openapi: 3.0.1
info:
  title: SmartAccounts
  version: 1.1.2
  description: >
    # Overview    
    
    <img src="https://static.wixstatic.com/media/d07c66_aed6f61e702242c287728877f0fd247f~mv2.png" width="400"/>
    
    **Smart Accounts** is the first account interrogation service (AIS) developed in Romania and authorised by the National Bank of Romania (NBR). Our solution suits individuals, legal entities (enabling access for all their bank accounts in one place) and companies that process their customers' financial-banking data, such as billing platforms, NFIs, ERP services, or personal finance management providers.

    ## Simplify integration for consistent banking experience
    
     Our Smart Accounts API solution is specifically designed to optimize the integration process, thereby saving you considerable time and effort. With our solution, you gain access to a bank selector API that simplifies the process of connecting with multiple banks. This eliminates the need for you to individually implement bank-specific requirements to request them from your users, automating those needs and significantly reducing the integration time.
     
     The API specifies the necessary data for each bank before starting the consent initiation process. For instance, if the user selects Bank X from the bank selector, you will know from this API if that bank requires no initial information or the PSU_ID before starting the consent initiation process. Furthermore, our solution normalizes the consent initiation and account interrogation steps across all banks. This ensures that you can expect a uniform and standardized process for consent initiation and account interrogation, regardless of the specific bank. The selected bank only represents an input parameter for our APIs, while the request and response objects of the API are bank-agnostic. This saves you from having to navigate through varying consent procedures and request/response mappings for each bank, further expediting the integration process.
     
     By leveraging our Smart Accounts API solution, you can seamlessly integrate with multiple banks, reduce integration time, and ensure a consistent user experience across different banking platforms. This not only saves you time and resources but also enhances the overall efficiency and effectiveness of your integration efforts.

    ## Which banks are currently integrated into Smart Accounts?

     The largest and most popular banks in Romania are connected in Smart Accounts: **Banca Transilvania, Banca Comerciala Romana, ING Bank, BRD Groupe Societe Generale, Raiffeisen Bank, CEC Bank, First Bank, UniCredit Bank, Revolut, OTP Bank, Garanti BBVA, Libra Bank** and **Alpha Bank**.

    ## How secure is Smart Accounts?

     Beyond the ease of integration and use, security is another fundamental principle of **Smart Accounts**. The implemented security policy ensures the protection of our partners and their customers against payments risks, including the risk of fraud and illegal use of sensitive payment data.
     All electronic communication channels are secured using **MTLS**, **digital signature**, and the **OAuth2** protocol with **OpenID Connect**.
     The Smart Accounts system permanently ensures the integrity and confidentiality of data on payment transactions and payment service users as follows:
     - data in transit is encrypted using MTLS and digitally signed. Idle data is stored encrypted with a unique encryption key. Encryption algorithm used is AES, the encryption key being used only at the API level and stored in a protected configuration file;
     - access to Smart Accounts administration or reporting features is granted using authentication with user / password credentials. The system requires the use of passwords with a very high degree of complexity and password rotation every 60 days.

    ## What do I need to get started with Smart Accounts?

     You need to get an **X.509 certificate** from a certified authority of your choice.
      - an X.509 certificate contains a public key and an identity (a hostname or organisation or an individual) and it's signed by a certificate authority.
      - a Certification Authority (CA) acts as a trusted third party for both the subject (owner) of the certificate and the party relying on the certificate.
     The X.509 certificate is used in both sandbox and production environments. You can obtain it on your own, or we can assist you in obtaining one.

     After that, we will walk together through the stage of **initiating the business relationship** and **integrate Smart Accounts into your platform**.

    ## What is the process of initiating the business relationship?

     For the integration process we will collect the relevant data to configure your profile and to ensure the proper functioning of the product with your platform (company logo, company name, CUI).

    
    ## Prior to the technical integration, Smart Fintech will request the following from the partner:
     1. The subject of the X.509 certificate and the name of the authority (CA) that generated this certificate;
     2. A **redirectURL**, where Smart Accounts will redirect the payment service user after confirmation of consent initiation.

