Open banking client API specifications

Replace VPN with Public Key Infrastructure

These methods must be developed with PKI,(Contis has used x509 certificates to implement PKI. There will be 2 pairs of PKI certificates (Public & Private)

Client certificates.
Contis certificates

Client must share their certificate/public key with Contis, the certificate can be provided by you, alternatively Contis can generate the certificate pair. Contis will encrypt the sensitive field data using client’s public key and then whole request payload will be used to generate digital signature using Contis’ private key. This signature will be passed in request header as “x-signature” field.

Contis will share certificate/public key to client(s) to verify the signature generated & passed in each request by Contis. This public key will be used to verify the digital signature which can be found in request header as “x-signature” field at client end. This key can be used to encrypt any sensitive field(s) such as password, OTP etc. if it is passed in response. If any such fields found in response, Contis will decrypt those using Contis’ private key for further use.

For example:

Client certificate pair:

Contis certificate pair:

Contis will encrypt OTP = “12345678” using client public key will be

Z4aLdv/PDodBy2rQvHICPu52Xv8LxUpt/DH3n01V9uWIbUpWREkoayT0kDizogk
vuO+aDogiVxbWDyDV4u2ua/u24O0KSG6gqRSjL9aOkuFSgQl9yy3MVcHcMRyuyl
FWTTIH9GAw0c+ghKBvXtq4caUe3IrSKUNIbx7E3b7bpmHrlEVQs1PXl8OAg62Nk
4b/3ya6tfmNpzdYIrR+k6m50zHqGHInA1IE6/4vwmmBI0IUILWz1Kk7PRcgl5Wc
newi8YqkCKB1Wo7hGrKosuqNRyZz0rooK0a9MtLnbmJTxmpG9c8+aXnSqvj0UGp
eI6RPW+aUKoSf0nz70YkXsoV5zw==

This value will be passed in request data field OTPCode. Which client need to decrypt using their associated private key.
To generate signature, Contis will use their private key.

For example request,

Username: testUser
Password: testPassword

Password will be encrypted with client public key. So client can decrypt it with private key at their end.

So here, as per above Public/Private keys set.

Password will be a,

JwhxoahH+qH0DT3bF4JgzfdM33aIKXwdmv+NZNK+EE4Vigp26ShiQ4W+GOh+gKIS
F7L2BUhP0F4lNVxSUqJtuL6uWLkZG3ExNNDdqG17/Qw28udxe0hj0y//JXmB7reL
C15SN68cJr6wUATC0R4oGmZ4/NoEM3xtvtMfh9ar/WYGpR1vEYEX3wpq/z6id5N7
ISuxepJDNpv6cFI5Rhae0IWEMqsE6T9PXo4py/cArclfFZ+fec3oSR4gQ1spTc+4
cSjrW2KtUyZxhddLJlWw3CcQyXirasZW5DM6SUyuQPq/DA3Y829OuqNi5MM/r/R/
qkEGgnFBH2NNjpxWxf20zg==

Request:

{
    "Username": "testUser", 
    "Password": "JwhxoahH+qH0DT3bF4JgzfdM33aIKXwdmv+NZNK+EE4Vigp2
                 6ShiQ4W+GOh+gKISF7L2BUhP0F4lNVxSUqJtuL6uWLkZG3Ex
                 NNDdqG17/Qw28udxe0hj0y//JXmB7reLC15SN68cJr6wUATC
                 0R4oGmZ4/NoEM3xtvtMfh9ar/WYGpR1vEYEX3wpq/z6id5N7
                 ISuxepJDNpv6cFI5Rhae0IWEMqsE6T9PXo4py/cArclfFZ+f
                 ec3oSR4gQ1spTc+4cSjrW2KtUyZxhddLJlWw3CcQyXirasZW
                 5DM6SUyuQPq/DA3Y829OuqNi5MM/r/R/qkEGgnFBH2NNjpxW
                 xf20zg==", 
    "RequestReference": "Test Request"
}

Signature of the above request will be

bozrGbY3qz/TpYtImKAaxdJapzmzqTRKOljTKbQCPLxlvf9LHTwC43+LIK48CaqhL
BkzKk0UGBPqMwgCEZzi8m9y86O/A1tT1aHSAthFldndTjtj/HjKhh2Dk3luf4tuW+
UkfZgmI6vBmfTGRKslMFWm/q3X4zP5ktjmRMwmpmzz5DbSx/hFzDEqLZpBscANR5U
50by+d+0RU/kHS3M4PqKp2bZDVSSwFZ1eGJOIcHy2yy2qya1+SIoq4sSBI1dE3SB5
WpMKSWu6pC1M/okibsEOCHnnZbYHmGF8PQDVmUSKQBkz6nW/8U3znh5su1MbzPAuC
i9B9OQagPXm+JoT9w==

which will be passed in request header in “x-signature” request header.

