @@ components: description: An RFC4122 UID used as a correlation id. schema: type: string + x-jws-signature: + $ref: '#/components/headers/x-jws-signature' content: application/json; charset=utf-8: schema: @@ -414,6 +433,8 @@ components: description: An RFC4122 UID used as a correlation id. schema: type: string + x-jws-signature: + $ref: '#/components/headers/x-jws-signature' 403Error: description: Forbidden headers: @@ -422,6 +443,8 @@ components: description: An RFC4122 UID used as a correlation id. schema: type: string + x-jws-signature: + $ref: '#/components/headers/x-jws-signature' content: application/json; charset=utf-8: schema: @@ -440,6 +463,8 @@ components: description: An RFC4122 UID used as a correlation id. schema: type: string + x-jws-signature: + $ref: '#/components/headers/x-jws-signature' 406Error: description: Not Acceptable headers: @@ -448,6 +473,8 @@ components: description: An RFC4122 UID used as a correlation id. schema: type: string + x-jws-signature: + $ref: '#/components/headers/x-jws-signature' 415Error: description: Unsupported Media Type headers: @@ -456,6 +483,8 @@ components: description: An RFC4122 UID used as a correlation id. schema: type: string + x-jws-signature: + $ref: '#/components/headers/x-jws-signature' 429Error: description: Too Many Requests headers: @@ -467,6 +496,8 @@ components: description: An RFC4122 UID used as a correlation id. schema: type: string + x-jws-signature: + $ref: '#/components/headers/x-jws-signature' 500Error: description: Internal Server Error headers: @@ -475,6 +506,8 @@ components: description: An RFC4122 UID used as a correlation id. schema: type: string + x-jws-signature: + $ref: '#/components/headers/x-jws-signature' content: application/json; charset=utf-8: schema: From 7c8f68f53114b6ec17459cb818d9efdc1e3a616d Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 15 Jul 2026 15:34:44 +0100 Subject: [PATCH 14/36] Add v4.0.1-Update1 changelog entry Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- changelog.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/changelog.md b/changelog.md index 4906f78..36b23f4 100644 --- a/changelog.md +++ b/changelog.md @@ -14,6 +14,25 @@ For v4.0.1 the following approach has been adopted for identifying changes: - [v4.0.1 Release Candidate 1](https://openbanking.atlassian.net/wiki/spaces/WOR/pages/4203282434/Feedback+-+v4.0.1+Release+Candidate+1) - [v4.0.1 Release Candidate 2](https://openbanking.atlassian.net/wiki/spaces/WOR/pages/4309942273/Feedback+-+v4.0.1+Release+Candidate+2) +## v4.0.1-Update1 - TBD + +### Added + +- Added CBPII OpenAPI tags for `Funds Confirmation Consents` and `Funds Confirmations` to improve Swagger UI grouping and navigation. +- Added optional `x-jws-signature` request header support across all CBPII operations to align with the Open Banking spec pages/standard. +- Added optional `x-jws-signature` response header support across CBPII success and error responses to align with the Open Banking spec pages/standard. + +### Changed + +- Updated CBPII endpoint descriptions for consent creation, consent retrieval, consent deletion and funds confirmation creation to provide clearer behaviour and outcome detail. +- Standardised CBPII OpenAPI description formatting for consistency (single-line where suitable, `>-`/`|-` block scalar usage where appropriate, paragraph spacing, inline code formatting, and emphasised notes). +- Updated CBPII security scheme descriptions to align with Open Banking/FAPI context and clarify `Authorization` header usage. +- Updated `x-jws-signature` to be optional in CBPII request/response modelling to align with the Open Banking spec pages/standard. + +### Removed + +- Removed **unused** CBPII components `404Error` and `Identification_0`. + ## v4.0.1 - 2026-04-01 ### Added From 8a870bd836bb510e2a3751aecf04ca9ddd6a1f7d Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 15 Jul 2026 16:40:16 +0100 Subject: [PATCH 15/36] Remove unused x-idempotency-key from CBPII spec Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- changelog.md | 1 + dist/openapi/confirmation-funds-openapi.yaml | 11 ----------- 2 files changed, 1 insertion(+), 11 deletions(-) diff --git a/changelog.md b/changelog.md index 36b23f4..f710030 100644 --- a/changelog.md +++ b/changelog.md @@ -32,6 +32,7 @@ For v4.0.1 the following approach has been adopted for identifying changes: ### Removed - Removed **unused** CBPII components `404Error` and `Identification_0`. +- Removed **unused** CBPII component `x-idempotency-key` (CBPII has no idempotent endpoints). ## v4.0.1 - 2026-04-01 diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 5e86375..2f841a7 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -252,17 +252,6 @@ components: description: An RFC4122 UID used as a correlation id. schema: type: string - x-idempotency-key: - name: x-idempotency-key - in: header - description: |- - Every request will be processed only once per `x-idempotency-key`. The - Idempotency Key will be valid for 24 hours. - required: true - schema: - type: string - maxLength: 40 - pattern: '^(?!\s)(.*)(\S)$' x-jws-signature: in: header name: x-jws-signature From d27d0cdfb937088de2669837c26aa2d5fe0263c9 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 15 Jul 2026 16:42:06 +0100 Subject: [PATCH 16/36] Refine CBPII changelog removed entries Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- changelog.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/changelog.md b/changelog.md index f710030..ea3fef8 100644 --- a/changelog.md +++ b/changelog.md @@ -31,8 +31,8 @@ For v4.0.1 the following approach has been adopted for identifying changes: ### Removed -- Removed **unused** CBPII components `404Error` and `Identification_0`. -- Removed **unused** CBPII component `x-idempotency-key` (CBPII has no idempotent endpoints). +- Removed **unused** CBPII response/schema components `404Error` and `Identification_0`. +- Removed **unused** CBPII header parameter `x-idempotency-key` (CBPII has no idempotent endpoints). ## v4.0.1 - 2026-04-01 From 64819821cfd56ff472204c28ca2f54f068af818b Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Fri, 17 Jul 2026 09:53:34 +0100 Subject: [PATCH 17/36] Refactor confirmation funds account ID enum Extract OBInternalAccountIdentification4Code into a reusable schema and update confirmation-of-funds SchemeName fields to reference it. Also link codeset descriptions to the specific source CSV files. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- dist/openapi/confirmation-funds-openapi.json | 38 ++++++++----------- dist/openapi/confirmation-funds-openapi.yaml | 40 ++++++++------------ 2 files changed, 32 insertions(+), 46 deletions(-) diff --git a/dist/openapi/confirmation-funds-openapi.json b/dist/openapi/confirmation-funds-openapi.json index 7cf7ea1..346cd6d 100644 --- a/dist/openapi/confirmation-funds-openapi.json +++ b/dist/openapi/confirmation-funds-openapi.json @@ -756,8 +756,20 @@ } } }, + "OBInternalAccountIdentification4Code": { + "description": "Name of the identification scheme, in a coded form as published in an external list. For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv)", + "type": "string", + "x-namespaced-enum": [ + "UK.OBIE.BBAN", + "UK.OBIE.IBAN", + "UK.OBIE.PAN", + "UK.OBIE.Paym", + "UK.OBIE.SortCodeAccountNumber", + "UK.OBIE.Wallet" + ] + }, "ExternalProxyAccountType1Code": { - "description": "Specifies the external proxy account type code, as published in the proxy account type external code set.
For a full list of values refer to `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", + "description": "Specifies the external proxy account type code, as published in the proxy account type external code set.
For a full list of values refer to `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/ISO_External_Codeset.csv)", "type": "string", "enum": [ "TELE", @@ -979,16 +991,7 @@ "description": "Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied.", "properties": { "SchemeName": { - "description": "Name of the identification scheme, in a coded form as published in an external list. For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", - "type": "string", - "x-namespaced-enum": [ - "UK.OBIE.BBAN", - "UK.OBIE.IBAN", - "UK.OBIE.PAN", - "UK.OBIE.Paym", - "UK.OBIE.SortCodeAccountNumber", - "UK.OBIE.Wallet" - ] + "$ref": "#/components/schemas/OBInternalAccountIdentification4Code" }, "Identification": { "description": "Identification assigned by an institution to identify an account. This identification is known by the account owner.", @@ -1073,16 +1076,7 @@ "description": "Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied.", "properties": { "SchemeName": { - "description": "Name of the identification scheme, in a coded form as published in an external list. For a full list of values refer to `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", - "type": "string", - "x-namespaced-enum": [ - "UK.OBIE.BBAN", - "UK.OBIE.IBAN", - "UK.OBIE.PAN", - "UK.OBIE.Paym", - "UK.OBIE.SortCodeAccountNumber", - "UK.OBIE.Wallet" - ] + "$ref": "#/components/schemas/OBInternalAccountIdentification4Code" }, "Identification": { "description": "Identification assigned by an institution to identify an account. This identification is known by the account owner.", @@ -1119,7 +1113,7 @@ "additionalProperties": false }, "OBInternalConsentStatus1Code": { - "description": "Specifies the status of consent resource in code form. For a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", + "description": "Specifies the status of consent resource in code form. For a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv)", "type": "string", "enum": [ "AWAU", diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 3c777ab..98500c8 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -518,11 +518,23 @@ components: description: Type of the proxy identification. minLength: 1 maxLength: 35 + OBInternalAccountIdentification4Code: + description: >- + Name of the identification scheme, in a coded form as published in an + external list. For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv) + type: string + x-namespaced-enum: + - UK.OBIE.BBAN + - UK.OBIE.IBAN + - UK.OBIE.PAN + - UK.OBIE.Paym + - UK.OBIE.SortCodeAccountNumber + - UK.OBIE.Wallet ExternalProxyAccountType1Code: description: >- Specifies the external proxy account type code, as published in the proxy account type external code set.
For a full list of values refer to - `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) + `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/ISO_External_Codeset.csv) type: string enum: - TELE @@ -739,17 +751,7 @@ components: a confirmation of funds consent will be applied. properties: SchemeName: - description: >- - Name of the identification scheme, in a coded form as - published in an external list. For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) - type: string - x-namespaced-enum: - - UK.OBIE.BBAN - - UK.OBIE.IBAN - - UK.OBIE.PAN - - UK.OBIE.Paym - - UK.OBIE.SortCodeAccountNumber - - UK.OBIE.Wallet + $ref: '#/components/schemas/OBInternalAccountIdentification4Code' Identification: description: >- Identification assigned by an institution to identify an @@ -857,17 +859,7 @@ components: a confirmation of funds consent will be applied. properties: SchemeName: - description: >- - Name of the identification scheme, in a coded form as - published in an external list. For a full list of values refer to `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) - type: string - x-namespaced-enum: - - UK.OBIE.BBAN - - UK.OBIE.IBAN - - UK.OBIE.PAN - - UK.OBIE.Paym - - UK.OBIE.SortCodeAccountNumber - - UK.OBIE.Wallet + $ref: '#/components/schemas/OBInternalAccountIdentification4Code' Identification: description: >- Identification assigned by an institution to identify an @@ -905,7 +897,7 @@ components: $ref: '#/components/schemas/Meta' additionalProperties: false OBInternalConsentStatus1Code: - description: Specifies the status of consent resource in code form. For a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) + description: Specifies the status of consent resource in code form. For a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv) type: string enum: - AWAU From 51c021a99efe040c30a607f7159e354599798fd5 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Fri, 17 Jul 2026 10:03:43 +0100 Subject: [PATCH 18/36] Add CBPII OpenAPI examples Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- changelog.md | 1 + dist/openapi/confirmation-funds-openapi.yaml | 265 ++++++++++++++++++- 2 files changed, 261 insertions(+), 5 deletions(-) diff --git a/changelog.md b/changelog.md index ea3fef8..7180de3 100644 --- a/changelog.md +++ b/changelog.md @@ -21,6 +21,7 @@ For v4.0.1 the following approach has been adopted for identifying changes: - Added CBPII OpenAPI tags for `Funds Confirmation Consents` and `Funds Confirmations` to improve Swagger UI grouping and navigation. - Added optional `x-jws-signature` request header support across all CBPII operations to align with the Open Banking spec pages/standard. - Added optional `x-jws-signature` response header support across CBPII success and error responses to align with the Open Banking spec pages/standard. +- Added reusable CBPII OpenAPI examples for successful request/response payloads, key parameters, and error payloads. ### Changed diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 2f841a7..d953e79 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -44,6 +44,9 @@ paths: application/json: schema: $ref: '#/components/schemas/OBFundsConfirmationConsent1' + examples: + FundsConfirmationConsentCreateRequest: + $ref: '#/components/examples/FundsConfirmationConsentCreateRequest' description: Default required: true responses: @@ -176,6 +179,11 @@ paths: application/json: schema: $ref: '#/components/schemas/OBFundsConfirmation1' + examples: + FundsConfirmationCreateRequest: + $ref: '#/components/examples/FundsConfirmationCreateRequest' + FundsConfirmationUsdRequest: + $ref: '#/components/examples/FundsConfirmationUsdRequest' description: Default required: true responses: @@ -211,6 +219,7 @@ components: required: true schema: type: string + example: FCC-20260401-0001 Authorization: in: header name: Authorization @@ -218,6 +227,7 @@ components: description: An Authorisation Token as per schema: type: string + example: Bearer x-customer-user-agent: in: header name: x-customer-user-agent @@ -225,6 +235,7 @@ components: required: false schema: type: string + example: Mozilla/5.0 (Example PSU Device) x-fapi-customer-ip-address: in: header name: x-fapi-customer-ip-address @@ -232,6 +243,7 @@ components: description: The PSU's IP address if the PSU is currently logged in with the TPP. schema: type: string + example: 203.0.113.42 x-fapi-auth-date: in: header name: x-fapi-auth-date @@ -245,6 +257,7 @@ components: schema: type: string pattern: '^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} (GMT|UTC)$' + example: Wed, 01 Apr 2026 10:15:30 GMT x-fapi-interaction-id: in: header name: x-fapi-interaction-id @@ -252,6 +265,7 @@ components: description: An RFC4122 UID used as a correlation id. schema: type: string + example: 93bac548-d2de-4546-b106-880a5018460d x-jws-signature: in: header name: x-jws-signature @@ -259,6 +273,7 @@ components: description: A detached JWS signature of the body of the payload. schema: type: string + example: eyJ...header.eyJ...payload.signature x-client-id: in: header name: x-client-id @@ -271,6 +286,7 @@ components: This header __must not__ be used for client authentication schema: type: string + example: cbpii-client-12345 headers: RateLimit-Policy: required: false @@ -287,6 +303,7 @@ components: The **OPTIONAL** "w" parameter value conveys a time window. schema: type: string + example: '"default";q=100;w=10' RateLimit: required: false description: |- @@ -302,11 +319,172 @@ components: The **OPTIONAL** "t" parameter value conveys the time window reset time for the identified policy. schema: type: string + example: '"default";r=50;t=30' x-jws-signature: required: false description: A detached JWS signature of the body of the payload. schema: type: string + example: eyJ...header.eyJ...payload.signature + examples: + FundsConfirmationConsentCreateRequest: + summary: Create a funds-confirmation consent + value: + Data: + ExpirationDateTime: '2026-10-01T10:15:30+00:00' + DebtorAccount: + SchemeName: UK.OBIE.SortCodeAccountNumber + Identification: '30949301273801' + Name: Jane Smith + SecondaryIdentification: Roll 56988 + Proxy: + Identification: '+441632960540' + Code: TELE + Type: Telephone + FundsConfirmationConsentCreateResponse: + summary: Funds-confirmation consent awaiting authorisation + value: + Data: + ConsentId: FCC-20260401-0001 + CreationDateTime: '2026-04-01T10:15:30+00:00' + Status: AWAU + StatusUpdateDateTime: '2026-04-01T10:15:30+00:00' + ExpirationDateTime: '2026-10-01T10:15:30+00:00' + DebtorAccount: + SchemeName: UK.OBIE.SortCodeAccountNumber + Identification: '30949301273801' + Name: Jane Smith + SecondaryIdentification: Roll 56988 + Proxy: + Identification: '+441632960540' + Code: TELE + Type: Telephone + Links: + Self: https://api.alphabank.com/open-banking/v4.0/cbpii/funds-confirmation-consents/FCC-20260401-0001 + Meta: {} + FundsConfirmationConsentReadAuthorisedResponse: + summary: Authorised funds-confirmation consent + value: + Data: + ConsentId: FCC-20260401-0001 + CreationDateTime: '2026-04-01T10:15:30+00:00' + Status: AUTH + StatusUpdateDateTime: '2026-04-01T10:20:30+00:00' + ExpirationDateTime: '2026-10-01T10:15:30+00:00' + DebtorAccount: + SchemeName: UK.OBIE.SortCodeAccountNumber + Identification: '30949301273801' + Name: Jane Smith + SecondaryIdentification: Roll 56988 + Proxy: + Identification: '+441632960540' + Code: TELE + Type: Telephone + Links: + Self: https://api.alphabank.com/open-banking/v4.0/cbpii/funds-confirmation-consents/FCC-20260401-0001 + Meta: {} + FundsConfirmationConsentReadMaskedPanResponse: + summary: Authorised funds-confirmation consent with masked PAN + description: ASPSPs may partially mask the account identification when returning PAN account details on GET. + value: + Data: + ConsentId: FCC-20260401-0002 + CreationDateTime: '2026-04-01T10:15:30+00:00' + Status: AUTH + StatusUpdateDateTime: '2026-04-01T10:20:30+00:00' + ExpirationDateTime: '2026-10-01T10:15:30+00:00' + DebtorAccount: + SchemeName: UK.OBIE.PAN + Identification: '4444********1111' + Name: Jane Smith + SecondaryIdentification: '008419' + Proxy: + Identification: '+441632960540' + Code: TELE + Type: Telephone + Links: + Self: https://api.alphabank.com/open-banking/v4.0/cbpii/funds-confirmation-consents/FCC-20260401-0002 + Meta: {} + FundsConfirmationCreateRequest: + summary: Create a funds-confirmation request + value: + Data: + ConsentId: FCC-20260401-0001 + Reference: CARD-PURCHASE-001 + InstructedAmount: + Amount: '20.00' + Currency: GBP + FundsConfirmationCreateResponse: + summary: Funds are available for the card purchase + value: + Data: + FundsConfirmationId: FC-20260401-0001 + ConsentId: FCC-20260401-0001 + CreationDateTime: '2026-04-01T10:25:30+00:00' + FundsAvailable: true + Reference: CARD-PURCHASE-001 + InstructedAmount: + Amount: '20.00' + Currency: GBP + Links: + Self: https://api.alphabank.com/open-banking/v4.0/cbpii/funds-confirmations/FC-20260401-0001 + Meta: {} + FundsConfirmationUsdRequest: + summary: Create a funds-confirmation request for a USD account + description: Funds can be confirmed in USD only where the underlying payment account currency is USD. + value: + Data: + ConsentId: FCC-20260401-USD1 + Reference: CARD-PURCHASE-USD + InstructedAmount: + Amount: '20.00' + Currency: USD + FundsConfirmationUsdResponse: + summary: Funds are available for the USD card purchase + description: Funds can be confirmed in USD only where the underlying payment account currency is USD. + value: + Data: + FundsConfirmationId: FC-20260401-USD1 + ConsentId: FCC-20260401-USD1 + CreationDateTime: '2026-04-01T10:25:30+00:00' + FundsAvailable: true + Reference: CARD-PURCHASE-USD + InstructedAmount: + Amount: '20.00' + Currency: USD + Links: + Self: https://api.alphabank.com/open-banking/v4.0/cbpii/funds-confirmations/FC-20260401-USD1 + Meta: {} + Error400InvalidField: + summary: Invalid field value + value: + Code: UK.OBIE.Field.Invalid + Message: One or more request fields are invalid. + Errors: + - ErrorCode: U002 + Message: InstructedAmount.Currency must match the currency of the underlying payment account. + Path: Data.InstructedAmount.Currency + Url: https://docs.alphabank.com/open-banking/errors/U002 + Error403InvalidConsentStatus: + summary: Consent is not authorised for funds confirmation + value: + Code: UK.OBIE.Resource.InvalidConsentStatus + Message: The consent is not in a status that allows funds confirmation. + Errors: + - ErrorCode: U009 + Message: The funds-confirmation consent is not authorised for this request. + Path: Data.ConsentId + Url: https://docs.alphabank.com/open-banking/errors/U009 + Error500Unexpected: + summary: Unexpected processing error + value: + Id: ERR-20260401-0001 + Code: UK.OBIE.UnexpectedError + Message: An unexpected error occurred while processing the request. + Errors: + - ErrorCode: U000 + Message: The ASPSP could not complete the request due to an unexpected processing error. + Url: https://docs.alphabank.com/open-banking/errors/U000 responses: 201FundsConfirmationConsentsCreated: description: Funds Confirmation Consent Created @@ -326,9 +504,15 @@ components: application/json; charset=utf-8: schema: $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1' + examples: + FundsConfirmationConsentCreateResponse: + $ref: '#/components/examples/FundsConfirmationConsentCreateResponse' application/json: schema: $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1' + examples: + FundsConfirmationConsentCreateResponse: + $ref: '#/components/examples/FundsConfirmationConsentCreateResponse' application/jose+jwe: schema: $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1' @@ -350,9 +534,19 @@ components: application/json; charset=utf-8: schema: $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1' + examples: + FundsConfirmationConsentReadAuthorisedResponse: + $ref: '#/components/examples/FundsConfirmationConsentReadAuthorisedResponse' + FundsConfirmationConsentReadMaskedPanResponse: + $ref: '#/components/examples/FundsConfirmationConsentReadMaskedPanResponse' application/json: schema: $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1' + examples: + FundsConfirmationConsentReadAuthorisedResponse: + $ref: '#/components/examples/FundsConfirmationConsentReadAuthorisedResponse' + FundsConfirmationConsentReadMaskedPanResponse: + $ref: '#/components/examples/FundsConfirmationConsentReadMaskedPanResponse' application/jose+jwe: schema: $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1' @@ -388,9 +582,19 @@ components: application/json; charset=utf-8: schema: $ref: '#/components/schemas/OBFundsConfirmationResponse1' + examples: + FundsConfirmationCreateResponse: + $ref: '#/components/examples/FundsConfirmationCreateResponse' + FundsConfirmationUsdResponse: + $ref: '#/components/examples/FundsConfirmationUsdResponse' application/json: schema: $ref: '#/components/schemas/OBFundsConfirmationResponse1' + examples: + FundsConfirmationCreateResponse: + $ref: '#/components/examples/FundsConfirmationCreateResponse' + FundsConfirmationUsdResponse: + $ref: '#/components/examples/FundsConfirmationUsdResponse' application/jose+jwe: schema: $ref: '#/components/schemas/OBFundsConfirmationResponse1' @@ -408,9 +612,15 @@ components: application/json; charset=utf-8: schema: $ref: '#/components/schemas/OBErrorResponse1' + examples: + Error400InvalidField: + $ref: '#/components/examples/Error400InvalidField' application/json: schema: $ref: '#/components/schemas/OBErrorResponse1' + examples: + Error400InvalidField: + $ref: '#/components/examples/Error400InvalidField' application/jose+jwe: schema: $ref: '#/components/schemas/OBErrorResponse1' @@ -438,9 +648,15 @@ components: application/json; charset=utf-8: schema: $ref: '#/components/schemas/OBErrorResponse1' + examples: + Error403InvalidConsentStatus: + $ref: '#/components/examples/Error403InvalidConsentStatus' application/json: schema: $ref: '#/components/schemas/OBErrorResponse1' + examples: + Error403InvalidConsentStatus: + $ref: '#/components/examples/Error403InvalidConsentStatus' application/jose+jwe: schema: $ref: '#/components/schemas/OBErrorResponse1' @@ -501,9 +717,15 @@ components: application/json; charset=utf-8: schema: $ref: '#/components/schemas/OBErrorResponse1' + examples: + Error500Unexpected: + $ref: '#/components/examples/Error500Unexpected' application/json: schema: $ref: '#/components/schemas/OBErrorResponse1' + examples: + Error500Unexpected: + $ref: '#/components/examples/Error500Unexpected' application/jose+jwe: schema: $ref: '#/components/schemas/OBErrorResponse1' @@ -548,6 +770,7 @@ components: type: string minLength: 1 maxLength: 2048 + example: '+441632960540' Code: $ref: '#/components/schemas/ExternalProxyAccountType1Code' Type: @@ -555,6 +778,7 @@ components: description: Type of the proxy identification. minLength: 1 maxLength: 35 + example: Telephone ExternalProxyAccountType1Code: description: |- Specifies the external proxy account type code, as published in the proxy account type external code set. @@ -583,6 +807,7 @@ components: - UBIL - VIPN - BIID + example: TELE ISODateTime: description: |- All dates in the JSON payloads are represented in ISO 8601 date-time format. @@ -640,14 +865,17 @@ components: type: string minLength: 1 maxLength: 500 + example: InstructedAmount.Currency must match the currency of the underlying payment account. Path: - description: Recommended but optional reference to the JSON Path of the field with error, e.g., `Data.Initiation.InstructedAmount.Currency` + description: Recommended but optional reference to the JSON Path of the field with error, e.g., `Data.InstructedAmount.Currency` type: string minLength: 1 maxLength: 500 + example: Data.InstructedAmount.Currency Url: description: URL to help remediate the problem, or provide more information, or to API Reference, or help etc type: string + example: https://docs.alphabank.com/open-banking/errors/U002 required: - ErrorCode additionalProperties: false @@ -668,7 +896,7 @@ components: High level textual error code, to help categorise the errors. type: string minLength: 1 - example: 400 BadRequest + example: UK.OBIE.Field.Invalid maxLength: 40 Message: description: |- @@ -677,7 +905,7 @@ components: Brief Error message type: string minLength: 1 - example: There is something wrong with the request parameters provided + example: One or more request fields are invalid. maxLength: 500 Errors: items: @@ -704,11 +932,13 @@ components: type: string minLength: 1 maxLength: 128 + example: FCC-20260401-0001 Reference: description: Unique reference, as assigned by the CBPII, to unambiguously refer to the request related to the payment transaction. type: string minLength: 1 maxLength: 35 + example: CARD-PURCHASE-001 InstructedAmount: type: object required: @@ -720,10 +950,12 @@ components: description: A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217. type: string pattern: '^\d{1,13}$|^\d{1,13}\.\d{1,5}$' + example: '20.00' Currency: description: A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". type: string pattern: '^[A-Z]{3,3}$' + example: GBP additionalProperties: false OBFundsConfirmationConsent1: type: object @@ -746,6 +978,7 @@ components: `2017-04-05T10:43:07+00:00` type: string format: date-time + example: '2026-10-01T10:15:30+00:00' DebtorAccount: type: object required: @@ -766,11 +999,13 @@ components: - UK.OBIE.Paym - UK.OBIE.SortCodeAccountNumber - UK.OBIE.Wallet + example: UK.OBIE.SortCodeAccountNumber Identification: description: Identification assigned by an institution to identify an account. This identification is known by the account owner. type: string minLength: 1 maxLength: 256 + example: '30949301273801' Name: description: |- Name of the account, as assigned by the account servicing institution. @@ -779,6 +1014,7 @@ components: type: string minLength: 1 maxLength: 350 + example: Jane Smith SecondaryIdentification: description: |- This is secondary identification of the account, as assigned by the account servicing institution. @@ -787,6 +1023,7 @@ components: type: string minLength: 1 maxLength: 34 + example: Roll 56988 Proxy: $ref: '#/components/schemas/OBProxy1' additionalProperties: false @@ -809,6 +1046,7 @@ components: type: string minLength: 1 maxLength: 128 + example: FCC-20260401-0001 CreationDateTime: description: |- Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. @@ -818,6 +1056,7 @@ components: `2017-04-05T10:43:07+00:00` type: string format: date-time + example: '2026-04-01T10:15:30+00:00' Status: $ref: '#/components/schemas/OBInternalConsentStatus1Code' StatusReason: @@ -833,6 +1072,7 @@ components: `2017-04-05T10:43:07+00:00` type: string format: date-time + example: '2026-04-01T10:20:30+00:00' ExpirationDateTime: description: |- Specified date and time the funds confirmation authorisation will expire. @@ -844,6 +1084,7 @@ components: `2017-04-05T10:43:07+00:00` type: string format: date-time + example: '2026-10-01T10:15:30+00:00' DebtorAccount: type: object required: @@ -864,11 +1105,13 @@ components: - UK.OBIE.Paym - UK.OBIE.SortCodeAccountNumber - UK.OBIE.Wallet + example: UK.OBIE.SortCodeAccountNumber Identification: description: Identification assigned by an institution to identify an account. This identification is known by the account owner. type: string minLength: 1 maxLength: 256 + example: '30949301273801' Name: description: |- Name of the account, as assigned by the account servicing institution. @@ -877,6 +1120,7 @@ components: type: string minLength: 1 maxLength: 350 + example: Jane Smith SecondaryIdentification: description: |- This is secondary identification of the account, as assigned by the account servicing institution. @@ -885,6 +1129,7 @@ components: type: string minLength: 1 maxLength: 34 + example: Roll 56988 Proxy: $ref: '#/components/schemas/OBProxy1' Links: @@ -904,6 +1149,7 @@ components: - AUTH - CANC - EXPD + example: AUTH OBFundsConfirmationResponse1: type: object required: @@ -924,11 +1170,13 @@ components: type: string minLength: 1 maxLength: 40 + example: FC-20260401-0001 ConsentId: description: Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation consent resource. type: string minLength: 1 maxLength: 128 + example: FCC-20260401-0001 CreationDateTime: description: |- Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. @@ -938,14 +1186,17 @@ components: `2017-04-05T10:43:07+00:00` type: string format: date-time + example: '2026-04-01T10:25:30+00:00' FundsAvailable: description: Flag to indicate the result of a confirmation of funds check. type: boolean + example: true Reference: description: Unique reference, as assigned by the CBPII, to unambiguously refer to the request related to the payment transaction. type: string minLength: 1 maxLength: 35 + example: CARD-PURCHASE-001 InstructedAmount: type: object required: @@ -957,10 +1208,12 @@ components: description: A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217. type: string pattern: '^\d{1,13}$|^\d{1,13}\.\d{1,5}$' + example: '20.00' Currency: description: A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". type: string pattern: '^[A-Z]{3,3}$' + example: GBP Links: $ref: '#/components/schemas/Links' Meta: @@ -974,7 +1227,7 @@ components: type: string minLength: 4 maxLength: 4 - example: U001 + example: U002 OBStatusReason: type: object properties: @@ -986,14 +1239,16 @@ components: For a full list of values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) minLength: 1 maxLength: 4 - example: ERIN + example: U009 StatusReasonDescription: description: Description supporting the `StatusReasonCode`. type: string minLength: 1 maxLength: 500 + example: The consent is not in a status that allows funds confirmation. Path: type: string description: Optional reference to the JSON Path of the field when status reason refers to an object/field, e.g., `Data.DebtorAccount.SchemeName` minLength: 1 maxLength: 500 + example: Data.ConsentId From 215c32153b7b9db7e5acf17d599759c69c6b2f0c Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Fri, 17 Jul 2026 10:15:28 +0100 Subject: [PATCH 19/36] Remove confirmation funds JSON changes Restore the generated JSON spec to the PR base version so this PR only changes the YAML spec. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- dist/openapi/confirmation-funds-openapi.json | 38 +++++++++++--------- 1 file changed, 22 insertions(+), 16 deletions(-) diff --git a/dist/openapi/confirmation-funds-openapi.json b/dist/openapi/confirmation-funds-openapi.json index 346cd6d..7cf7ea1 100644 --- a/dist/openapi/confirmation-funds-openapi.json +++ b/dist/openapi/confirmation-funds-openapi.json @@ -756,20 +756,8 @@ } } }, - "OBInternalAccountIdentification4Code": { - "description": "Name of the identification scheme, in a coded form as published in an external list. For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv)", - "type": "string", - "x-namespaced-enum": [ - "UK.OBIE.BBAN", - "UK.OBIE.IBAN", - "UK.OBIE.PAN", - "UK.OBIE.Paym", - "UK.OBIE.SortCodeAccountNumber", - "UK.OBIE.Wallet" - ] - }, "ExternalProxyAccountType1Code": { - "description": "Specifies the external proxy account type code, as published in the proxy account type external code set.
For a full list of values refer to `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/ISO_External_Codeset.csv)", + "description": "Specifies the external proxy account type code, as published in the proxy account type external code set.