    ## What do I need for the sandbox environment?

     1. The NDA must be signed;
     2. The onboarding procedure completed, where we will need the information described in addition to partner's name (as it will be displayed on the Smart Accounts page) and tax identification code / number;
     3. The X.509 certificate for sandbox environment **(apart from the one needed for production environment)**. If certificate is missing, we can generate a one for testing.
    The Smart Accounts team will provide a certificate (if required), a Postman and an environment collection, as well as technical documentation. Any partner will benefit from support during testing and integration.

    ## What do I need for the production environment?

     1. The contract must be signed;
     2. The subject of the X.509 certificate and the name of the authority (CA) that generated this certificate;
     3. The reconfirmation of the data submitted for partner's profile configuration in Smart Accounts, listed above.
    
    ## Support

    Please contact us through our page <a href=https://www.smartfintech.eu/contact >https://www.smartfintech.eu/contact </a> 
    or send us an email at <a href="mailto: contact@smartfintech.eu" >contact@smartfintech.eu <a/>
  termsOfService: https://www.smartfintech.eu/terms-and-conditions-smartaccounts
  contact:
    name: API Support
    url: https://www.smartfintech.eu
    email: support@smartfintech.eu
externalDocs:
  description: Onboarding Manual
  url:  https://www.smartfintech.eu/_files/ugd/58544c_8fd6b17e676f49959c1e4b178a2556b4.pdf
servers:
  - url: mtls.sandboxaccounts.smartfintech.eu/gateway
    description: Staging server
  - url: mtls.accounts.smartfintech.eu/gateway
    description: Production server
tags:
  - name: Step 1 - Authentication
    description: | 
      These APIs offer the following services: 
      - authentication based on a client_id already enrolled and associated with the X.509 certificate;
      - refresh the access token obtained after authentication.
  - name: Step 2 - Consent Initiation
    description: |
      These APIs provide:
      - the list of integrated banks; 
      - email based validation of the accepted T&C;
      - consent initiation.
  - name: Step 3 - Consent Details
    description: | 
      These APIs: 
      - provide information about consents;
      - delete consent.
  - name: Step 4 - Account Information
    description: | 
      These APIs provide information about: 
      - account(s);
      - balance(s); 
      - transaction(s).
      
      The bank's name must be according to the "codeBanks" from Get Banks, otherwise an error will be raised. **Validation performed on all resource APIs: If the bank’s name and "internalConsentId" are not the same as the ones from "initConsent", an error will be raised.**
paths:
  /authenticate/rest/api/token:
    post:
      tags:
        - Step 1 - Authentication
      summary: Authenticate
      description: >
        After enrollment of the partner in Smart Accounts' systems, the partner will receive a client_id which is assigned to a certificate's Subject DN.
        
        The API will extract de Subject DN from client's certificate. 
        
        Whenever the partner wants to initiate a new consent, he will have to call /authenticate/rest/api/authenticate/token API. The API receives the client_id of the partner. 
        
        The response of the API contains an access_token, a refresh_token and an internalConsentId generated by Smart Accounts. 
        
        **The access and refresh tokens are uniquely generated per internalConsentId.** 
        
        **The access token expires after 5 minutes, so it must be renewed using the refresh token provided ("POST refreshToken API"). The refresh token expires after 90 days.**
        
        Mixing tokens with other internalConsentIds will cause an UNAUTHORIZED response from Smart Accounts.
        
        Returned internalConsentId, access and refresh tokens should be saved by partner's systems.

      operationId: login
      parameters:
      - in: query
        name: client_id
        schema:
          type: string
        required: true
        description: The client id of the partner
      responses:
        200:
          description: SUCCESS
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAccessToken'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'          
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  /authenticate/rest/api/refreshToken:
    post:
      tags:
        - Step 1 - Authentication
      summary: ResfreshToken
      description: >
        This API will be used whenever the access_token expires for a consent. API receives in its body the client_id, refresh_token of the expired access_token and in access_token API's header the access token that expired.
    
        API responds with a new set of access_token and refresh_token and the consent id for which they are eligible.
        
