Open Banking API Integration: Examples of Fintech APIs

Emma is UK-based app that gives users an easy way to track, invest and save money. Finicity is a financial data aggregator that offers an API platform with direct data agreements with large financial such as Chase, Wells Fargo, Capital One, CitiBank, Fidelity and more. Open banking APIs can be used to authenticate customers and verify their identity. For example, HSBC has an API portal that allows developers to register and access HSBC’s APIs. The portal also provides documentation and support to help developers get started. The Open Banking Implementation Entity is the official UK company that oversees open banking implementation in the UK. Dynamic Client Registration is a process by which banks can automate the enrolment of new Third Party Providers, without having to manually authenticate each one.

• The solution leverages RFC 7523’s ‘Using JWTs as Authorization Grants’ as a means of passing in a “trusted” JWT that identifies the PSU to the TPP.
• This type of API can be used to develop new applications and services that make use of banking data, such as transaction history or account balances.
• It also creates significant opportunities for developers to offer innovative solutions.
• This is read-only access — the AISP cannot initiate any payments or actions from the account.

Customers will benefit from increased competition in the financial industry as prices will go down and service quality will go up. For example, customers will be able to use financial services aggregators to compare offers from banks and other institutions. They’ll also get remote access to a number of products that used to be available in branches only. For customers, open banking APIs offer a wide range of features and services.

Which versions of the product are affected?

A financial institution should conduct a data audit to determine which types of customer data is available for internal and external utilization. The bank should also assess the data potential for machine learning and other analytic approaches to improve fraud detection, credit scoring, pricing, and cross-selling.

• The situation may change dramatically in the foreseeable future as more banks will add these services to the value proposition.
• With this additional detail, the market is experiencing a distinction between regulated TPPs and non regulated FinTechs.
• Yes Yes Yes Yes The TPP tried to access the resource with a method that is not supported.
• For non-json payloads (e.g. for PDF files), the mime type of the payload must be specified in this claim.

Collaboration with other banks and third-party institutions can also prove to be incredibly profitable. By gaining access to user data from other participating financial institutions , banks can market their products and services to a much wider audience.

Developer resources

This type of API can be used to develop new applications and services that make use of banking data, such as transaction history or account balances. Open banking APIs allow third-party developers to build applications that interact with a bank’s customer data and systems, which can create new opportunities for innovation in the banking sector. In European open banking, eIDAS certificates allow ASPSPs such as banks to identify and authorise the API connections from Third Party Providers like PISPs and AISPs. This is a vital factor in preventing fraudulent access to bank accounts. The licensing change does not affect you as user, but it is relevant to your provider who has used our product in their solution implementation. In case of uncertainty please contact your service provider or approach us at Security is a crucial part of banking as they store sensitive information.

The platform provides access to a wide range of Barclays’ APIs, including APIs for account information, payments, and transactions. Open banking APIs are used to connect third party providers to banks in a secure and uniform way. In the UK, these must conform to standards set out by the Open Banking Implementation Entity . An API is an application programming interface, a technology which connects different IT systems together so that they can exchange data. One system can ‘call’ or request data from the other system using an API, and receive that data in a standard format. They are used for core banking activities such as opening bank accounts and making cross-border transactions.

What Are Open Banking APIs?

Open banking allows businesses to authenticate payments directly between consumers and their banks. The following use cases demonstrate how open banking APIs are being used to create value for businesses and customers. The Open Data API Specification dictates how banks create access endpoints for Third Party Providers . It specifies the ways in which TPPs should be able to use a bank’s Read/Write API. Open banking providers like TrueLayer aggregate bank APIs and provide businesses with a single API connection.

In a 2022 survey, 95% of responders indicated they have suffered an API security incident in the last 12 months. Moreover, 40% of API users have indicated that they have experienced API malfunctioning. Given the importance of security and high level of competition in open banking, API providers should test their APIs rigorously in order to ensure a high level of security and functionality. The AISP provides a access token which is used to generate a burst of multiple requests to retrieve an Accounts resource. Once a consent re-authentication is successful, the TPP must not use access tokens and refresh tokens that were previously issued for the same consent. An ASPSP may issue an access token and refresh token for a long-lived consent. In such a situation, the state of the intent does not change and the ASPSP must not modify the state of the intent.

Speak to an open banking expert, and discover how to transform your entire payment experience.

Re-authenticating the PSU may result in an appropriate token that may be used. Yes Yes Yes Yes The TPP tried to access the resource with a method that is not supported. 415 Unsupported Media Type Yes No No Yes The operation was refused as too many requests have been made within a certain timeframe. 429 Too Many Requests ASPSPs may throttle requests when they are made in excess of their fair usage policy.

• The underlying data-set may change between two subsequent requests.
• Make an audit of your CRM, select the most popular banks among your customers, then research which banking institutions are most popular among your target customers.
• Message encryption is predicated on the sender encrypting the payload using the public part of a key matched by a private key held by the recipient.
• If an ASPSP does not support should reject any requests with a Content-type or Accept headers that indicate that message encryption is required.
• On the other hand, other grant types identify the client and resource owner.
• If you are a business that would like to implement our products in a commercial setting and would like to protect your individual changes, we offer the option to license our products under a commercial license.

Where message signing and encryption is required by implementors they should continue to use the detached signature method described above for consistency with the standards. The x-idempotency-key provided in the header must be at most 40 characters in size. If a larger x-idempotency-key length is provided, the ASPSP mustreject the request with a status code is 400 . The TPP attempts to access a Resource and the ASPSP decides to re-authenticate the PSU. The ASPSP must respond back with an appropriate error code to indicate re-authentication is required. If the TPP expects an unencrypted response, it must indicate that the only a JSON response is accepted (e.g by setting the value to application/json) as a content header for all endpoints that respond with JSON. Where a requirement is being implemented by either an ASPSP and/or a TPP, a different categorisation is applied.

The ASPSPmustreject any API requests that should be signed but do not contain a signature in the HTTP header with a 400 error. A Trust Anchor that is trusted by the ASPSPs and TPPs is responsible for providing a store of public keys for each of the parties. The ASPSPmay use the message signature, along with the x-idempotency-key to ensure that the request body has not changed. The TPPmust not change the request body while using the same x-idempotency-key. If the TPP changes the request body, the ASPSP must not modify the end resource.

This opens up a world of potential for banks to develop their own integration-based financial services. Before open banking, screen scraping was the only way for apps to access customer’s bank accounts. However, open banking is a more secure method since it doesn’t require the customer’s credentials and is therefore much more secure. Situation HTTP Status Notes Returned by POST Returned by GET Returned by DELETE Returned by PUT Request completed successfully 200 OK PUT will be specified to return the updated resource. 201 Created The operation results in the creation of a new resource. Yes No No No Delete operation completed successfully 204 No Content No No Yes No Request has malformed, missing or non-compliant JSON body, URL parameters or header fields.

What is an open banking API?

All versions of Open Banking Gateway after v1.0 will be affected by the licensing changes and move to a dual-licensing model. This project is dual licensed under Affero GNU General Public License v.3 (AGPL v.3) or alternatively under a commercial license agreement – see the LICENSE file for details. Shell script examples on how to retrieve accessToken and account information. Python script which retrieves accessToken, customer and account information. Java client which retrieves accessToken and account information. Simple Node client which retrieves accessToken and account information. Simple .NET Core Console Application which retrieves accessToken, customer and account information.