For a full list of values refer to `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", "type": "string", "enum": [ "TELE", @@ -991,7 +979,16 @@ "description": "Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied.", "properties": { "SchemeName": { - "$ref": "#/components/schemas/OBInternalAccountIdentification4Code" + "description": "Name of the identification scheme, in a coded form as published in an external list. For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", + "type": "string", + "x-namespaced-enum": [ + "UK.OBIE.BBAN", + "UK.OBIE.IBAN", + "UK.OBIE.PAN", + "UK.OBIE.Paym", + "UK.OBIE.SortCodeAccountNumber", + "UK.OBIE.Wallet" + ] }, "Identification": { "description": "Identification assigned by an institution to identify an account. This identification is known by the account owner.", @@ -1076,7 +1073,16 @@ "description": "Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied.", "properties": { "SchemeName": { - "$ref": "#/components/schemas/OBInternalAccountIdentification4Code" + "description": "Name of the identification scheme, in a coded form as published in an external list. For a full list of values refer to `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", + "type": "string", + "x-namespaced-enum": [ + "UK.OBIE.BBAN", + "UK.OBIE.IBAN", + "UK.OBIE.PAN", + "UK.OBIE.Paym", + "UK.OBIE.SortCodeAccountNumber", + "UK.OBIE.Wallet" + ] }, "Identification": { "description": "Identification assigned by an institution to identify an account. This identification is known by the account owner.", @@ -1113,7 +1119,7 @@ "additionalProperties": false }, "OBInternalConsentStatus1Code": { - "description": "Specifies the status of consent resource in code form. For a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv)", + "description": "Specifies the status of consent resource in code form. For a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", "type": "string", "enum": [ "AWAU", From c0db4df9543f55a5b4ad168ff5ef176a6698f842 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Fri, 17 Jul 2026 10:16:07 +0100 Subject: [PATCH 20/36] Tidy confirmation funds enum descriptions Use the existing multiline description style for the reusable account identification codeset description. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- dist/openapi/confirmation-funds-openapi.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 4d15961..b19b7bc 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -556,9 +556,10 @@ components: minLength: 1 maxLength: 35 OBInternalAccountIdentification4Code: - description: >- - Name of the identification scheme, in a coded form as published in an - external list. For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv) + description: |- + Name of the identification scheme, in a coded form as published in an external list. + + For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv) type: string x-namespaced-enum: - UK.OBIE.BBAN From bd65d271e01c5807b7ed13979c027852669e6b9f Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Fri, 17 Jul 2026 10:22:15 +0100 Subject: [PATCH 21/36] Update CBPII enum changelog entries Document direct codeset CSV links and the reusable OBInternalAccountIdentification4Code schema refactor. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- changelog.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/changelog.md b/changelog.md index ea3fef8..adb4c94 100644 --- a/changelog.md +++ b/changelog.md @@ -28,6 +28,8 @@ For v4.0.1 the following approach has been adopted for identifying changes: - Standardised CBPII OpenAPI description formatting for consistency (single-line where suitable, `>-`/`|-` block scalar usage where appropriate, paragraph spacing, inline code formatting, and emphasised notes). - Updated CBPII security scheme descriptions to align with Open Banking/FAPI context and clarify `Authorization` header usage. - Updated `x-jws-signature` to be optional in CBPII request/response modelling to align with the Open Banking spec pages/standard. +- Updated CBPII enum descriptions to link directly to the relevant codeset CSV files. +- Refactored CBPII `OBInternalAccountIdentification4Code` into a reusable schema reference. ### Removed From fd45bb620dbf9e54a8dda514bbc4d751837b2f39 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Fri, 17 Jul 2026 11:38:53 +0100 Subject: [PATCH 22/36] Refactor CBPII confirmation funds schemas Extract CBPII Confirmation of Funds inline data dictionary schemas into reusable OpenAPI components and document the mapping in the changelog. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- changelog.md | 9 + dist/openapi/confirmation-funds-openapi.yaml | 391 +++++++++---------- 2 files changed, 191 insertions(+), 209 deletions(-) diff --git a/changelog.md b/changelog.md index adb4c94..2647e6c 100644 --- a/changelog.md +++ b/changelog.md @@ -30,6 +30,15 @@ For v4.0.1 the following approach has been adopted for identifying changes: - Updated `x-jws-signature` to be optional in CBPII request/response modelling to align with the Open Banking spec pages/standard. - Updated CBPII enum descriptions to link directly to the relevant codeset CSV files. - Refactored CBPII `OBInternalAccountIdentification4Code` into a reusable schema reference. +- Refactored CBPII Confirmation of Funds OpenAPI data dictionary schemas to use reusable component references aligned to the spec pages: + - `OBFundsConfirmationConsent1/Data` now references `OBFundsConfirmationConsentData1` + - `OBFundsConfirmationConsentResponse1/Data` now references `OBFundsConfirmationConsentDataResponse1` + - `OBFundsConfirmation1/Data` now references `OBFundsConfirmationData1` + - `OBFundsConfirmationResponse1/Data` now references `OBFundsConfirmationDataResponse1` + - `OBFundsConfirmationConsent1/Data/DebtorAccount` and `OBFundsConfirmationConsentResponse1/Data/DebtorAccount` now reference `OBCashAccountDebtorWithName` + - `OBFundsConfirmation1/Data/InstructedAmount` and `OBFundsConfirmationResponse1/Data/InstructedAmount` now reference `OBActiveOrHistoricCurrencyAndAmount` + - `OBFundsConfirmation1/Data/InstructedAmount/Amount` and `OBFundsConfirmationResponse1/Data/InstructedAmount/Amount` now reference `OBActiveCurrencyAndAmount_SimpleType` + - `OBFundsConfirmation1/Data/InstructedAmount/Currency` and `OBFundsConfirmationResponse1/Data/InstructedAmount/Currency` now reference `ActiveOrHistoricCurrencyCode` ### Removed diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index b19b7bc..941d989 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -555,6 +555,38 @@ components: description: Type of the proxy identification. minLength: 1 maxLength: 35 + OBCashAccountDebtorWithName: + type: object + required: + - SchemeName + - Identification + description: Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied. + properties: + SchemeName: + $ref: '#/components/schemas/OBInternalAccountIdentification4Code' + Identification: + description: Identification assigned by an institution to identify an account. This identification is known by the account owner. + type: string + minLength: 1 + maxLength: 256 + Name: + description: |- + Name of the account, as assigned by the account servicing institution. + + Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account. + type: string + minLength: 1 + maxLength: 350 + SecondaryIdentification: + description: |- + This is secondary identification of the account, as assigned by the account servicing institution. + + This can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination). + type: string + minLength: 1 + maxLength: 34 + Proxy: + $ref: '#/components/schemas/OBProxy1' OBInternalAccountIdentification4Code: description: |- Name of the identification scheme, in a coded form as published in an external list. @@ -605,6 +637,25 @@ components: `2017-04-05T10:43:07+00:00` type: string format: date-time + OBActiveOrHistoricCurrencyAndAmount: + type: object + required: + - Amount + - Currency + description: Amount of money to be confirmed as available funds in the debtor account. Contains an `Amount` and a `Currency`. + properties: + Amount: + $ref: '#/components/schemas/OBActiveCurrencyAndAmount_SimpleType' + Currency: + $ref: '#/components/schemas/ActiveOrHistoricCurrencyCode' + OBActiveCurrencyAndAmount_SimpleType: + description: A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217. + type: string + pattern: '^\d{1,13}$|^\d{1,13}\.\d{1,5}$' + ActiveOrHistoricCurrencyCode: + description: A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". + type: string + pattern: '^[A-Z]{3,3}$' Links: type: object description: Links relevant to the payload @@ -706,183 +757,116 @@ components: - Data properties: Data: - type: object - required: - - ConsentId - - Reference - - InstructedAmount - properties: - ConsentId: - description: Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation consent resource. - type: string - minLength: 1 - maxLength: 128 - Reference: - description: Unique reference, as assigned by the CBPII, to unambiguously refer to the request related to the payment transaction. - type: string - minLength: 1 - maxLength: 35 - InstructedAmount: - type: object - required: - - Amount - - Currency - description: Amount of money to be confirmed as available funds in the debtor account. Contains an `Amount` and a `Currency`. - properties: - Amount: - description: A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217. - type: string - pattern: '^\d{1,13}$|^\d{1,13}\.\d{1,5}$' - Currency: - description: A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". - type: string - pattern: '^[A-Z]{3,3}$' + $ref: '#/components/schemas/OBFundsConfirmationData1' additionalProperties: false + OBFundsConfirmationData1: + type: object + required: + - ConsentId + - Reference + - InstructedAmount + properties: + ConsentId: + description: Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation consent resource. + type: string + minLength: 1 + maxLength: 128 + Reference: + description: Unique reference, as assigned by the CBPII, to unambiguously refer to the request related to the payment transaction. + type: string + minLength: 1 + maxLength: 35 + InstructedAmount: + $ref: '#/components/schemas/OBActiveOrHistoricCurrencyAndAmount' OBFundsConfirmationConsent1: type: object required: - Data properties: Data: - type: object - required: - - DebtorAccount - properties: - ExpirationDateTime: - description: |- - Specified date and time the funds confirmation authorisation will expire. - - If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. - - All date-time fields in responses must include the timezone. An example is below: - - `2017-04-05T10:43:07+00:00` - type: string - format: date-time - DebtorAccount: - type: object - required: - - SchemeName - - Identification - description: Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied. - properties: - SchemeName: - $ref: '#/components/schemas/OBInternalAccountIdentification4Code' - Identification: - description: Identification assigned by an institution to identify an account. This identification is known by the account owner. - type: string - minLength: 1 - maxLength: 256 - Name: - description: |- - Name of the account, as assigned by the account servicing institution. - - Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account. - type: string - minLength: 1 - maxLength: 350 - SecondaryIdentification: - description: |- - This is secondary identification of the account, as assigned by the account servicing institution. - - This can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination). - type: string - minLength: 1 - maxLength: 34 - Proxy: - $ref: '#/components/schemas/OBProxy1' + $ref: '#/components/schemas/OBFundsConfirmationConsentData1' additionalProperties: false + OBFundsConfirmationConsentData1: + type: object + required: + - DebtorAccount + properties: + ExpirationDateTime: + description: |- + Specified date and time the funds confirmation authorisation will expire. + + If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. + + All date-time fields in responses must include the timezone. An example is below: + + `2017-04-05T10:43:07+00:00` + type: string + format: date-time + DebtorAccount: + $ref: '#/components/schemas/OBCashAccountDebtorWithName' OBFundsConfirmationConsentResponse1: type: object required: - Data properties: Data: - type: object - required: - - ConsentId - - CreationDateTime - - Status - - StatusUpdateDateTime - - DebtorAccount - properties: - ConsentId: - description: Unique identification as assigned to identify the funds confirmation consent resource. - type: string - minLength: 1 - maxLength: 128 - CreationDateTime: - description: |- - Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. - - All date-time fields in responses must include the timezone. An example is below: - - `2017-04-05T10:43:07+00:00` - type: string - format: date-time - Status: - $ref: '#/components/schemas/OBInternalConsentStatus1Code' - StatusReason: - type: array - items: - $ref: '#/components/schemas/OBStatusReason' - StatusUpdateDateTime: - description: |- - Date and time at which the resource status was updated. All dates in the JSON payloads are represented in ISO 8601 date-time format. - - All date-time fields in responses must include the timezone. An example is below: - - `2017-04-05T10:43:07+00:00` - type: string - format: date-time - ExpirationDateTime: - description: |- - Specified date and time the funds confirmation authorisation will expire. - - If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. - - All date-time fields in responses must include the timezone. An example is below: - - `2017-04-05T10:43:07+00:00` - type: string - format: date-time - DebtorAccount: - type: object - required: - - SchemeName - - Identification - description: Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied. - properties: - SchemeName: - $ref: '#/components/schemas/OBInternalAccountIdentification4Code' - Identification: - description: Identification assigned by an institution to identify an account. This identification is known by the account owner. - type: string - minLength: 1 - maxLength: 256 - Name: - description: |- - Name of the account, as assigned by the account servicing institution. - - Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account. - type: string - minLength: 1 - maxLength: 350 - SecondaryIdentification: - description: |- - This is secondary identification of the account, as assigned by the account servicing institution. - - This can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination). - type: string - minLength: 1 - maxLength: 34 - Proxy: - $ref: '#/components/schemas/OBProxy1' + $ref: '#/components/schemas/OBFundsConfirmationConsentDataResponse1' Links: $ref: '#/components/schemas/Links' Meta: $ref: '#/components/schemas/Meta' additionalProperties: false + OBFundsConfirmationConsentDataResponse1: + type: object + required: + - ConsentId + - CreationDateTime + - Status + - StatusUpdateDateTime + - DebtorAccount + properties: + ConsentId: + description: Unique identification as assigned to identify the funds confirmation consent resource. + type: string + minLength: 1 + maxLength: 128 + CreationDateTime: + description: |- + Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. + + All date-time fields in responses must include the timezone. An example is below: + + `2017-04-05T10:43:07+00:00` + type: string + format: date-time + Status: + $ref: '#/components/schemas/OBInternalConsentStatus1Code' + StatusReason: + type: array + items: + $ref: '#/components/schemas/OBStatusReason' + StatusUpdateDateTime: + description: |- + Date and time at which the resource status was updated. All dates in the JSON payloads are represented in ISO 8601 date-time format. + + All date-time fields in responses must include the timezone. An example is below: + + `2017-04-05T10:43:07+00:00` + type: string + format: date-time + ExpirationDateTime: + description: |- + Specified date and time the funds confirmation authorisation will expire. + + If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. + + All date-time fields in responses must include the timezone. An example is below: + + `2017-04-05T10:43:07+00:00` + type: string + format: date-time + DebtorAccount: + $ref: '#/components/schemas/OBCashAccountDebtorWithName' OBInternalConsentStatus1Code: description: |- Specifies the status of consent resource in code form. @@ -901,62 +885,51 @@ components: - Data properties: Data: - type: object - required: - - FundsConfirmationId - - ConsentId - - CreationDateTime - - FundsAvailable - - Reference - - InstructedAmount - properties: - FundsConfirmationId: - description: Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation resource. - type: string - minLength: 1 - maxLength: 40 - ConsentId: - description: Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation consent resource. - type: string - minLength: 1 - maxLength: 128 - CreationDateTime: - description: |- - Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. - - All date-time fields in responses must include the timezone. An example is below: - - `2017-04-05T10:43:07+00:00` - type: string - format: date-time - FundsAvailable: - description: Flag to indicate the result of a confirmation of funds check. - type: boolean - Reference: - description: Unique reference, as assigned by the CBPII, to unambiguously refer to the request related to the payment transaction. - type: string - minLength: 1 - maxLength: 35 - InstructedAmount: - type: object - required: - - Amount - - Currency - description: Amount of money to be confirmed as available funds in the debtor account. Contains an `Amount` and a `Currency`. - properties: - Amount: - description: A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217. - type: string - pattern: '^\d{1,13}$|^\d{1,13}\.