        **Note: Last refresh_token is the only one valid and previous refresh_token is invalidated automatically**.
      operationId: refreshToken
      parameters:
        - in: header
          name: access_token
          schema:
            type: string
          required: true
        - in: header
          name: internalConsentId
          schema:
            type: integer
          required: true
        - in: query
          name: client_id
          schema:
           type: string
          required: true
        - in: query
          name: refresh_token
          schema:
            type: string
          required: true
      responses:
        200:
          description: SUCCESS
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAccessToken'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'          
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  # /createUser:
  #   post:
  #     tags:
  #       - create-user-controller-impl
  #     operationId: createUser
  #     parameters:
  #       - in: header
  #         name: email
  #         required: true
  #         schema:
  #           type: string
  #     responses:
  #       '200':
  #         description: OK
  #         content:
  #           '*/*':
  #             schema:
  #               $ref: '#/components/schemas/GenericResponse'
  /core/rest/api/banks:
    get:
      tags:
        - Step 2 - Consent Initiation
      summary: Banks
      description: >
        GET Banks returns the list of integrated and available banks. Every bank object contains the object "requiredParameters" which includes the parameters "requiresPSUIdType", "requiresPSUId" and "requiresIban". The parameters are boolean type and the value "true" means that the respective parameter should be sent on further requests.
        
        
        **All API calls must be made using the "code" specific for each bank, otherwise an error will be raised.**
        
        
        API must be called with Authorization header containing the **access_token** value received on Authenticate step.
      operationId: getBanks
      responses:
        200:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BanksResponse'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  /core/rest/api/checkPsuEmail:
    post:
      tags:
        - Step 2 - Consent Initiation
      summary: Check Email Account
      description: >
        This API verifies:
        
        - if the user has accepted Smart Fintech's terms and conditions; 
        
        - if the user has an existing account with this e-mail.
        
        
        API must be called with Authorization header containing the **access_token** value received on Authenticate step.
      operationId: checkPsuEmail
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PsuEmailRequest'
        required: true
      responses:
        200:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PsuEmailResponse'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  /core/rest/api/initConsent/{internalConsentId}:
    post:
      tags:
        - Step 2 - Consent Initiation
      summary: InitConsent
      description: >
        At this point, the consent can be prepared to be sent to bank for authorisation. In order to initialise a consent, Smart Accounts needs the following information:
        
        - Request body:
          - **codeBank** – for which bank the PSU wants to create a consent (”code” received on GET Banks API);
          - **periodOfValid** – the period is with default value = 180 days. If Smart Accounts receives a different value on this parameter, a "Bad request" error will be raised. After 180 days, the PSU must re-authorise in the bank's page. Please be aware that the re-authorisation in the bank's page will generate a new consent ID so you must keep the evidence of the PSU's consents to match the account information;
          - **psuEmail** – it is the e-mail address of the PSU this address and it will be used to inform the user about the consent initialisation;
          - **psuIntermediarId** – is the unique ID associated to the PSU by the partner systems;
          - **redirectURL**– is the page where the PSU will be redirected after he finishes the authorisation phase in the bank's page. It is recommended to be redirect in the partner's page;
          - **TCaccepted** – must be true, otherwise a "Bad request" error will be raised. It is partner’s choice if for each new consent the user must check and agree to the Smart Accounts Terms and Conditions, or it can implement a different way of managing the PSU's T&C agreement;
          - **allAccounts** – with attributes "iban" and "currency" (mandatory for RZB and OTP);

        - Request header: 
          - **Content-Type** – mandatory for all banks;
          - **PSU-IP-Address** – is mandatory and without this information, there is a limitation over the number of API calls that we can make (4 calls maximum per day); 
          - **PSU-ID** – it is generated by the bank, also known as username. Mandatory for BRD, RZB, OTP;
          - **PSU-ID-Type** – mandatory for:  
            - BRD - accepted values are: "PF", "PJ" or "PFA"; 
            - RZB – accepted value: "PJ" – only for corporate accounts. Do not send PSU-ID-TYPE if you want to initiate a consent for an individual person. 
        
        
        API must be called with Authorization header containing the **access_token** value received on Authenticate step.
      operationId: initConsent
      parameters:
        - in: path
          name: internalConsentId
          required: true
          schema:
            type: integer
        - in: header
          name: PSU-IP-Address
          required: true
          schema:
            type: string
        - in: header
          name: scaMethod
          required: false
          schema:
            type: string
        - in: header
          name: PSU-ID
          required: false
          schema:
            type: string
        - in: header    
          name: PSU-ID-Type
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InitConsentRequest'
        required: true
      responses:
        200:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HubInitconsentResponse'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  /core/rest/api/consent/{bankName}/{internalConsentId}:
    get:
      tags:
        - Step 3 - Consent Details
      summary: Consent
      description: >
        The purpose of this API is to check the consent details and the list of available accounts. The list of available accounts means the list of accounts for which the user has granted access through the consent authorisation.
        