Similarly, contis will generate and pass digital signature for each request. In response, client has to generate the signature using client’s private key of response payload which will be verified by contis at their end using client’s public key. If any sensitive data fields are there in response, client has to encrypt it using contis’ public key and then need to generate signature of response payload.

Specifications:

M = Mandatory O= Optional

Client API

VerifyConsumerCredential

Client is responsible to block the Consumer Login, when consumer is failed to provide correct username and password.

Request object: VerifyConsumerCredentialReq

DataMember	Type	Required M/O	Remarks
Username	string (100)	M	Consumer username
Password	string (400)	M	This input will be encrypted using client public key.
RequestReference	string (50)	M	Unique Reference number associated with API request. Should provide reference number in each API request for tracking/auditing purpose of actions performed at contis platform.

Response object: VerifyConsumerCredentialRes

DataMember	Type	Required M/O	Remarks
ConsumerID	integer	M	ConsumerID provided by Contis at time of creating new Consumer.
ResponseCode	enum	M	Any of response code provided by Contis.
ResponseMessage	string (200)	O	Response message in case of error/success description.
RequestReference	string (50)	M	Should provide reference number in each API request for tracking/auditing purpose of actions performed at contis platform.

Custom Enum DataType:

Enum	ResponseCode
0	Success
200	Invalid Credential
500	Internal Error
400	Invalid Request
404	Consumer Not Found

BlockConsumerLogin

Contis will call this method to block consumer login at client end, when consumer will be failed to provide correct OTP.

Request object: BlockConsumerLoginReq

DataMember	Type	Required M/O	Remarks
ConsumerID	integer	M	ConsumerID returned during successful VerifyConsumerCredential request.
RequestReference	string (50)	M	Unique Reference number associated with API request. Should provide reference number in each API request for tracking/auditing purpose of actions performed at contis platform.

Response object: BlockConsumerLoginRes

DataMember	Type	Required M/O	Remarks
ResponseCode	enumresponsecode	M	Any of response code provided by Contis.
ResponseMessage	string (200)	O	Response message in case of error/success description.
RequestReference	string (50)	M	Should provide reference number in each API request for tracking/auditing purpose of actions performed at contis platform.

Contis API

Once, Consumer has approved the access consent of their account(s), Contis is allowing their Consumer to revoke the access any time they wish.

To achieve this function Contis has developed Consent APIs.

For more detail of implementation, please follow the link below,

https://sandboxapireference.contis.com/docs/API/Consent

VerifyConsumerCredential

Request:

{
    "Username": "testUser",
    "Password": "JwhxoahH+qH0DT3bF4JgzfdM33aIKXwdmv+NZNK+EE4Vigp26Shi
                 Q4W+GOh+gKISF7L2BUhP0F4lNVxSUqJtuL6uWLkZG3ExNNDdqG17
                 /Qw28udxe0hj0y//JXmB7reLC15SN68cJr6wUATC0R4oGmZ4/NoE
                 M3xtvtMfh9ar/WYGpR1vEYEX3wpq/z6id5N7ISuxepJDNpv6cFI5
                 Rhae0IWEMqsE6T9PXo4py/cArclfFZ+fec3oSR4gQ1spTc+4cSjr
                 W2KtUyZxhddLJlWw3CcQyXirasZW5DM6SUyuQPq/DA3Y829OuqNi
                 5MM/r/R/qkEGgnFBH2NNjpxWxf20zg==",
    "RequestReference": "Test Request"
}

Signature of the above request will be

bozrGbY3qz/TpYtImKAaxdJapzmzqTRKOljTKbQCPLxlvf9LHTwC43+LIK48CaqhLBkzKk
0UGBPqMwgCEZzi8m9y86O/A1tT1aHSAthFldndTjtj/HjKhh2Dk3luf4tuW+UkfZgmI6vB
mfTGRKslMFWm/q3X4zP5ktjmRMwmpmzz5DbSx/hFzDEqLZpBscANR5U50by+d+0RU/kHS3
M4PqKp2bZDVSSwFZ1eGJOIcHy2yy2qya1+SIoq4sSBI1dE3SB5WpMKSWu6pC1M/okibsEO
CHnnZbYHmGF8PQDVmUSKQBkz6nW/8U3znh5su1MbzPAuCi9B9OQagPXm+JoT9w==