\d{1,5}$' - Currency: - description: A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 "Codes for the representation of currencies and funds". - type: string - pattern: '^[A-Z]{3,3}$' + $ref: '#/components/schemas/OBFundsConfirmationDataResponse1' Links: $ref: '#/components/schemas/Links' Meta: $ref: '#/components/schemas/Meta' additionalProperties: false + OBFundsConfirmationDataResponse1: + type: object + required: + - FundsConfirmationId + - ConsentId + - CreationDateTime + - FundsAvailable + - Reference + - InstructedAmount + properties: + FundsConfirmationId: + description: Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation resource. + type: string + minLength: 1 + maxLength: 40 + ConsentId: + description: Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation consent resource. + type: string + minLength: 1 + maxLength: 128 + CreationDateTime: + description: |- + Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. + + All date-time fields in responses must include the timezone. An example is below: + + `2017-04-05T10:43:07+00:00` + type: string + format: date-time + FundsAvailable: + description: Flag to indicate the result of a confirmation of funds check. + type: boolean + Reference: + description: Unique reference, as assigned by the CBPII, to unambiguously refer to the request related to the payment transaction. + type: string + minLength: 1 + maxLength: 35 + InstructedAmount: + $ref: '#/components/schemas/OBActiveOrHistoricCurrencyAndAmount' OBExternalStatusReason1Code: description: |- Low level textual error code. From 3f89f2a674efa6cde4ef1c51cc5f4dac6d093a04 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Fri, 17 Jul 2026 13:43:10 +0100 Subject: [PATCH 23/36] Remove manual CBPII payload examples Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- changelog.md | 2 +- dist/openapi/confirmation-funds-openapi.yaml | 211 ------------------- 2 files changed, 1 insertion(+), 212 deletions(-) diff --git a/changelog.md b/changelog.md index e2ea18f..82efb5d 100644 --- a/changelog.md +++ b/changelog.md @@ -21,7 +21,7 @@ For v4.0.1 the following approach has been adopted for identifying changes: - Added CBPII OpenAPI tags for `Funds Confirmation Consents` and `Funds Confirmations` to improve Swagger UI grouping and navigation. - Added optional `x-jws-signature` request header support across all CBPII operations to align with the Open Banking spec pages/standard. - Added optional `x-jws-signature` response header support across CBPII success and error responses to align with the Open Banking spec pages/standard. -- Added reusable CBPII OpenAPI examples for successful request/response payloads, key parameters, and error payloads. +- Added CBPII OpenAPI examples for key parameters and schema fields. ### Changed diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 3ff1ae4..764e4b2 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -44,9 +44,6 @@ paths: application/json: schema: $ref: '#/components/schemas/OBFundsConfirmationConsent1' - examples: - FundsConfirmationConsentCreateRequest: - $ref: '#/components/examples/FundsConfirmationConsentCreateRequest' description: Default required: true responses: @@ -179,11 +176,6 @@ paths: application/json: schema: $ref: '#/components/schemas/OBFundsConfirmation1' - examples: - FundsConfirmationCreateRequest: - $ref: '#/components/examples/FundsConfirmationCreateRequest' - FundsConfirmationUsdRequest: - $ref: '#/components/examples/FundsConfirmationUsdRequest' description: Default required: true responses: @@ -326,165 +318,6 @@ components: schema: type: string example: eyJ...header.eyJ...payload.signature - examples: - FundsConfirmationConsentCreateRequest: - summary: Create a funds-confirmation consent - value: - Data: - ExpirationDateTime: '2026-10-01T10:15:30+00:00' - DebtorAccount: - SchemeName: UK.OBIE.SortCodeAccountNumber - Identification: '30949301273801' - Name: Jane Smith - SecondaryIdentification: Roll 56988 - Proxy: - Identification: '+441632960540' - Code: TELE - Type: Telephone - FundsConfirmationConsentCreateResponse: - summary: Funds-confirmation consent awaiting authorisation - value: - Data: - ConsentId: FCC-20260401-0001 - CreationDateTime: '2026-04-01T10:15:30+00:00' - Status: AWAU - StatusUpdateDateTime: '2026-04-01T10:15:30+00:00' - ExpirationDateTime: '2026-10-01T10:15:30+00:00' - DebtorAccount: - SchemeName: UK.OBIE.SortCodeAccountNumber - Identification: '30949301273801' - Name: Jane Smith - SecondaryIdentification: Roll 56988 - Proxy: - Identification: '+441632960540' - Code: TELE - Type: Telephone - Links: - Self: https://api.alphabank.com/open-banking/v4.0/cbpii/funds-confirmation-consents/FCC-20260401-0001 - Meta: {} - FundsConfirmationConsentReadAuthorisedResponse: - summary: Authorised funds-confirmation consent - value: - Data: - ConsentId: FCC-20260401-0001 - CreationDateTime: '2026-04-01T10:15:30+00:00' - Status: AUTH - StatusUpdateDateTime: '2026-04-01T10:20:30+00:00' - ExpirationDateTime: '2026-10-01T10:15:30+00:00' - DebtorAccount: - SchemeName: UK.OBIE.SortCodeAccountNumber - Identification: '30949301273801' - Name: Jane Smith - SecondaryIdentification: Roll 56988 - Proxy: - Identification: '+441632960540' - Code: TELE - Type: Telephone - Links: - Self: https://api.alphabank.com/open-banking/v4.0/cbpii/funds-confirmation-consents/FCC-20260401-0001 - Meta: {} - FundsConfirmationConsentReadMaskedPanResponse: - summary: Authorised funds-confirmation consent with masked PAN - description: ASPSPs may partially mask the account identification when returning PAN account details on GET. - value: - Data: - ConsentId: FCC-20260401-0002 - CreationDateTime: '2026-04-01T10:15:30+00:00' - Status: AUTH - StatusUpdateDateTime: '2026-04-01T10:20:30+00:00' - ExpirationDateTime: '2026-10-01T10:15:30+00:00' - DebtorAccount: - SchemeName: UK.OBIE.PAN - Identification: '4444********1111' - Name: Jane Smith - SecondaryIdentification: '008419' - Proxy: - Identification: '+441632960540' - Code: TELE - Type: Telephone - Links: - Self: https://api.alphabank.com/open-banking/v4.0/cbpii/funds-confirmation-consents/FCC-20260401-0002 - Meta: {} - FundsConfirmationCreateRequest: - summary: Create a funds-confirmation request - value: - Data: - ConsentId: FCC-20260401-0001 - Reference: CARD-PURCHASE-001 - InstructedAmount: - Amount: '20.00' - Currency: GBP - FundsConfirmationCreateResponse: - summary: Funds are available for the card purchase - value: - Data: - FundsConfirmationId: FC-20260401-0001 - ConsentId: FCC-20260401-0001 - CreationDateTime: '2026-04-01T10:25:30+00:00' - FundsAvailable: true - Reference: CARD-PURCHASE-001 - InstructedAmount: - Amount: '20.00' - Currency: GBP - Links: - Self: https://api.alphabank.com/open-banking/v4.0/cbpii/funds-confirmations/FC-20260401-0001 - Meta: {} - FundsConfirmationUsdRequest: - summary: Create a funds-confirmation request for a USD account - description: Funds can be confirmed in USD only where the underlying payment account currency is USD. - value: - Data: - ConsentId: FCC-20260401-USD1 - Reference: CARD-PURCHASE-USD - InstructedAmount: - Amount: '20.00' - Currency: USD - FundsConfirmationUsdResponse: - summary: Funds are available for the USD card purchase - description: Funds can be confirmed in USD only where the underlying payment account currency is USD. - value: - Data: - FundsConfirmationId: FC-20260401-USD1 - ConsentId: FCC-20260401-USD1 - CreationDateTime: '2026-04-01T10:25:30+00:00' - FundsAvailable: true - Reference: CARD-PURCHASE-USD - InstructedAmount: - Amount: '20.00' - Currency: USD - Links: - Self: https://api.alphabank.com/open-banking/v4.0/cbpii/funds-confirmations/FC-20260401-USD1 - Meta: {} - Error400InvalidField: - summary: Invalid field value - value: - Code: UK.OBIE.Field.Invalid - Message: One or more request fields are invalid. - Errors: - - ErrorCode: U002 - Message: InstructedAmount.Currency must match the currency of the underlying payment account. - Path: Data.InstructedAmount.Currency - Url: https://docs.alphabank.com/open-banking/errors/U002 - Error403InvalidConsentStatus: - summary: Consent is not authorised for funds confirmation - value: - Code: UK.OBIE.Resource.InvalidConsentStatus - Message: The consent is not in a status that allows funds confirmation. - Errors: - - ErrorCode: U009 - Message: The funds-confirmation consent is not authorised for this request. - Path: Data.ConsentId - Url: https://docs.alphabank.com/open-banking/errors/U009 - Error500Unexpected: - summary: Unexpected processing error - value: - Id: ERR-20260401-0001 - Code: UK.OBIE.UnexpectedError - Message: An unexpected error occurred while processing the request. - Errors: - - ErrorCode: U000 - Message: The ASPSP could not complete the request due to an unexpected processing error. - Url: https://docs.alphabank.com/open-banking/errors/U000 responses: 201FundsConfirmationConsentsCreated: description: Funds Confirmation Consent Created @@ -504,15 +337,9 @@ components: application/json; charset=utf-8: schema: $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1' - examples: - FundsConfirmationConsentCreateResponse: - $ref: '#/components/examples/FundsConfirmationConsentCreateResponse' application/json: schema: $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1' - examples: - FundsConfirmationConsentCreateResponse: - $ref: '#/components/examples/FundsConfirmationConsentCreateResponse' application/jose+jwe: schema: $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1' @@ -534,19 +361,9 @@ components: application/json; charset=utf-8: schema: $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1' - examples: - FundsConfirmationConsentReadAuthorisedResponse: - $ref: '#/components/examples/FundsConfirmationConsentReadAuthorisedResponse' - FundsConfirmationConsentReadMaskedPanResponse: - $ref: '#/components/examples/FundsConfirmationConsentReadMaskedPanResponse' application/json: schema: $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1' - examples: - FundsConfirmationConsentReadAuthorisedResponse: - $ref: '#/components/examples/FundsConfirmationConsentReadAuthorisedResponse' - FundsConfirmationConsentReadMaskedPanResponse: - $ref: '#/components/examples/FundsConfirmationConsentReadMaskedPanResponse' application/jose+jwe: schema: $ref: '#/components/schemas/OBFundsConfirmationConsentResponse1' @@ -582,19 +399,9 @@ components: application/json; charset=utf-8: schema: $ref: '#/components/schemas/OBFundsConfirmationResponse1' - examples: - FundsConfirmationCreateResponse: - $ref: '#/components/examples/FundsConfirmationCreateResponse' - FundsConfirmationUsdResponse: - $ref: '#/components/examples/FundsConfirmationUsdResponse' application/json: schema: $ref: '#/components/schemas/OBFundsConfirmationResponse1' - examples: - FundsConfirmationCreateResponse: - $ref: '#/components/examples/FundsConfirmationCreateResponse' - FundsConfirmationUsdResponse: - $ref: '#/components/examples/FundsConfirmationUsdResponse' application/jose+jwe: schema: $ref: '#/components/schemas/OBFundsConfirmationResponse1' @@ -612,15 +419,9 @@ components: application/json; charset=utf-8: schema: $ref: '#/components/schemas/OBErrorResponse1' - examples: - Error400InvalidField: - $ref: '#/components/examples/Error400InvalidField' application/json: schema: $ref: '#/components/schemas/OBErrorResponse1' - examples: - Error400InvalidField: - $ref: '#/components/examples/Error400InvalidField' application/jose+jwe: schema: $ref: '#/components/schemas/OBErrorResponse1' @@ -648,15 +449,9 @@ components: application/json; charset=utf-8: schema: $ref: '#/components/schemas/OBErrorResponse1' - examples: - Error403InvalidConsentStatus: - $ref: '#/components/examples/Error403InvalidConsentStatus' application/json: schema: $ref: '#/components/schemas/OBErrorResponse1' - examples: - Error403InvalidConsentStatus: - $ref: '#/components/examples/Error403InvalidConsentStatus' application/jose+jwe: schema: $ref: '#/components/schemas/OBErrorResponse1' @@ -717,15 +512,9 @@ components: application/json; charset=utf-8: schema: $ref: '#/components/schemas/OBErrorResponse1' - examples: - Error500Unexpected: - $ref: '#/components/examples/Error500Unexpected' application/json: schema: $ref: '#/components/schemas/OBErrorResponse1' - examples: - Error500Unexpected: - $ref: '#/components/examples/Error500Unexpected' application/jose+jwe: schema: $ref: '#/components/schemas/OBErrorResponse1' From ee272ba99fc5ceaf6c55efb8b4668efb299b04a8 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Fri, 17 Jul 2026 13:50:35 +0100 Subject: [PATCH 24/36] Update changelog.md --- changelog.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changelog.md b/changelog.md index 82efb5d..4cea572 100644 --- a/changelog.md +++ b/changelog.md @@ -25,7 +25,7 @@ For v4.0.1 the following approach has been adopted for identifying changes: ### Changed -- Updated CBPII endpoint descriptions for consent creation, consent retrieval, consent deletion and funds confirmation creation to provide clearer behaviour and outcome detail. +- Updated CBPII endpoint descriptions for consent creation, consent retrieval, consent deletion and funds confirmation creation to provide clearer behaviour and outcome detail, to optimse for AI Agents. - Standardised CBPII OpenAPI description formatting for consistency (single-line where suitable, `>-`/`|-` block scalar usage where appropriate, paragraph spacing, inline code formatting, and emphasised notes). - Updated CBPII security scheme descriptions to align with Open Banking/FAPI context and clarify `Authorization` header usage. - Updated `x-jws-signature` to be optional in CBPII request/response modelling to align with the Open Banking spec pages/standard. From 8516395cc4240e8c93d13cf77123d48b7be09a89 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Fri, 17 Jul 2026 14:08:19 +0100 Subject: [PATCH 25/36] Clarify CBPII security scheme descriptions Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- dist/openapi/confirmation-funds-openapi.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 764e4b2..d166815 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -522,11 +522,11 @@ components: TPPOAuth2Security: type: oauth2 description: |- - TPP client credential authorisation flow with the ASPSP. + TPP client credentials authorisation flow with the ASPSP. FAPI 1 Advanced / OAuth 2.0 client credentials authorisation flow with the ASPSP. Access tokens are sent on resource requests using the standard HTTP Authorization header with the Bearer authentication scheme: `Authorization: Bearer `. - This OpenAPI security scheme represents the OAuth2 access-token requirement. Additional Open Banking/FAPI requirements such as transport security, client authentication method, signing, PAR/JAR, or certificate binding are profiled by the Open Banking security profile and may not be fully expressible in OpenAPI 3.0 securitySchemes. + This OpenAPI security scheme represents the OAuth2 access-token requirement. Additional Open Banking/FAPI requirements such as transport security, client authentication method, PAR/JAR, or certificate binding are profiled by the Open Banking security profile and may not be fully expressible in OpenAPI 3.0 securitySchemes. flows: clientCredentials: tokenUrl: https://authserver.example/token @@ -535,11 +535,11 @@ components: PSUOAuth2Security: type: oauth2 description: |- - OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when a TPP wants to access an ASPSP resource owned by the PSU + OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when a TPP wants to access an ASPSP resource owned by the PSU. - FAPI 1 Advanced / OAuth 2.0 authorisation code flow with the ASPSP. Access tokens are sent on resource requests using the standard HTTP Authorization header with the Bearer scheme: `Authorization: Bearer ` + FAPI 1 Advanced / OAuth 2.0 authorisation code flow with the ASPSP. Access tokens are sent on resource requests using the standard HTTP Authorization header with the Bearer scheme: `Authorization: Bearer `. - This OpenAPI security scheme represents the OAuth2 access-token requirement. Additional Open Banking/FAPI requirements such as transport security, client authentication method, signing, PAR/JAR, or certificate binding are profiled by the Open Banking security profile and may not be fully expressible in OpenAPI 3.0 securitySchemes. + This OpenAPI security scheme represents the OAuth2 access-token requirement. Additional Open Banking/FAPI requirements such as transport security, client authentication method, PAR/JAR, or certificate binding are profiled by the Open Banking security profile and may not be fully expressible in OpenAPI 3.0 securitySchemes. flows: authorizationCode: authorizationUrl: https://authserver.example/authorization From 90a7135a4e66738cb59dc513a376808d35390462 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 22 Jul 2026 10:12:08 +0100 Subject: [PATCH 26/36] Refine CBPII OpenAPI docs and schema reuse Updates the v4.0.1 Swagger update notes and aligns the generated confirmation-funds OpenAPI JSON with the YAML source. Adds CBPII tags, richer operation/field examples and descriptions, makes x-jws-signature optional in requests, adds x-jws-signature response headers across success/error responses, and refactors repeated payload/account/amount structures into reusable component schemas for clearer, more consistent API documentation. --- changelog.md | 11 +- dist/openapi/confirmation-funds-openapi.json | 668 ++++++++++--------- 2 files changed, 363 insertions(+), 316 deletions(-) diff --git a/changelog.md b/changelog.md index 4cea572..728de33 100644 --- a/changelog.md +++ b/changelog.md @@ -14,20 +14,23 @@ For v4.0.1 the following approach has been adopted for identifying changes: - [v4.0.1 Release Candidate 1](https://openbanking.atlassian.net/wiki/spaces/WOR/pages/4203282434/Feedback+-+v4.0.1+Release+Candidate+1) - [v4.0.1 Release Candidate 2](https://openbanking.atlassian.net/wiki/spaces/WOR/pages/4309942273/Feedback+-+v4.0.1+Release+Candidate+2) -## v4.0.1-Update1 - TBD +## v4.0.1 Swagger Update 1 - TBD + +This update covers Swagger/OpenAPI refinements for the Confirmation of Funds (CBPII) API in v4.0.1. ### Added - Added CBPII OpenAPI tags for `Funds Confirmation Consents` and `Funds Confirmations` to improve Swagger UI grouping and navigation. - Added optional `x-jws-signature` request header support across all CBPII operations to align with the Open Banking spec pages/standard. - Added optional `x-jws-signature` response header support across CBPII success and error responses to align with the Open Banking spec pages/standard. -- Added CBPII OpenAPI examples for key parameters and schema fields. +- Added CBPII OpenAPI examples for key parameters, headers, error payloads and schema fields. ### Changed -- Updated CBPII endpoint descriptions for consent creation, consent retrieval, consent deletion and funds confirmation creation to provide clearer behaviour and outcome detail, to optimse for AI Agents. +- Updated CBPII endpoint descriptions for consent creation, consent retrieval, consent deletion and funds confirmation creation to provide clearer behaviour and outcome detail for Swagger UI and AI agent consumers. +- Updated the duplicate CBPII OpenAPI JSON output generated from the YAML source so the YAML and JSON Swagger artefacts stay aligned. - Standardised CBPII OpenAPI description formatting for consistency (single-line where suitable, `>-`/`|-` block scalar usage where appropriate, paragraph spacing, inline code formatting, and emphasised notes). -- Updated CBPII security scheme descriptions to align with Open Banking/FAPI context and clarify `Authorization` header usage. +- Updated CBPII security scheme, error model and account proxy descriptions to align with Open Banking/FAPI context and improve clarity. - Updated `x-jws-signature` to be optional in CBPII request/response modelling to align with the Open Banking spec pages/standard. - Updated CBPII enum descriptions to link directly to the relevant codeset CSV files. - Refactored CBPII `OBInternalAccountIdentification4Code` into a reusable schema reference. diff --git a/dist/openapi/confirmation-funds-openapi.json b/dist/openapi/confirmation-funds-openapi.json index 7cf7ea1..4605f93 100644 --- a/dist/openapi/confirmation-funds-openapi.json +++ b/dist/openapi/confirmation-funds-openapi.json @@ -2,7 +2,7 @@ "openapi": "3.0.0", "info": { "title": "Confirmation of Funds API Specification", - "description": "Swagger for Confirmation of Funds API Specification.