        Depending on each bank's integration, this API will respond as follows:
          - **will return the list of the selected accounts by PSU and the parameter "availableAccounts" will be null**:
            - BT,
            - BRD when PSU-ID-Type = PJ/PFA,
            - RZB,
            - FB, 
            - UNC, 
            - OTP, 
            - LIB;
          - **will NOT return the list of the selected accounts by PSU and the parameter "availableAccounts" will be null**: 
            - CEC – if only an account is selected, then its IBAN will appear in "accounts", "balances" and "transactions", 
            - REV;
          - **will NOT return the list of the selected accounts by PSU and the parameter "availableAccounts" will have the value."allAccounts"**: 
            - BCR, 
            - ING, 
            - BRD (PSU-ID-Type = PF),
            - GRT,
            - ALPH.
    
        API must be called with Authorization header containing the **access_token** value received on Authenticate step.
      operationId: getConsent
      parameters:
        - in: path
          name: bankName
          required: true
          schema:
            type: string
        - in: path
          name: internalConsentId
          required: true
          schema:
            type: integer
        - in: header
          name: PSU-IP-Address
          required: true
          schema:
            type: string
      responses:
        200:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConsentResponse'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  /core/rest/api/consent/{bankName}/{internalConsentId}/status:
    get:
      tags:
        - Step 3 - Consent Details
      summary: Consent status
      description: >
        This API will return the status of the consent sent on request.
        
        
        The list of possible statuses, according to Berlin Group Implementation Guidelines. The bold statuses are the ones we have encountered in production environment tests, until now:
        
        <table>
          <tr>
          <td><b>Status name</b></td>
          <td><b>Description</b> </td>
          </tr>
          <tr>
          <td><b>received</b></td>
          <td><b>The consent data have been received and are technically correct. The data is not authorised yet.</b> </td>
          </tr>
          <tr>
          <td>rejected</td>
          <td>The consent data have been rejected e.g. since no successful authorisation has taken place.  </td>
          </tr>
          <tr>
          <td>partiallyAuthorised <br></td>
          <td> The consent is due to a multi-level authorisation, some but not all mandated authorisations have been performed yet.  </td>
          </tr>
          <tr>
          <td><b>valid</b></td>
          <td><b>The consent is accepted and valid for GET account data calls and others as specified in the consent object.</b> </td>
          </tr>
          <tr>
          <td><b>revokedByPsu</b></td>
          <td><b>The consent has been revoked by the PSU towards the ASPSP.</b></td>
          </tr>
          <tr>
          <td><b>expired</b></td>
          <td><b>The consent expired. </b> </td>
          </tr>
          <tr>
          <td><b>terminatedByTPP</b></td>
          <td><b>The corresponding TPP has terminated the consent by applying the DELETE method to the consent resource. </b> </td>
          </tr>
        </table>
          
          
        API must be called with Authorization header containing the **access_token** value received on Authenticate step.
          

      operationId: getConsentStatus
      parameters:
        - in: path
          name: bankName
          required: true
          schema:
            type: string
        - in: path
          name: internalConsentId
          required: true
          schema:
            type: integer
        - in: header
          name: PSU-IP-Address
          required: true
          schema:
            type: string
      responses:
        200:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseConsentStatus'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  /core/rest/api/deleteConsent/{bankName}/{internalConsentId}:
    delete:
      tags:
        - Step 3 - Consent Details
      summary: Delete consent
      description: >
        This API can be used to revoke access given through a consent.
        
        
        After calling the API DeleteConsent, any other called API will respond with UNAUTHORIZED (TerminatedByTPP).
        
                  
        API must be called with Authorization header containing the **access_token** value received on Authenticate step.
      operationId: deleteConsent
      parameters:
        - in: path
          name: bankName
          required: true
          schema:
            type: string
        - in: path    
          name: internalConsentId
          required: true
          schema:
            type: integer
        - in: header
          name: PSU-IP-Address
          required: true
          schema:
            type: string
      responses:
        200:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteResponse'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  /core/rest/api/accounts/{bankName}/{internalConsentId}:
    get:
      tags:
        - Step 4 - Account Information
      summary: Accounts
      description: >
        Returns a list of payment accounts to which an account access has been granted through the "initConsent" endpoint by the PSU.
        