Response:

{
    "ConsumerID": 55320,
    "ResponseCode": 0,
    "ResponseMessage": "Valid consumer details.",
    "RequestReference": "Test Request"
}

Signature of the above response will be

EJ2DKOV0ddgOGBsskLt9V8eHAIpu/dalD3elh8AtKf3l3wwPONSY0fY1vrdDqUFuU1udNH
WlLXFjibFXptlnM4JQ6R9S/vs406BYEkBV4D4Y0WW1D7KQgamKnceyV8YZ+pMkQsSuMB/s
zrmI5YzcMit+0RetB6snhN4tR2Qet1oTIC0xV3d9ydwLPW4Q+oMuZQtl9pchWECMGQcS0Y
78gnBNizCR7OLCJCYW29lhmC0GOzX7a6ZDJF3Gmkd03GlQ+f7+Jjf0zqXO/HytTtnIUmyW
TDcbr527ivS+X7FEoiE/KEfQzPqq+J4M3AASn4YJ5j4Wry2Hd4Q4gzkNytaW2g==

BlockConsumerLogin

Request:

{
    "ConsumerID": 55320,
    "RequestReference": "Test Request"
}

Signature of the above request will be

Yy+7ExranzyJNn3BmlB0mXbTOqqdCMA/Svo1qS30aAYbRwWR+fWlSabPB9BuDrt7cwvCj
3AcTDLUVhTJYMYmTErtcD92wtrzhaWny7KMXSyggwE156BgUO4KhLO4S5dKNh4nMA4JGd
f3dOk+RgrIFpd9/gyygxLBqi6zmrOnclUFFzB7V1iB/h72fyI2WSk9I+BLYysF/ZlqB1i
G4lnT8Dn+tAJS6X/ofxBqQCdy5c32dQDRbzBdoyDKnTq/AdjHIV7NjhPYwT7GiteiwFOC
CEKL/O/AdO0bahTKBpF5LJ1aK9yG7iFQfSaM+5evWtdZ759YYXCBTDEzFksxo2+Yvw==

Response:

{
    "ResponseCode": 0,
    "ResponseMessage": "User blocked.",
    "RequestReference": "Test Request"
}

Signature of the above response will be

f0+9Ev1F055Ih2p6y84mM8oIjhVtnFRzKuixTcVfHohJvN72Q3LwbfMQ9eLL1y/OtMF93
Gn1G92TULYBR7wp3Uw7MwDNAR/5XpbzchYfIdxGgUmUZaLF4McSmRzhfGHUDpMeAcVyak
gEaNHbdFOMheq1zNcMa+HzdJlmSz2aGAEz/YJr18+Tth9CrQGPP83MxSmSyAAGE7FXguL
EzxpuuzKMNhYfhKjxOCqhggZkj5G+A2EmTiCcOhXeWiD5nyJtLK8t7Ku5fiM/Uj07jdhK
w18O5SiigMMT1oS4sXJAV8U1Gm8lKo2FYTMzm3AW/ixYCiF7XRevj9PftqLip4T23w==