\n\n**Please Note**: There are no optional fields, if a field is not marked as “Required” it is a Conditional field.\n", + "description": "Swagger for Confirmation of Funds API Specification.\n\n**Please Note**: There are no optional fields, if a field is not marked as “Required” it is a Conditional field.", "termsOfService": "https://www.openbanking.org.uk/terms", "contact": { "name": "Service Desk", @@ -14,6 +14,16 @@ }, "version": "4.0.1" }, + "tags": [ + { + "name": "Funds Confirmation Consents", + "description": "Operations related to funds confirmation consents" + }, + { + "name": "Funds Confirmations", + "description": "Operations related to funds confirmations" + } + ], "paths": { "/funds-confirmation-consents": { "post": { @@ -21,7 +31,7 @@ "Funds Confirmation Consents" ], "summary": "Create a Funds Confirmation Consent", - "description": "Enables a CBPII to ask an ASPSP to create a new funds-confirmation-consent resource, by sending a copy of the consent to the ASPSP.", + "description": "Enables a CBPII to ask an ASPSP to create a new funds-confirmation-consent resource, by sending a copy of the consent to the ASPSP.\n\nOn success (HTTP 201), the response contains a `ConsentId`, `CreationDateTime`, the current `Status` of the consent, `StatusUpdateDateTime`, and the `DebtorAccount` associated with the consent. The consent may initially be returned with status `AWAU` (`AwaitingAuthorisation`).\n\n**Note:** Creating this consent does not immediately authorise funds confirmations. The PSU will need to authenticate and authorise the consent with their ASPSP before the consent can be used for funds confirmation requests.", "operationId": "CreateFundsConfirmationConsents", "parameters": [ { @@ -39,6 +49,9 @@ { "$ref": "#/components/parameters/x-customer-user-agent" }, + { + "$ref": "#/components/parameters/x-jws-signature" + }, { "$ref": "#/components/parameters/x-client-id" } @@ -98,7 +111,7 @@ "Funds Confirmation Consents" ], "summary": "Get a Funds Confirmation Consent", - "description": "Enables a CBPII to retrieve the status of a Funds Confirmation Consent resource.", + "description": "Enables a CBPII to retrieve the status of a Funds Confirmation Consent resource.\n\nOn success (HTTP 200), the response contains the consent `ConsentId`, `CreationDateTime`, current `Status`, `StatusUpdateDateTime`, optional `StatusReason`, optional `ExpirationDateTime`, and the `DebtorAccount` associated with the consent.\n\n**Note:** This operation is read-only. It does not change the consent status, authorise the consent, revoke the consent, or perform a funds availability check.", "operationId": "GetFundsConfirmationConsentsConsentId", "parameters": [ { @@ -119,6 +132,9 @@ { "$ref": "#/components/parameters/x-customer-user-agent" }, + { + "$ref": "#/components/parameters/x-jws-signature" + }, { "$ref": "#/components/parameters/x-client-id" } @@ -162,7 +178,7 @@ "Funds Confirmation Consents" ], "summary": "Delete a Funds Confirmation Consent", - "description": "Enables a CBPII to inform the PSU’s ASPSP that the PSU has revoked their consent to provide funds confirmations.", + "description": "Enables a CBPII to inform the PSU's ASPSP that the PSU has revoked their consent to provide funds confirmations.\n\nOn success (HTTP 204), the response has no body. The ASPSP confirms that the funds-confirmation-consent resource identified by `ConsentId` has been deleted or revoked for future funds confirmation use.\n\n**Note:** After this operation succeeds, the consent can no longer be used to create funds confirmation requests.", "operationId": "DeleteFundsConfirmationConsentsConsentId", "parameters": [ { @@ -183,6 +199,9 @@ { "$ref": "#/components/parameters/x-customer-user-agent" }, + { + "$ref": "#/components/parameters/x-jws-signature" + }, { "$ref": "#/components/parameters/x-client-id" } @@ -228,7 +247,7 @@ "Funds Confirmations" ], "summary": "Create a Funds Confirmation Request", - "description": "Enables a CBPII to check whether a PSU has sufficient available funds for a CBPII transaction.", + "description": "Enables a CBPII to check whether a PSU has sufficient available funds for a CBPII transaction.\n\nThe request identifies the authorised funds-confirmation consent using `ConsentId`, provides a CBPII-assigned `Reference`, and specifies the `InstructedAmount` to check.\n\nOn success (HTTP 201), the response contains a `FundsConfirmationId`, the related `ConsentId`, `CreationDateTime`, the boolean `FundsAvailable` result, the `Reference`, and the `InstructedAmount` checked.\n\n**Note:** This operation checks availability only; it does not reserve funds, move funds, or initiate a payment.", "operationId": "CreateFundsConfirmations", "parameters": [ { @@ -246,6 +265,9 @@ { "$ref": "#/components/parameters/x-customer-user-agent" }, + { + "$ref": "#/components/parameters/x-jws-signature" + }, { "$ref": "#/components/parameters/x-client-id" } @@ -310,19 +332,21 @@ "ConsentId": { "name": "ConsentId", "in": "path", - "description": "ConsentId", + "description": "`ConsentId`", "required": true, "schema": { - "type": "string" + "type": "string", + "example": "FCC-20260401-0001" } }, "Authorization": { "in": "header", "name": "Authorization", "required": true, - "description": "An Authorisation Token as per https://tools.ietf.org/html/rfc6750", + "description": "An Authorisation Token as per ", "schema": { - "type": "string" + "type": "string", + "example": "Bearer " } }, "x-customer-user-agent": { @@ -331,7 +355,8 @@ "description": "Indicates the user-agent that the PSU is using.", "required": false, "schema": { - "type": "string" + "type": "string", + "example": "Mozilla/5.0 (Example PSU Device)" } }, "x-fapi-customer-ip-address": { @@ -340,17 +365,19 @@ "required": false, "description": "The PSU's IP address if the PSU is currently logged in with the TPP.", "schema": { - "type": "string" + "type": "string", + "example": "203.0.113.42" } }, "x-fapi-auth-date": { "in": "header", "name": "x-fapi-auth-date", "required": false, - "description": "The time when the PSU last logged in with the TPP. \nAll dates in the HTTP headers are represented as RFC 7231 Full Dates. An example is below: \nSun, 10 Sep 2017 19:43:31 UTC", + "description": "The time when the PSU last logged in with the TPP.\n\nAll dates in the HTTP headers are represented as RFC 7231 Full Dates. An example is below:\n\n`Sun, 10 Sep 2017 19:43:31 UTC`", "schema": { "type": "string", - "pattern": "^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \\d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \\d{4} \\d{2}:\\d{2}:\\d{2} (GMT|UTC)$" + "pattern": "^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \\d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \\d{4} \\d{2}:\\d{2}:\\d{2} (GMT|UTC)$", + "example": "Wed, 01 Apr 2026 10:15:30 GMT" } }, "x-fapi-interaction-id": { @@ -358,53 +385,55 @@ "name": "x-fapi-interaction-id", "required": false, "description": "An RFC4122 UID used as a correlation id.", - "schema": { - "type": "string" - } - }, - "x-idempotency-key": { - "name": "x-idempotency-key", - "in": "header", - "description": "Every request will be processed only once per x-idempotency-key. The\nIdempotency Key will be valid for 24 hours.\n", - "required": true, "schema": { "type": "string", - "maxLength": 40, - "pattern": "^(?!\\s)(.*)(\\S)$" + "example": "93bac548-d2de-4546-b106-880a5018460d" } }, "x-jws-signature": { "in": "header", "name": "x-jws-signature", - "required": true, + "required": false, "description": "A detached JWS signature of the body of the payload.", "schema": { - "type": "string" + "type": "string", + "example": "eyJ...header.eyJ...payload.signature" } }, "x-client-id": { "in": "header", "name": "x-client-id", "required": false, - "description": "Only used if an ASPSP requires the client ID in order to return rate limit headers. \n\nTPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements.\n\nThis header __must not__ be used for client authentication\n", + "description": "Only used if an ASPSP requires the client ID in order to return rate limit headers.\n\nTPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements.\n\nThis header __must not__ be used for client authentication", "schema": { - "type": "string" + "type": "string", + "example": "cbpii-client-12345" } } }, "headers": { "RateLimit-Policy": { "required": false, - "description": "TPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements.\n\nA non-empty list of Quota Policy Items. The Item value __MUST__ be a String.\n\nExample:\n`RateLimit-Policy: \"default\";q=100;w=10`\n\nThe **REQUIRED** \"q\" parameter indicates the quota allocated by this policy measured in quota units.\n\nThe **OPTIONAL** \"w\" parameter value conveys a time window.\n", + "description": "TPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements.\n\nA non-empty list of Quota Policy Items. The Item value __MUST__ be a String.\n\nExample:\n`RateLimit-Policy: \"default\";q=100;w=10`\n\nThe **REQUIRED** \"q\" parameter indicates the quota allocated by this policy measured in quota units.\n\nThe **OPTIONAL** \"w\" parameter value conveys a time window.", "schema": { - "type": "string" + "type": "string", + "example": "\"default\";q=100;w=10" } }, "RateLimit": { "required": false, - "description": "TPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements.\n\nA server uses the \"RateLimit\" response header field to communicate the current service limit for a quota policy for a particular partition key.\n\nExample:\n`RateLimit: \"default\";r=50;t=30`\n\nThe **REQUIRED** \"r\" parameter value conveys the remaining quota units for the identified policy.\n\nThe **OPTIONAL** \"t\" parameter value conveys the time window reset time for the identified policy.\n", + "description": "TPPs __must__ refer to ASPSP developer portals for further information on any rate limit policies, if the headers are supported and any additional requirements.\n\nA server uses the \"RateLimit\" response header field to communicate the current service limit for a quota policy for a particular partition key.\n\nExample:\n`RateLimit: \"default\";r=50;t=30`\n\nThe **REQUIRED** \"r\" parameter value conveys the remaining quota units for the identified policy.\n\nThe **OPTIONAL** \"t\" parameter value conveys the time window reset time for the identified policy.", "schema": { - "type": "string" + "type": "string", + "example": "\"default\";r=50;t=30" + } + }, + "x-jws-signature": { + "required": false, + "description": "A detached JWS signature of the body of the payload.", + "schema": { + "type": "string", + "example": "eyJ...header.eyJ...payload.signature" } } }, @@ -424,6 +453,9 @@ }, "RateLimit": { "$ref": "#/components/headers/RateLimit" + }, + "x-jws-signature": { + "$ref": "#/components/headers/x-jws-signature" } }, "content": { @@ -459,6 +491,9 @@ }, "RateLimit": { "$ref": "#/components/headers/RateLimit" + }, + "x-jws-signature": { + "$ref": "#/components/headers/x-jws-signature" } }, "content": { @@ -494,6 +529,9 @@ }, "RateLimit": { "$ref": "#/components/headers/RateLimit" + }, + "x-jws-signature": { + "$ref": "#/components/headers/x-jws-signature" } } }, @@ -512,6 +550,9 @@ }, "RateLimit": { "$ref": "#/components/headers/RateLimit" + }, + "x-jws-signature": { + "$ref": "#/components/headers/x-jws-signature" } }, "content": { @@ -541,6 +582,9 @@ "schema": { "type": "string" } + }, + "x-jws-signature": { + "$ref": "#/components/headers/x-jws-signature" } }, "content": { @@ -570,6 +614,9 @@ "schema": { "type": "string" } + }, + "x-jws-signature": { + "$ref": "#/components/headers/x-jws-signature" } } }, @@ -582,6 +629,9 @@ "schema": { "type": "string" } + }, + "x-jws-signature": { + "$ref": "#/components/headers/x-jws-signature" } }, "content": { @@ -602,18 +652,6 @@ } } }, - "404Error": { - "description": "Not found", - "headers": { - "x-fapi-interaction-id": { - "required": true, - "description": "An RFC4122 UID used as a correlation id.", - "schema": { - "type": "string" - } - } - } - }, "405Error": { "description": "Method Not Allowed", "headers": { @@ -623,6 +661,9 @@ "schema": { "type": "string" } + }, + "x-jws-signature": { + "$ref": "#/components/headers/x-jws-signature" } } }, @@ -635,6 +676,9 @@ "schema": { "type": "string" } + }, + "x-jws-signature": { + "$ref": "#/components/headers/x-jws-signature" } } }, @@ -647,6 +691,9 @@ "schema": { "type": "string" } + }, + "x-jws-signature": { + "$ref": "#/components/headers/x-jws-signature" } } }, @@ -664,6 +711,9 @@ "schema": { "type": "string" } + }, + "x-jws-signature": { + "$ref": "#/components/headers/x-jws-signature" } } }, @@ -676,6 +726,9 @@ "schema": { "type": "string" } + }, + "x-jws-signature": { + "$ref": "#/components/headers/x-jws-signature" } }, "content": { @@ -700,7 +753,7 @@ "securitySchemes": { "TPPOAuth2Security": { "type": "oauth2", - "description": "TPP client credential authorisation flow with the ASPSP", + "description": "TPP client credentials authorisation flow with the ASPSP.\n\nFAPI 1 Advanced / OAuth 2.0 client credentials authorisation flow with the ASPSP. Access tokens are sent on resource requests using the standard HTTP Authorization header with the Bearer authentication scheme: `Authorization: Bearer `.\n\nThis OpenAPI security scheme represents the OAuth2 access-token requirement. Additional Open Banking/FAPI requirements such as transport security, client authentication method, PAR/JAR, or certificate binding are profiled by the Open Banking security profile and may not be fully expressible in OpenAPI 3.0 securitySchemes.", "flows": { "clientCredentials": { "tokenUrl": "https://authserver.example/token", @@ -712,7 +765,7 @@ }, "PSUOAuth2Security": { "type": "oauth2", - "description": "OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when a TPP wants to access an ASPSP resource owned by the PSU", + "description": "OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when a TPP wants to access an ASPSP resource owned by the PSU.\n\nFAPI 1 Advanced / OAuth 2.0 authorisation code flow with the ASPSP. Access tokens are sent on resource requests using the standard HTTP Authorization header with the Bearer scheme: `Authorization: Bearer `.\n\nThis OpenAPI security scheme represents the OAuth2 access-token requirement. Additional Open Banking/FAPI requirements such as transport security, client authentication method, PAR/JAR, or certificate binding are profiled by the Open Banking security profile and may not be fully expressible in OpenAPI 3.0 securitySchemes.", "flows": { "authorizationCode": { "authorizationUrl": "https://authserver.example/authorization", @@ -725,12 +778,6 @@ } }, "schemas": { - "Identification_0": { - "description": "Identification assigned by an institution to identify an account. This identification is known by the account owner.", - "type": "string", - "minLength": 1, - "maxLength": 256 - }, "OBProxy1": { "description": "Specifies an alternate assumed name for the identification of the account.", "type": "object", @@ -743,7 +790,8 @@ "description": "Identification used to indicate the account identification under another specified name.", "type": "string", "minLength": 1, - "maxLength": 2048 + "maxLength": 2048, + "example": "+441632960540" }, "Code": { "$ref": "#/components/schemas/ExternalProxyAccountType1Code" @@ -752,12 +800,63 @@ "type": "string", "description": "Type of the proxy identification.", "minLength": 1, - "maxLength": 35 + "maxLength": 35, + "example": "Telephone" } } }, + "OBCashAccountDebtorWithName": { + "type": "object", + "required": [ + "SchemeName", + "Identification" + ], + "description": "Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied.", + "properties": { + "SchemeName": { + "$ref": "#/components/schemas/OBInternalAccountIdentification4Code" + }, + "Identification": { + "description": "Identification assigned by an institution to identify an account. This identification is known by the account owner.", + "type": "string", + "minLength": 1, + "maxLength": 256, + "example": "30949301273801" + }, + "Name": { + "description": "Name of the account, as assigned by the account servicing institution.\n\nUsage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account.", + "type": "string", + "minLength": 1, + "maxLength": 350, + "example": "Jane Smith" + }, + "SecondaryIdentification": { + "description": "This is secondary identification of the account, as assigned by the account servicing institution.\n\nThis can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination).", + "type": "string", + "minLength": 1, + "maxLength": 34, + "example": "Roll 56988" + }, + "Proxy": { + "$ref": "#/components/schemas/OBProxy1" + } + } + }, + "OBInternalAccountIdentification4Code": { + "description": "Name of the identification scheme, in a coded form as published in an external list.\n\nFor a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv)", + "type": "string", + "x-namespaced-enum": [ + "UK.OBIE.BBAN", + "UK.OBIE.IBAN", + "UK.OBIE.PAN", + "UK.OBIE.Paym", + "UK.OBIE.SortCodeAccountNumber", + "UK.OBIE.Wallet" + ], + "example": "UK.OBIE.SortCodeAccountNumber" + }, "ExternalProxyAccountType1Code": { - "description": "Specifies the external proxy account type code, as published in the proxy account type external code set.
For a full list of values refer to `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", + "description": "Specifies the external proxy account type code, as published in the proxy account type external code set.\n\nFor a full list of values refer to `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/ISO_External_Codeset.csv)", "type": "string", "enum": [ "TELE", @@ -781,13 +880,42 @@ "UBIL", "VIPN", "BIID" - ] + ], + "example": "TELE" }, "ISODateTime": { - "description": "All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00", + "description": "All dates in the JSON payloads are represented in ISO 8601 date-time format.\n\nAll date-time fields in responses must include the timezone. An example is below:\n\n`2017-04-05T10:43:07+00:00`", "type": "string", "format": "date-time" }, + "OBActiveOrHistoricCurrencyAndAmount": { + "type": "object", + "required": [ + "Amount", + "Currency" + ], + "description": "Amount of money to be confirmed as available funds in the debtor account. Contains an `Amount` and a `Currency`.", + "properties": { + "Amount": { + "$ref": "#/components/schemas/OBActiveCurrencyAndAmount_SimpleType" + }, + "Currency": { + "$ref": "#/components/schemas/ActiveOrHistoricCurrencyCode" + } + } + }, + "OBActiveCurrencyAndAmount_SimpleType": { + "description": "A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217.", + "type": "string", + "pattern": "^\\d{1,13}$|^\\d{1,13}\\.\\d{1,5}$", + "example": "20.00" + }, + "ActiveOrHistoricCurrencyCode": { + "description": "A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 \"Codes for the representation of currencies and funds\".", + "type": "string", + "pattern": "^[A-Z]{3,3}$", + "example": "GBP" + }, "Links": { "type": "object", "description": "Links relevant to the payload", @@ -843,20 +971,23 @@ "$ref": "#/components/schemas/OBExternalStatusReason1Code" }, "Message": { - "description": "A description of the error that occurred. e.g., 'A mandatory field isn't supplied' or 'RequestedExecutionDateTime must be in future'\nOBL doesn't standardise this field", + "description": "A description of the error that occurred. e.g., `'A mandatory field isn't supplied'` or `'RequestedExecutionDateTime must be in future'`\n\nOBL doesn't standardise this field.", "type": "string", "minLength": 1, - "maxLength": 500 + "maxLength": 500, + "example": "InstructedAmount.Currency must match the currency of the underlying payment account." }, "Path": { - "description": "Recommended but optional reference to the JSON Path of the field with error, e.g., Data.Initiation.InstructedAmount.Currency", + "description": "Recommended but optional reference to the JSON Path of the field with error, e.g., `Data.InstructedAmount.Currency`", "type": "string", "minLength": 1, - "maxLength": 500 + "maxLength": 500, + "example": "Data.InstructedAmount.Currency" }, "Url": { "description": "URL to help remediate the problem, or provide more information, or to API Reference, or help etc", - "type": "string" + "type": "string", + "example": "https://docs.alphabank.com/open-banking/errors/U002" } }, "required": [ @@ -876,17 +1007,17 @@ "maxLength": 40 }, "Code": { - "description": "Deprecated
High level textual error code, to help categorise the errors.", + "description": "**Deprecated**\n\nHigh level textual error code, to help categorise the errors.", "type": "string", "minLength": 1, - "example": "400 BadRequest", + "example": "UK.OBIE.Field.Invalid", "maxLength": 40 }, "Message": { - "description": "Deprecated
Brief Error message", + "description": "**Deprecated**\n\nBrief Error message", "type": "string", "minLength": 1, - "example": "There is something wrong with the request parameters provided", + "example": "One or more request fields are invalid.", "maxLength": 500 }, "Errors": { @@ -909,50 +1040,38 @@ ], "properties": { "Data": { - "type": "object", - "required": [ - "ConsentId", - "Reference", - "InstructedAmount" - ], - "properties": { - "ConsentId": { - "description": "Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation consent resource.", - "type": "string", - "minLength": 1, - "maxLength": 128 - }, - "Reference": { - "description": "Unique reference, as assigned by the CBPII, to unambiguously refer to the request related to the payment transaction.", - "type": "string", - "minLength": 1, - "maxLength": 35 - }, - "InstructedAmount": { - "type": "object", - "required": [ - "Amount", - "Currency" - ], - "description": "Amount of money to be confirmed as available funds in the debtor account. Contains an Amount and a Currency.", - "properties": { - "Amount": { - "description": "A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217.", - "type": "string", - "pattern": "^\\d{1,13}$|^\\d{1,13}\\.\\d{1,5}$" - }, - "Currency": { - "description": "A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 \"Codes for the representation of currencies and funds\".", - "type": "string", - "pattern": "^[A-Z]{3,3}$" - } - } - } - } + "$ref": "#/components/schemas/OBFundsConfirmationData1" } }, "additionalProperties": false }, + "OBFundsConfirmationData1": { + "type": "object", + "required": [ + "ConsentId", + "Reference", + "InstructedAmount" + ], + "properties": { + "ConsentId": { + "description": "Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation consent resource.", + "type": "string", + "minLength": 1, + "maxLength": 128, + "example": "FCC-20260401-0001" + }, + "Reference": { + "description": "Unique reference, as assigned by the CBPII, to unambiguously refer to the request related to the payment transaction.", + "type": "string", + "minLength": 1, + "maxLength": 35, + "example": "CARD-PURCHASE-001" + }, + "InstructedAmount": { + "$ref": "#/components/schemas/OBActiveOrHistoricCurrencyAndAmount" + } + } + }, "OBFundsConfirmationConsent1": { "type": "object", "required": [ @@ -960,64 +1079,28 @@ ], "properties": { "Data": { - "type": "object", - "required": [ - "DebtorAccount" - ], - "properties": { - "ExpirationDateTime": { - "description": "Specified date and time the funds confirmation authorisation will expire.\n If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00", - "type": "string", - "format": "date-time" - }, - "DebtorAccount": { - "type": "object", - "required": [ - "SchemeName", - "Identification" - ], - "description": "Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied.", - "properties": { - "SchemeName": { - "description": "Name of the identification scheme, in a coded form as published in an external list. For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", - "type": "string", - "x-namespaced-enum": [ - "UK.OBIE.BBAN", - "UK.OBIE.IBAN", - "UK.OBIE.PAN", - "UK.OBIE.Paym", - "UK.OBIE.SortCodeAccountNumber", - "UK.OBIE.Wallet" - ] - }, - "Identification": { - "description": "Identification assigned by an institution to identify an account. This identification is known by the account owner.", - "type": "string", - "minLength": 1, - "maxLength": 256 - }, - "Name": { - "description": "Name of the account, as assigned by the account servicing institution.\nUsage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account.", - "type": "string", - "minLength": 1, - "maxLength": 350 - }, - "SecondaryIdentification": { - "description": "This is secondary identification of the account, as assigned by the account servicing institution. \nThis can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination).", - "type": "string", - "minLength": 1, - "maxLength": 34 - }, - "Proxy": { - "$ref": "#/components/schemas/OBProxy1" - } - } - } - } + "$ref": "#/components/schemas/OBFundsConfirmationConsentData1" } }, "additionalProperties": false }, + "OBFundsConfirmationConsentData1": { + "type": "object", + "required": [ + "DebtorAccount" + ], + "properties": { + "ExpirationDateTime": { + "description": "Specified date and time the funds confirmation authorisation will expire.\n\nIf this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format.\n\nAll date-time fields in responses must include the timezone. An example is below:\n\n`2017-04-05T10:43:07+00:00`", + "type": "string", + "format": "date-time", + "example": "2026-10-01T10:15:30+00:00" + }, + "DebtorAccount": { + "$ref": "#/components/schemas/OBCashAccountDebtorWithName" + } + } + }, "OBFundsConfirmationConsentResponse1": { "type": "object", "required": [ @@ -1025,89 +1108,7 @@ ], "properties": { "Data": { - "type": "object", - "required": [ - "ConsentId", - "CreationDateTime", - "Status", - "StatusUpdateDateTime", - "DebtorAccount" - ], - "properties": { - "ConsentId": { - "description": "Unique identification as assigned to identify the funds confirmation consent resource.", - "type": "string", - "minLength": 1, - "maxLength": 128 - }, - "CreationDateTime": { - "description": "Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00", - "type": "string", - "format": "date-time" - }, - "Status": { - "$ref": "#/components/schemas/OBInternalConsentStatus1Code" - }, - "StatusReason": { - "type": "array", - "items": { - "$ref": "#/components/schemas/OBStatusReason" - } - }, - "StatusUpdateDateTime": { - "description": "Date and time at which the resource status was updated. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00", - "type": "string", - "format": "date-time" - }, - "ExpirationDateTime": { - "description": "Specified date and time the funds confirmation authorisation will expire.\nIf this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00", - "type": "string", - "format": "date-time" - }, - "DebtorAccount": { - "type": "object", - "required": [ - "SchemeName", - "Identification" - ], - "description": "Unambiguous identification of the account of the debtor to which a confirmation of funds consent will be applied.", - "properties": { - "SchemeName": { - "description": "Name of the identification scheme, in a coded form as published in an external list. For a full list of values refer to `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", - "type": "string", - "x-namespaced-enum": [ - "UK.OBIE.BBAN", - "UK.OBIE.IBAN", - "UK.OBIE.PAN", - "UK.OBIE.Paym", - "UK.OBIE.SortCodeAccountNumber", - "UK.OBIE.Wallet" - ] - }, - "Identification": { - "description": "Identification assigned by an institution to identify an account. This identification is known by the account owner.", - "type": "string", - "minLength": 1, - "maxLength": 256 - }, - "Name": { - "description": "Name of the account, as assigned by the account servicing institution.\nUsage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account.", - "type": "string", - "minLength": 1, - "maxLength": 350 - }, - "SecondaryIdentification": { - "description": "This is secondary identification of the account, as assigned by the account servicing institution. \nThis can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination).", - "type": "string", - "minLength": 1, - "maxLength": 34 - }, - "Proxy": { - "$ref": "#/components/schemas/OBProxy1" - } - } - } - } + "$ref": "#/components/schemas/OBFundsConfirmationConsentDataResponse1" }, "Links": { "$ref": "#/components/schemas/Links" @@ -1118,8 +1119,57 @@ }, "additionalProperties": false }, + "OBFundsConfirmationConsentDataResponse1": { + "type": "object", + "required": [ + "ConsentId", + "CreationDateTime", + "Status", + "StatusUpdateDateTime", + "DebtorAccount" + ], + "properties": { + "ConsentId": { + "description": "Unique identification as assigned to identify the funds confirmation consent resource.", + "type": "string", + "minLength": 1, + "maxLength": 128, + "example": "FCC-20260401-0001" + }, + "CreationDateTime": { + "description": "Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format.\n\nAll date-time fields in responses must include the timezone. An example is below:\n\n`2017-04-05T10:43:07+00:00`", + "type": "string", + "format": "date-time", + "example": "2026-04-01T10:15:30+00:00" + }, + "Status": { + "$ref": "#/components/schemas/OBInternalConsentStatus1Code" + }, + "StatusReason": { + "type": "array", + "items": { + "$ref": "#/components/schemas/OBStatusReason" + } + }, + "StatusUpdateDateTime": { + "description": "Date and time at which the resource status was updated. All dates in the JSON payloads are represented in ISO 8601 date-time format.\n\nAll date-time fields in responses must include the timezone. An example is below:\n\n`2017-04-05T10:43:07+00:00`", + "type": "string", + "format": "date-time", + "example": "2026-04-01T10:20:30+00:00" + }, + "ExpirationDateTime": { + "description": "Specified date and time the funds confirmation authorisation will expire.\n\nIf this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format.\n\nAll date-time fields in responses must include the timezone. An example is below:\n\n`2017-04-05T10:43:07+00:00`", + "type": "string", + "format": "date-time", + "example": "2026-10-01T10:15:30+00:00" + }, + "DebtorAccount": { + "$ref": "#/components/schemas/OBCashAccountDebtorWithName" + } + } + }, "OBInternalConsentStatus1Code": { - "description": "Specifies the status of consent resource in code form. For a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", + "description": "Specifies the status of consent resource in code form.\n\nFor a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv)", "type": "string", "enum": [ "AWAU", @@ -1127,7 +1177,8 @@ "AUTH", "CANC", "EXPD" - ] + ], + "example": "AUTH" }, "OBFundsConfirmationResponse1": { "type": "object", @@ -1136,64 +1187,7 @@ ], "properties": { "Data": { - "type": "object", - "required": [ - "FundsConfirmationId", - "ConsentId", - "CreationDateTime", - "FundsAvailable", - "Reference", - "InstructedAmount" - ], - "properties": { - "FundsConfirmationId": { - "description": "Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation resource.", - "type": "string", - "minLength": 1, - "maxLength": 40 - }, - "ConsentId": { - "description": "Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation consent resource.", - "type": "string", - "minLength": 1, - "maxLength": 128 - }, - "CreationDateTime": { - "description": "Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. \nAll date-time fields in responses must include the timezone. An example is below:\n2017-04-05T10:43:07+00:00", - "type": "string", - "format": "date-time" - }, - "FundsAvailable": { - "description": "Flag to indicate the result of a confirmation of funds check.", - "type": "boolean" - }, - "Reference": { - "description": "Unique reference, as assigned by the CBPII, to unambiguously refer to the request related to the payment transaction.", - "type": "string", - "minLength": 1, - "maxLength": 35 - }, - "InstructedAmount": { - "type": "object", - "required": [ - "Amount", - "Currency" - ], - "description": "Amount of money to be confirmed as available funds in the debtor account. Contains an Amount and a Currency.", - "properties": { - "Amount": { - "description": "A number of monetary units specified in an active currency where the unit of currency is explicit and compliant with ISO 4217.", - "type": "string", - "pattern": "^\\d{1,13}$|^\\d{1,13}\\.\\d{1,5}$" - }, - "Currency": { - "description": "A code allocated to a currency by a Maintenance Agency under an international identification scheme, as described in the latest edition of the international standard ISO 4217 \"Codes for the representation of currencies and funds\".", - "type": "string", - "pattern": "^[A-Z]{3,3}$" - } - } - } - } + "$ref": "#/components/schemas/OBFundsConfirmationDataResponse1" }, "Links": { "$ref": "#/components/schemas/Links" @@ -1204,37 +1198,87 @@ }, "additionalProperties": false }, + "OBFundsConfirmationDataResponse1": { + "type": "object", + "required": [ + "FundsConfirmationId", + "ConsentId", + "CreationDateTime", + "FundsAvailable", + "Reference", + "InstructedAmount" + ], + "properties": { + "FundsConfirmationId": { + "description": "Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation resource.", + "type": "string", + "minLength": 1, + "maxLength": 40, + "example": "FC-20260401-0001" + }, + "ConsentId": { + "description": "Unique identification as assigned by the ASPSP to uniquely identify the funds confirmation consent resource.", + "type": "string", + "minLength": 1, + "maxLength": 128, + "example": "FCC-20260401-0001" + }, + "CreationDateTime": { + "description": "Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format.