OTP Webhook

066|55320|OpenBanking-VerifyPSU-OTP|12345678|SecurityHash

OTP : 12345678
Encrypted OTP : ZWoIGl34dh5rvF8dH8iecjLomv1sV3TZzt238Y+6b772m6m+l3RKhOIyIm7PQF0634dd
                CVT1nBK6fqUPiTHMzv4xKRiTISCv70n0yxEvPcNZZRtvrSZqTvnKiRkHI4Q4q/OiY75C
                7azZX79aoKc8yEvp5Kv8UbaFjMLM7W+dcUWio1JLPtsmLisLeUXphFLnHHP+nlUD9Kjz
                cyNfRfNceEL7Um6NLOn5NB1JxLOVQ/j1qVFix8rScNFOJTmwYCGDT8J39rHluicBQnRR
                a4vMQrW86FuZV9b0+O6eTLIzD/9o9noKEcHcTtoIe7sTVS8n6pVHn3qVUUkjkKm4ngPG
                sQ==066|55320|OpenBanking-VerifyPSU-OTP|ZWoIGl34dh5rvF8dH8iecjLomv1s
                V3TZzt238Y+6b772m6m+l3RKhOIyIm7PQF0634ddCVT1nBK6fqUPiTHMzv4xKRiTISCv
                70n0yxEvPcNZZRtvrSZqTvnKiRkHI4Q4q/OiY75C7azZX79aoKc8yEvp5Kv8UbaFjMLM
                7W+dcUWio1JLPtsmLisLeUXphFLnHHP+nlUD9KjzcyNfRfNceEL7Um6NLOn5NB1JxLOV
                Q/j1qVFix8rScNFOJTmwYCGDT8J39rHluicBQnRRa4vMQrW86FuZV9b0+O6eTLIzD/9o
                9noKEcHcTtoIe7sTVS8n6pVHn3qVUUkjkKm4ngPGsQ==|SecurityHash
security key to generate Hash : 883986C0F101EC37FE366D61952F907E8BBE0060C2069CB3BD8E01
                                8053EA3DF1
HashString : 066&55320&OpenBanking-VerifyPSU-OTP&ZWoIGl34dh5rvF8dH8iecjLomv1sV3TZzt238
             Y+6b772m6m+l3RKhOIyIm7PQF0634ddCVT1nBK6fqUPiTHMzv4xKRiTISCv70n0yxEvPcNZZR
             tvrSZqTvnKiRkHI4Q4q/OiY75C7azZX79aoKc8yEvp5Kv8UbaFjMLM7W+dcUWio1JLPtsmLis
             LeUXphFLnHHP+nlUD9KjzcyNfRfNceEL7Um6NLOn5NB1JxLOVQ/j1qVFix8rScNFOJTmwYCGD
             T8J39rHluicBQnRRa4vMQrW86FuZV9b0+O6eTLIzD/9o9noKEcHcTtoIe7sTVS8n6pVHn3qVU
             UkjkKm4ngPGsQ==

Request:

{
    "NotificationType": "066",
    "ConsumerID": "55320",
    "OTPType": "OpenBanking-VerifyPSU-OTP",
    "OTPCode": "ZWoIGl34dh5rvF8dH8iecjLomv1sV3TZzt238Y+6b772m6m+l3RKhOIyIm7PQF0634ddCVT
                1nBK6fqUPiTHMzv4xKRiTISCv70n0yxEvPcNZZRtvrSZqTvnKiRkHI4Q4q/OiY75C7azZX7
                9aoKc8yEvp5Kv8UbaFjMLM7W+dcUWio1JLPtsmLisLeUXphFLnHHP+nlUD9KjzcyNfRfNce
                EL7Um6NLOn5NB1JxLOVQ/j1qVFix8rScNFOJTmwYCGDT8J39rHluicBQnRRa4vMQrW86FuZ
                V9b0+O6eTLIzD/9o9noKEcHcTtoIe7sTVS8n6pVHn3qVUUkjkKm4ngPGsQ==",
    "SecurityHash": "9cefdb39651bc8e039149ce78cbad0e456074af6d8433538badf447be62d49fc"
}

Signature of the above request will be

m/7zYTjcHUGtjFeDNYfxjaHxQOsTT0wDtj6ZTr1QfjKo4w1PQcV18o32iEPLulHwTPIzzw
NG4b8l3YcG0PkT5CzcKVGZ9M3Ohf9PKiYJkJ0N3Y0nxvFKPv12YRSEl9QkeMcPvv6G2i6i
Aq4TNEu1Q2vD4twV6FjTWqm5ErKoCbDt9ka/hh3cx78JwsWVZGzmrY0k35Orut1R8nQt7W
MJusny+HB9LF2VPHrsoLXAcJgvj4i+rUetvmWMsKNx/W6WEElKDqITUxnyURmv/j63nfFA
u9ZdhyA2Pm3nRwcKIYnF4Qbuaiw7uNTyA5G2EmddczSxVUDghMPdS+2LfDr2mg==

Webhook

OTPWebHook to receive OTP

Request data field OTPCode will be encrypted using Client Public Key.

Contis will send signature in request header name “x-signature”.

Format:
NotificationType|ConsumerID|OTPType|OTPCode|SecurityHash

Sr No	Items	Remarks
1	NotificationType	Unique code to identify the notification. Fixed value: 066
2	ConsumerID	ConsumerID for which OTP sent
3	OTPType	Meaning full description. e.g. OpenBanking-VerifyPSU-OTP
4	OTPCode	8-digit OTP This input will be encrypted using client public key.

E.g. 066|12345678|OpenBanking-VerifyPSU-OTP|12345678|SecurityHashC

Development

Open banking client API specifications

Replace VPN with Public Key Infrastructure

For example:

Client certificate pair:

Contis certificate pair:

For example request,

Request:

Client API

VerifyConsumerCredential

BlockConsumerLogin

Contis API

VerifyConsumerCredential

Request:

Response:

BlockConsumerLogin

Request:

Response:

OTP Webhook

Request:

Webhook

OTPWebHook to receive OTP