\n\nAll date-time fields in responses must include the timezone. An example is below:\n\n`2017-04-05T10:43:07+00:00`", + "type": "string", + "format": "date-time", + "example": "2026-04-01T10:25:30+00:00" + }, + "FundsAvailable": { + "description": "Flag to indicate the result of a confirmation of funds check.", + "type": "boolean", + "example": true + }, + "Reference": { + "description": "Unique reference, as assigned by the CBPII, to unambiguously refer to the request related to the payment transaction.", + "type": "string", + "minLength": 1, + "maxLength": 35, + "example": "CARD-PURCHASE-001" + }, + "InstructedAmount": { + "$ref": "#/components/schemas/OBActiveOrHistoricCurrencyAndAmount" + } + } + }, "OBExternalStatusReason1Code": { - "description": "Low level textual error code, for all enum values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", + "description": "Low level textual error code.\n\nFor all enum values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", "type": "string", "minLength": 4, "maxLength": 4, - "example": "U001" + "example": "U002" }, "OBStatusReason": { "type": "object", "properties": { "StatusReasonCode": { "type": "string", - "description": "Specifies the status reason in a code form. \n For a full list of values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", + "description": "Specifies the status reason in a code form.\n\nFor a full list of values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets)", "minLength": 1, "maxLength": 4, - "example": "ERIN" + "example": "U009" }, "StatusReasonDescription": { - "description": "Description supporting the StatusReasonCode.", + "description": "Description supporting the `StatusReasonCode`.", "type": "string", "minLength": 1, - "maxLength": 500 + "maxLength": 500, + "example": "The consent is not in a status that allows funds confirmation." }, "Path": { "type": "string", - "description": "Optional reference to the JSON Path of the field when status reason refers to an object/field, e.g., Data.DebtorAccount.SchemeName", + "description": "Optional reference to the JSON Path of the field when status reason refers to an object/field, e.g., `Data.DebtorAccount.SchemeName`", "minLength": 1, - "maxLength": 500 + "maxLength": 500, + "example": "Data.ConsentId" } } } } } -} \ No newline at end of file +} From 79860e12e4eb6e218a79de482f43d2925b5e9b70 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 22 Jul 2026 10:12:46 +0100 Subject: [PATCH 27/36] Update confirmation-funds-openapi.json --- dist/openapi/confirmation-funds-openapi.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dist/openapi/confirmation-funds-openapi.json b/dist/openapi/confirmation-funds-openapi.json index 4605f93..c40b5b0 100644 --- a/dist/openapi/confirmation-funds-openapi.json +++ b/dist/openapi/confirmation-funds-openapi.json @@ -1281,4 +1281,4 @@ } } } -} +} \ No newline at end of file From 32130d4bf92fb31b79294cafdb05ce257cffd189 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Fri, 28 Aug 2026 11:42:31 +0100 Subject: [PATCH 28/36] Update UML diagram descriptions and codes Refresh the SVG UML annotations for funds confirmation and account/transaction models by improving description formatting, clarifying inline field/code references, and updating code set links. Also add the `CRYP` value to the transaction payment purpose code list. --- uml-diagrams/OBFundsConfirmation1.svg | 2 +- uml-diagrams/OBFundsConfirmationConsent1.svg | 19 +++++-- .../OBFundsConfirmationConsentResponse1.svg | 56 +++++++++++++------ uml-diagrams/OBFundsConfirmationResponse1.svg | 20 ++++--- uml-diagrams/OBReadAccount6.svg | 2 +- uml-diagrams/OBReadTransaction6.svg | 1 + 6 files changed, 68 insertions(+), 32 deletions(-) diff --git a/uml-diagrams/OBFundsConfirmation1.svg b/uml-diagrams/OBFundsConfirmation1.svg index 83da973..fdccbf8 100644 --- a/uml-diagrams/OBFundsConfirmation1.svg +++ b/uml-diagrams/OBFundsConfirmation1.svg @@ -48,7 +48,7 @@ Reference [1..1] -Amount of money to be confirmed as available funds in the debtor account. Contains an Amount and a Currency. +Amount of money to be confirmed as available funds in the debtor account. Contains an `Amount` and a `Currency`. InstructedAmount diff --git a/uml-diagrams/OBFundsConfirmationConsent1.svg b/uml-diagrams/OBFundsConfirmationConsent1.svg index a2c56b9..765b413 100644 --- a/uml-diagrams/OBFundsConfirmationConsent1.svg +++ b/uml-diagrams/OBFundsConfirmationConsent1.svg @@ -32,9 +32,12 @@ Data Type: string Format: date-time Description: Specified date and time the funds confirmation authorisation will expire. - If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. + +If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. + All date-time fields in responses must include the timezone. An example is below: -2017-04-05T10:43:07+00:00 + +`2017-04-05T10:43:07+00:00` ExpirationDateTime [0..1] @@ -59,6 +62,7 @@ Identification [1..1] MinLength: 1 MaxLength: 350 Description: Name of the account, as assigned by the account servicing institution. + Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account. Name [0..1] @@ -66,7 +70,9 @@ Name [0..1] Type: string -Description: Name of the identification scheme, in a coded form as published in an external list. For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) +Description: Name of the identification scheme, in a coded form as published in an external list. + +For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv) Values: - UK.OBIE.BBAN - UK.OBIE.IBAN @@ -82,7 +88,8 @@ SchemeName [1..1] <title>Type: string MinLength: 1 MaxLength: 34 -Description: This is secondary identification of the account, as assigned by the account servicing institution. +Description: This is secondary identification of the account, as assigned by the account servicing institution. + This can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination). SecondaryIdentification [0..1] @@ -96,7 +103,9 @@ Proxy Type: string -Description: Specifies the external proxy account type code, as published in the proxy account type external code set.<br > For a full list of values refer to `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) +Description: Specifies the external proxy account type code, as published in the proxy account type external code set. + +For a full list of values refer to `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/ISO_External_Codeset.csv) Values: - TELE - EMAL diff --git a/uml-diagrams/OBFundsConfirmationConsentResponse1.svg b/uml-diagrams/OBFundsConfirmationConsentResponse1.svg index e6c9e78..da0823b 100644 --- a/uml-diagrams/OBFundsConfirmationConsentResponse1.svg +++ b/uml-diagrams/OBFundsConfirmationConsentResponse1.svg @@ -40,9 +40,11 @@ ConsentId [1..1] <text x="36em" y="5.6em" fill="darkslateblue"> <title>Type: string Format: date-time -Description: Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. +Description: Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. + All date-time fields in responses must include the timezone. An example is below: -2017-04-05T10:43:07+00:00 + +`2017-04-05T10:43:07+00:00` CreationDateTime [1..1] @@ -51,16 +53,21 @@ CreationDateTime [1..1] Type: string Format: date-time Description: Specified date and time the funds confirmation authorisation will expire. -If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. + +If this is not populated, the authorisation will be open ended. All dates in the JSON payloads are represented in ISO 8601 date-time format. + All date-time fields in responses must include the timezone. An example is below: -2017-04-05T10:43:07+00:00 + +`2017-04-05T10:43:07+00:00` ExpirationDateTime [0..1] Type: string -Description: Specifies the status of consent resource in code form. For a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) +Description: Specifies the status of consent resource in code form. + +For a full list of values refer to `OBInternalConsentStatus1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv) Values: - AWAU - RJCT @@ -74,9 +81,11 @@ Status [1..1] <text x="36em" y="9.5em" fill="darkslateblue"> <title>Type: string Format: date-time -Description: Date and time at which the resource status was updated. All dates in the JSON payloads are represented in ISO 8601 date-time format. +Description: Date and time at which the resource status was updated. All dates in the JSON payloads are represented in ISO 8601 date-time format. + All date-time fields in responses must include the timezone. An example is below: -2017-04-05T10:43:07+00:00 + +`2017-04-05T10:43:07+00:00` StatusUpdateDateTime [1..1] @@ -101,6 +110,7 @@ Identification [1..1] MinLength: 1 MaxLength: 350 Description: Name of the account, as assigned by the account servicing institution. + Usage: The account name is the name or names of the account owner(s) represented at an account level. The account name is not the product name or the nickname of the account. Name [0..1] @@ -108,7 +118,9 @@ Name [0..1] Type: string -Description: Name of the identification scheme, in a coded form as published in an external list. For a full list of values refer to `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) +Description: Name of the identification scheme, in a coded form as published in an external list. + +For a full list of values see `OBInternalAccountIdentification4Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/OB_Internal_Codeset.csv) Values: - UK.OBIE.BBAN - UK.OBIE.IBAN @@ -124,7 +136,8 @@ SchemeName [1..1] <title>Type: string MinLength: 1 MaxLength: 34 -Description: This is secondary identification of the account, as assigned by the account servicing institution. +Description: This is secondary identification of the account, as assigned by the account servicing institution. + This can be used by building societies to additionally identify accounts with a roll number (in addition to a sort code and account number combination). SecondaryIdentification [0..1] @@ -138,7 +151,9 @@ Proxy Type: string -Description: Specifies the external proxy account type code, as published in the proxy account type external code set.<br > For a full list of values refer to `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) +Description: Specifies the external proxy account type code, as published in the proxy account type external code set. + +For a full list of values refer to `ExternalProxyAccountType1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets/blob/main/ISO_External_Codeset.csv) Values: - TELE - EMAL @@ -193,7 +208,7 @@ StatusReason <title>Type: string MinLength: 1 MaxLength: 500 -Description: Optional reference to the JSON Path of the field when status reason refers to an object/field, e.g., Data.DebtorAccount.SchemeName +Description: Optional reference to the JSON Path of the field when status reason refers to an object/field, e.g., `Data.DebtorAccount.SchemeName` Path [0..1] @@ -202,8 +217,9 @@ Path [0..1] Type: string MinLength: 1 MaxLength: 4 -Description: Specifies the status reason in a code form. - For a full list of values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) +Description: Specifies the status reason in a code form. + +For a full list of values see `OBExternalStatusReason1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_Internal_CodeSets) StatusReasonCode [0..1] @@ -212,7 +228,7 @@ StatusReasonCode [0..1] Type: string MinLength: 1 MaxLength: 500 -Description: Description supporting the StatusReasonCode. +Description: Description supporting the `StatusReasonCode`. StatusReasonDescription [0..1] @@ -267,9 +283,11 @@ Meta Type: string Format: date-time -Description: All dates in the JSON payloads are represented in ISO 8601 date-time format. +Description: All dates in the JSON payloads are represented in ISO 8601 date-time format. + All date-time fields in responses must include the timezone. An example is below: -2017-04-05T10:43:07+00:00 + +`2017-04-05T10:43:07+00:00` FirstAvailableDateTime [0..1] @@ -277,9 +295,11 @@ FirstAvailableDateTime [0..1] Type: string Format: date-time -Description: All dates in the JSON payloads are represented in ISO 8601 date-time format. +Description: All dates in the JSON payloads are represented in ISO 8601 date-time format. + All date-time fields in responses must include the timezone. An example is below: -2017-04-05T10:43:07+00:00 + +`2017-04-05T10:43:07+00:00` LastAvailableDateTime [0..1] diff --git a/uml-diagrams/OBFundsConfirmationResponse1.svg b/uml-diagrams/OBFundsConfirmationResponse1.svg index a424e08..0a56dfe 100644 --- a/uml-diagrams/OBFundsConfirmationResponse1.svg +++ b/uml-diagrams/OBFundsConfirmationResponse1.svg @@ -40,9 +40,11 @@ ConsentId [1..1] Type: string Format: date-time -Description: Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. +Description: Date and time at which the resource was created. All dates in the JSON payloads are represented in ISO 8601 date-time format. + All date-time fields in responses must include the timezone. An example is below: -2017-04-05T10:43:07+00:00 + +`2017-04-05T10:43:07+00:00` CreationDateTime [1..1] @@ -74,7 +76,7 @@ Reference [1..1] -Amount of money to be confirmed as available funds in the debtor account. Contains an Amount and a Currency. +Amount of money to be confirmed as available funds in the debtor account. Contains an `Amount` and a `Currency`. InstructedAmount @@ -144,9 +146,11 @@ Meta Type: string Format: date-time -Description: All dates in the JSON payloads are represented in ISO 8601 date-time format. +Description: All dates in the JSON payloads are represented in ISO 8601 date-time format. + All date-time fields in responses must include the timezone. An example is below: -2017-04-05T10:43:07+00:00 + +`2017-04-05T10:43:07+00:00` FirstAvailableDateTime [0..1] @@ -154,9 +158,11 @@ FirstAvailableDateTime [0..1] Type: string Format: date-time -Description: All dates in the JSON payloads are represented in ISO 8601 date-time format. +Description: All dates in the JSON payloads are represented in ISO 8601 date-time format. + All date-time fields in responses must include the timezone. An example is below: -2017-04-05T10:43:07+00:00 + +`2017-04-05T10:43:07+00:00` LastAvailableDateTime [0..1] diff --git a/uml-diagrams/OBReadAccount6.svg b/uml-diagrams/OBReadAccount6.svg index c283a98..88a5794 100644 --- a/uml-diagrams/OBReadAccount6.svg +++ b/uml-diagrams/OBReadAccount6.svg @@ -287,7 +287,7 @@ CommunicationMethod [0..1] Type: string -Description: For a full list of enumeration values refer to `ExternalDocumentFormat1Code` in *OB_Internal_CodeSet* [here](https://github.com/OpenBankingUK/External_internal_CodeSets) +Description: For a full list of enumeration values refer to `ExternalDocumentFormat1Code` in *ISO_External_CodeSet* [here](https://github.com/OpenBankingUK/External_internal_CodeSets) Values: - DPDF - DXML diff --git a/uml-diagrams/OBReadTransaction6.svg b/uml-diagrams/OBReadTransaction6.svg index 5415891..9c96b0d 100644 --- a/uml-diagrams/OBReadTransaction6.svg +++ b/uml-diagrams/OBReadTransaction6.svg @@ -461,6 +461,7 @@ Values: - DEPD - RETL - DEBT + - CRYP PaymentPurposeCode [0..1] From 295ddc890a3d8d8bfe7888c50edf43b3c937c15e Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 2 Sep 2026 16:29:11 +0100 Subject: [PATCH 29/36] Fix AIS debtor account required fields Add the missing required constraint for SchemeName and Identification on the AIS debtor account schema and document the Update 1 fix. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- changelog.md | 1 + dist/openapi/account-info-openapi.json | 4 ++++ dist/openapi/account-info-openapi.yaml | 3 +++ 3 files changed, 8 insertions(+) diff --git a/changelog.md b/changelog.md index 728de33..d84c012 100644 --- a/changelog.md +++ b/changelog.md @@ -119,6 +119,7 @@ This update covers Swagger/OpenAPI refinements for the Confirmation of Funds (CB ### Fixed +- [CDRW-5054] Made `SchemeName` and `Identification` required on AIS `OBCashAccount6_1` to align `OBReadTransaction6/Data/Transaction/DebtorAccount` with `OBCashAccountDebtorWithName`. - [CDRW-4136] Updated description of `OBExternalStatusReason1Code` to point to correct codeset name in AIS, PIS, CBPII, Events and VRP. - [CDRW-5043] Corrected typos and improved description clarity across all OpenAPI specification files: - Fixed double word "as as" to "as" in top-level description (AIS, CBPII, Events, PIS, VRP) diff --git a/dist/openapi/account-info-openapi.json b/dist/openapi/account-info-openapi.json index 3ed37b8..ea13a99 100644 --- a/dist/openapi/account-info-openapi.json +++ b/dist/openapi/account-info-openapi.json @@ -7041,6 +7041,10 @@ "OBCashAccount6_1": { "type": "object", "description": "Unambiguous identification of the account of the debtor, in the case of a credit transaction.", + "required": [ + "SchemeName", + "Identification" + ], "properties": { "SchemeName": { "$ref": "#/components/schemas/OBInternalAccountIdentification4Code" diff --git a/dist/openapi/account-info-openapi.yaml b/dist/openapi/account-info-openapi.yaml index 6b11d77..7976cc8 100644 --- a/dist/openapi/account-info-openapi.yaml +++ b/dist/openapi/account-info-openapi.yaml @@ -5683,6 +5683,9 @@ components: description: >- Unambiguous identification of the account of the debtor, in the case of a credit transaction. + required: + - SchemeName + - Identification properties: SchemeName: $ref: '#/components/schemas/OBInternalAccountIdentification4Code' From 5a0869555122b586abf1daf9e0108636f8dd5902 Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 2 Sep 2026 16:34:00 +0100 Subject: [PATCH 30/36] Clarify AIS debtor changelog entry Clarify that the AIS debtor account required-field fix is an Update 1 correction for alignment intended in the v4.0.1 baseline. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- changelog.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changelog.md b/changelog.md index d84c012..aecb6f0 100644 --- a/changelog.md +++ b/changelog.md @@ -119,7 +119,7 @@ This update covers Swagger/OpenAPI refinements for the Confirmation of Funds (CB ### Fixed -- [CDRW-5054] Made `SchemeName` and `Identification` required on AIS `OBCashAccount6_1` to align `OBReadTransaction6/Data/Transaction/DebtorAccount` with `OBCashAccountDebtorWithName`. +- [CDRW-5054] Corrected AIS `OBCashAccount6_1` in Update 1 by making `SchemeName` and `Identification` required for `OBReadTransaction6/Data/Transaction/DebtorAccount`; this completes the `OBCashAccountDebtorWithName` alignment that was intended for the v4.0.1 baseline. - [CDRW-4136] Updated description of `OBExternalStatusReason1Code` to point to correct codeset name in AIS, PIS, CBPII, Events and VRP. - [CDRW-5043] Corrected typos and improved description clarity across all OpenAPI specification files: - Fixed double word "as as" to "as" in top-level description (AIS, CBPII, Events, PIS, VRP) From b83190da1dd6330fb3a13148293e6c2be5f9d7fb Mon Sep 17 00:00:00 2001 From: cjrobbertse-ob Date: Wed, 2 Sep 2026 16:35:38 +0100 Subject: [PATCH 31/36] Move AIS debtor changelog item to Update 1 Move the AIS debtor account required-field correction into the Swagger Update 1 changelog section. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- changelog.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/changelog.md b/changelog.md index aecb6f0..aa6ff02 100644 --- a/changelog.md +++ b/changelog.md @@ -49,6 +49,10 @@ This update covers Swagger/OpenAPI refinements for the Confirmation of Funds (CB - Removed **unused** CBPII response/schema components `404Error` and `Identification_0`. - Removed **unused** CBPII header parameter `x-idempotency-key` (CBPII has no idempotent endpoints). +### Fixed + +- [CDRW-5054] Corrected AIS `OBCashAccount6_1` in Update 1 by making `SchemeName` and `Identification` required for `OBReadTransaction6/Data/Transaction/DebtorAccount`; this completes the `OBCashAccountDebtorWithName` alignment that was intended for the v4.0.1 baseline. + ## v4.0.1 - 2026-04-01 ### Added @@ -119,7 +123,6 @@ This update covers Swagger/OpenAPI refinements for the Confirmation of Funds (CB ### Fixed -- [CDRW-5054] Corrected AIS `OBCashAccount6_1` in Update 1 by making `SchemeName` and `Identification` required for `OBReadTransaction6/Data/Transaction/DebtorAccount`; this completes the `OBCashAccountDebtorWithName` alignment that was intended for the v4.0.1 baseline. - [CDRW-4136] Updated description of `OBExternalStatusReason1Code` to point to correct codeset name in AIS, PIS, CBPII, Events and VRP. - [CDRW-5043] Corrected typos and improved description clarity across all OpenAPI specification files: - Fixed double word "as as" to "as" in top-level description (AIS, CBPII, Events, PIS, VRP) From 66eff3a28e804ed32ba8c588241d596e382e72d0 Mon Sep 17 00:00:00 2001 From: Peter Stanley <129527932+OBPeteS@users.noreply.github.com> Date: Wed, 2 Sep 2026 16:48:41 +0100 Subject: [PATCH 32/36] Update changelog.md Update ref for Transaction payload changes in changelog --- changelog.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changelog.md b/changelog.md index aa6ff02..ea94328 100644 --- a/changelog.md +++ b/changelog.md @@ -51,7 +51,7 @@ This update covers Swagger/OpenAPI refinements for the Confirmation of Funds (CB ### Fixed -- [CDRW-5054] Corrected AIS `OBCashAccount6_1` in Update 1 by making `SchemeName` and `Identification` required for `OBReadTransaction6/Data/Transaction/DebtorAccount`; this completes the `OBCashAccountDebtorWithName` alignment that was intended for the v4.0.1 baseline. +- [v401_KI_2] Corrected AIS `OBCashAccount6_1` in Update 1 by making `SchemeName` and `Identification` required for `OBReadTransaction6/Data/Transaction/DebtorAccount`; this completes the `OBCashAccountDebtorWithName` alignment that was intended for the v4.0.1 baseline. ## v4.0.1 - 2026-04-01 From 7ef87dbe1c2918d8d59eaaf7bfb0ae661c324528 Mon Sep 17 00:00:00 2001 From: Peter Stanley <129527932+OBPeteS@users.noreply.github.com> Date: Fri, 18 Sep 2026 10:26:15 +0100 Subject: [PATCH 33/36] Update OBReadTransaction6.svg Updated mandatory status of `SchemeName` and `Identification`. in Transactions UNL diagram --- uml-diagrams/OBReadTransaction6.svg | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/uml-diagrams/OBReadTransaction6.svg b/uml-diagrams/OBReadTransaction6.svg index 9c96b0d..b81d88a 100644 --- a/uml-diagrams/OBReadTransaction6.svg +++ b/uml-diagrams/OBReadTransaction6.svg @@ -1125,7 +1125,7 @@ MinLength: 1 MaxLength: 256 Description: Identification assigned by an institution to identify an account. This identification is known by the account owner. -Identification [0..1] +Identification [1..1] @@ -1149,7 +1149,7 @@ Values: - UK.OBIE.SortCodeAccountNumber - UK.OBIE.Wallet -SchemeName [0..1] +SchemeName [1..1] From 1b16ca1108d7771bd88b8688f3053ba4fdc0d1e9 Mon Sep 17 00:00:00 2001 From: Peter Stanley <129527932+OBPeteS@users.noreply.github.com> Date: Fri, 18 Sep 2026 10:30:39 +0100 Subject: [PATCH 34/36] Update changelog.md Added release date --- changelog.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changelog.md b/changelog.md index ea94328..03aa47f 100644 --- a/changelog.md +++ b/changelog.md @@ -14,7 +14,7 @@ For v4.0.1 the following approach has been adopted for identifying changes: - [v4.0.1 Release Candidate 1](https://openbanking.atlassian.net/wiki/spaces/WOR/pages/4203282434/Feedback+-+v4.0.1+Release+Candidate+1) - [v4.0.1 Release Candidate 2](https://openbanking.atlassian.net/wiki/spaces/WOR/pages/4309942273/Feedback+-+v4.0.1+Release+Candidate+2) -## v4.0.1 Swagger Update 1 - TBD +## v4.0.1 Swagger Update 1 - 2026-09-18 This update covers Swagger/OpenAPI refinements for the Confirmation of Funds (CBPII) API in v4.0.1. From 1a6fc3c3f99b47a80f8304442c63c3f36b25afff Mon Sep 17 00:00:00 2001 From: Peter Stanley <129527932+OBPeteS@users.noreply.github.com> Date: Fri, 18 Sep 2026 11:30:25 +0100 Subject: [PATCH 35/36] Updated jws exmaple --- dist/openapi/confirmation-funds-openapi.json | 4 ++-- dist/openapi/confirmation-funds-openapi.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/dist/openapi/confirmation-funds-openapi.json b/dist/openapi/confirmation-funds-openapi.json index c40b5b0..4e077ae 100644 --- a/dist/openapi/confirmation-funds-openapi.json +++ b/dist/openapi/confirmation-funds-openapi.json @@ -397,7 +397,7 @@ "description": "A detached JWS signature of the body of the payload.", "schema": { "type": "string", - "example": "eyJ...header.eyJ...payload.signature" + "example": "eyJhbGciOiJQUzI1NiIsInR5cCI6IkpPU0UiLCJraWQiOiJUYTRPbGp6d1dpWFNWV0V6NmYwT2lBUzJqMEkiLCJjdHkiOiJhcHBsaWNhdGlvbi9qc29uIiwiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay9pYXQiOjE3ODk3MjcwMDEsImh0dHA6Ly9vcGVuYmFua2luZy5vcmcudWsvaXNzIjoiMDAxNTgwMDAwMTA0MVJIQUFZIiwiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay90YW4iOiJvcGVuYmFua2luZy5vcmcudWsiLCJjcml0IjpbImh0dHA6Ly9vcGVuYmFua2luZy5vcmcudWsvaWF0IiwiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay9pc3MiLCJodHRwOi8vb3BlbmJhbmtpbmcub3JnLnVrL3RhbiJdfQ..2L_TlbsBGKWVZ4g9EDDJP5TDe5spMxToBrZf9WxnLzgYZXwXWmD0bc3__5MnZE4t4gt_azsn0wDMuVgnCxfpKTCIehtLkXrgtD9XCP0UM37pwoEODqBnPVNnENwU2_dSvHmvjOHi0zVbNLK_bHY-fo2enDjKfVk0DWyPuKX8zgsEvQrouPtB2yP4zbCl89YrY2TriKSkem6YlQd3KkSK6vtWKVJU_Ec11W2KVd6V_TA6goVZZkTx5uLVD_ygfsHMPHKD7t4u_2IleXOtgRoXxOZ0kFF0Ghsk9IbGJbcLYg7LudsIGMBFt-577sNJNJmPSXv4W5AC6Avmn2te-AInjw" } }, "x-client-id": { @@ -433,7 +433,7 @@ "description": "A detached JWS signature of the body of the payload.", "schema": { "type": "string", - "example": "eyJ...header.eyJ...payload.signature" + "example": "eyJhbGciOiJQUzI1NiIsInR5cCI6IkpPU0UiLCJraWQiOiJUYTRPbGp6d1dpWFNWV0V6NmYwT2lBUzJqMEkiLCJjdHkiOiJhcHBsaWNhdGlvbi9qc29uIiwiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay9pYXQiOjE3ODk3MjcwMDEsImh0dHA6Ly9vcGVuYmFua2luZy5vcmcudWsvaXNzIjoiMDAxNTgwMDAwMTA0MVJIQUFZIiwiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay90YW4iOiJvcGVuYmFua2luZy5vcmcudWsiLCJjcml0IjpbImh0dHA6Ly9vcGVuYmFua2luZy5vcmcudWsvaWF0IiwiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay9pc3MiLCJodHRwOi8vb3BlbmJhbmtpbmcub3JnLnVrL3RhbiJdfQ..2L_TlbsBGKWVZ4g9EDDJP5TDe5spMxToBrZf9WxnLzgYZXwXWmD0bc3__5MnZE4t4gt_azsn0wDMuVgnCxfpKTCIehtLkXrgtD9XCP0UM37pwoEODqBnPVNnENwU2_dSvHmvjOHi0zVbNLK_bHY-fo2enDjKfVk0DWyPuKX8zgsEvQrouPtB2yP4zbCl89YrY2TriKSkem6YlQd3KkSK6vtWKVJU_Ec11W2KVd6V_TA6goVZZkTx5uLVD_ygfsHMPHKD7t4u_2IleXOtgRoXxOZ0kFF0Ghsk9IbGJbcLYg7LudsIGMBFt-577sNJNJmPSXv4W5AC6Avmn2te-AInjw" } } }, diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index d166815..3a51eb1 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -265,7 +265,7 @@ components: description: A detached JWS signature of the body of the payload. schema: type: string - example: eyJ...header.eyJ...payload.signature + example: eyJhbGciOiJQUzI1NiIsInR5cCI6IkpPU0UiLCJraWQiOiJUYTRPbGp6d1dpWFNWV0V6NmYwT2lBUzJqMEkiLCJjdHkiOiJhcHBsaWNhdGlvbi9qc29uIiwiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay9pYXQiOjE3ODk3MjcwMDEsImh0dHA6Ly9vcGVuYmFua2luZy5vcmcudWsvaXNzIjoiMDAxNTgwMDAwMTA0MVJIQUFZIiwiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay90YW4iOiJvcGVuYmFua2luZy5vcmcudWsiLCJjcml0IjpbImh0dHA6Ly9vcGVuYmFua2luZy5vcmcudWsvaWF0IiwiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay9pc3MiLCJodHRwOi8vb3BlbmJhbmtpbmcub3JnLnVrL3RhbiJdfQ..2L_TlbsBGKWVZ4g9EDDJP5TDe5spMxToBrZf9WxnLzgYZXwXWmD0bc3__5MnZE4t4gt_azsn0wDMuVgnCxfpKTCIehtLkXrgtD9XCP0UM37pwoEODqBnPVNnENwU2_dSvHmvjOHi0zVbNLK_bHY-fo2enDjKfVk0DWyPuKX8zgsEvQrouPtB2yP4zbCl89YrY2TriKSkem6YlQd3KkSK6vtWKVJU_Ec11W2KVd6V_TA6goVZZkTx5uLVD_ygfsHMPHKD7t4u_2IleXOtgRoXxOZ0kFF0Ghsk9IbGJbcLYg7LudsIGMBFt-577sNJNJmPSXv4W5AC6Avmn2te-AInjw x-client-id: in: header name: x-client-id @@ -317,7 +317,7 @@ components: description: A detached JWS signature of the body of the payload. schema: type: string - example: eyJ...header.eyJ...payload.signature + example: eyJhbGciOiJQUzI1NiIsInR5cCI6IkpPU0UiLCJraWQiOiJUYTRPbGp6d1dpWFNWV0V6NmYwT2lBUzJqMEkiLCJjdHkiOiJhcHBsaWNhdGlvbi9qc29uIiwiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay9pYXQiOjE3ODk3MjcwMDEsImh0dHA6Ly9vcGVuYmFua2luZy5vcmcudWsvaXNzIjoiMDAxNTgwMDAwMTA0MVJIQUFZIiwiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay90YW4iOiJvcGVuYmFua2luZy5vcmcudWsiLCJjcml0IjpbImh0dHA6Ly9vcGVuYmFua2luZy5vcmcudWsvaWF0IiwiaHR0cDovL29wZW5iYW5raW5nLm9yZy51ay9pc3MiLCJodHRwOi8vb3BlbmJhbmtpbmcub3JnLnVrL3RhbiJdfQ..2L_TlbsBGKWVZ4g9EDDJP5TDe5spMxToBrZf9WxnLzgYZXwXWmD0bc3__5MnZE4t4gt_azsn0wDMuVgnCxfpKTCIehtLkXrgtD9XCP0UM37pwoEODqBnPVNnENwU2_dSvHmvjOHi0zVbNLK_bHY-fo2enDjKfVk0DWyPuKX8zgsEvQrouPtB2yP4zbCl89YrY2TriKSkem6YlQd3KkSK6vtWKVJU_Ec11W2KVd6V_TA6goVZZkTx5uLVD_ygfsHMPHKD7t4u_2IleXOtgRoXxOZ0kFF0Ghsk9IbGJbcLYg7LudsIGMBFt-577sNJNJmPSXv4W5AC6Avmn2te-AInjw responses: 201FundsConfirmationConsentsCreated: description: Funds Confirmation Consent Created From cb6bf12eb654249ec76a0970f8c73fe402f2ff1c Mon Sep 17 00:00:00 2001 From: Peter Stanley <129527932+OBPeteS@users.noreply.github.com> Date: Fri, 18 Sep 2026 11:40:20 +0100 Subject: [PATCH 36/36] Update CBPII auth header RFC link Refresh the Confirmation of Funds OpenAPI `Authorization` header description to use the current RFC 6750 datatracker URL in both YAML and generated JSON --- changelog.md | 3 ++- dist/openapi/confirmation-funds-openapi.json | 2 +- dist/openapi/confirmation-funds-openapi.yaml | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/changelog.md b/changelog.md index 03aa47f..8fad108 100644 --- a/changelog.md +++ b/changelog.md @@ -31,7 +31,7 @@ This update covers Swagger/OpenAPI refinements for the Confirmation of Funds (CB - Updated the duplicate CBPII OpenAPI JSON output generated from the YAML source so the YAML and JSON Swagger artefacts stay aligned. - Standardised CBPII OpenAPI description formatting for consistency (single-line where suitable, `>-`/`|-` block scalar usage where appropriate, paragraph spacing, inline code formatting, and emphasised notes). - Updated CBPII security scheme, error model and account proxy descriptions to align with Open Banking/FAPI context and improve clarity. -- Updated `x-jws-signature` to be optional in CBPII request/response modelling to align with the Open Banking spec pages/standard. +- Updated `x-jws-signature` to be optional in CBPII request/response modelling to align with the Open Banking spec pages/standard. Additionally a fully formed example value has been provided in the OpenAPI specification. - Updated CBPII enum descriptions to link directly to the relevant codeset CSV files. - Refactored CBPII `OBInternalAccountIdentification4Code` into a reusable schema reference. - Refactored CBPII Confirmation of Funds OpenAPI data dictionary schemas to use reusable component references aligned to the spec pages: @@ -43,6 +43,7 @@ This update covers Swagger/OpenAPI refinements for the Confirmation of Funds (CB - `OBFundsConfirmation1/Data/InstructedAmount` and `OBFundsConfirmationResponse1/Data/InstructedAmount` now reference `OBActiveOrHistoricCurrencyAndAmount` - `OBFundsConfirmation1/Data/InstructedAmount/Amount` and `OBFundsConfirmationResponse1/Data/InstructedAmount/Amount` now reference `OBActiveCurrencyAndAmount_SimpleType` - `OBFundsConfirmation1/Data/InstructedAmount/Currency` and `OBFundsConfirmationResponse1/Data/InstructedAmount/Currency` now reference `ActiveOrHistoricCurrencyCode` + - Updated link to RFC 6750 in the `Authorization` header description. ### Removed diff --git a/dist/openapi/confirmation-funds-openapi.json b/dist/openapi/confirmation-funds-openapi.json index 4e077ae..64076aa 100644 --- a/dist/openapi/confirmation-funds-openapi.json +++ b/dist/openapi/confirmation-funds-openapi.json @@ -343,7 +343,7 @@ "in": "header", "name": "Authorization", "required": true, - "description": "An Authorisation Token as per ", + "description": "An Authorisation Token as per ", "schema": { "type": "string", "example": "Bearer " diff --git a/dist/openapi/confirmation-funds-openapi.yaml b/dist/openapi/confirmation-funds-openapi.yaml index 3a51eb1..837c189 100644 --- a/dist/openapi/confirmation-funds-openapi.yaml +++ b/dist/openapi/confirmation-funds-openapi.yaml @@ -216,7 +216,7 @@ components: in: header name: Authorization required: true - description: An Authorisation Token as per + description: An Authorisation Token as per schema: type: string example: Bearer