        
        The partner must use the access_token in order to read the list of account(s) for the provided internalConsentId.
        
                  
        API must be called with Authorization header containing the **access_token** value received on Authenticate step.
      operationId: getAccounts
      parameters:
        - name: bankName
          in: path
          required: true
          schema:
            type: string
        - name: internalConsentId
          in: path
          required: true
          schema:
            type: integer
        - name: PSU-IP-Address
          in: header
          required: true
          schema:
            type: string
      responses:
        200:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAccounts'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  /core/rest/api/accounts/{bankName}/{resourceId}/{internalConsentId}/balances:
    get:
      tags:
        - Step 4 - Account Information
      summary: Balances
      description: >
        Balances can be checked for each account - "resourceId" from GetAccounts must be sent.
        
        
        The partner will use the access_token in order to read balance(s) for the provided internalConsentid.
        
                  
        API must be called with Authorization header containing the **access_token** value received on Authenticate step.
      operationId: getBalances
      parameters:
        - name: bankName
          in: path
          required: true
          schema:
            type: string
        - name: resourceId
          in: path
          required: true
          schema:
            type: string
        - name: internalConsentId
          in: path
          required: true
          schema:
            type: integer
        - name: PSU-IP-Address
          in: header
          required: true
          schema:
            type: string
      responses:
        200:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseBalances'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  /core/rest/api/accounts/{bankName}/{resourceId}/{internalConsentId}/details:
    get:
      tags:
        - Step 4 - Account Information
      summary: Account Details
      description: >
        This API is used to obtain account details for a specific account, not for all accounts.
        
        
        Only ING did not implement this API.
        
        
        The partner will use the access_token in order to read account's details for the provided internalConsentId.
        
        
        API must be called with Authorization header containing the **access_token** value received on Authenticate step.
      operationId: getAccountDetails
      parameters:
        - name: bankName
          in: path
          required: true
          schema:
            type: string
        - name: internalConsentId
          in: path
          required: true
          schema:
            type: integer
        - name: resourceId
          in: path
          required: true
          schema:
            type: string
        - name: PSU-IP-Address
          in: header
          required: true
          schema:
            type: string
      responses:
        200:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAccountDetails'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  
  /core/rest/api/accounts/{bankName}/{resourceId}/{internalConsentId}/transactions:
    get:
      tags:
        - Step 4 - Account Information
      summary: Transaction
      description: >
        API used to obtain the transactions for each account.
        
        The partner will use the access_token in the process of reading transactions for the provided internalConsentid. 
        
        Some banks have a limited period for which transactions can be retrieved:
        
        <table>
            <tr>
                <td><B>Bank </B></td>
                <td><b>Transactions period </b></td>
                <td><b>Notes </b> </td>
            </tr>
            <tr>
                <td>BCR </td>
                <td>90 days </td>
                <td> </td>
            </tr>
            <tr>
                <td>BT </td>
                <td>120 days </td>
                <td>90 days capped in Sandbox by the bank  </td>
            </tr>
            <tr>
                <td>BRD </td>
                <td>2 years </td>
                <td> </td>
            </tr>
            <tr>
                <td>OTP </td>
                <td>90 days </td>
                <td> </td>
            </tr>
            <tr>
                <td>RZB </td>
                <td>180 days </td>
                <td> </td>
            </tr>
            <tr>
                <td>ING, CEC, GRT, LIB, UNC, REV, FB, ALPH </td>
                <td>unlimited </td>
                <td>ALPH is capped at 18 months in Sandbox  </td>
            </tr>
        </table>
        
        Read transaction reports or transaction lists of a given account addressed by "account-id" (resourceId), depending on the steering parameter "bookingStatus".
        For a given account, additional parameters are the attributes "dateFrom" and "dateTo". Depending on each bank, these parameters are requested as follows:
        
        <table>
        <tr>
            <td><b>Parameter</b></td>
            <td><b>BT</b></td>
            <td><b>BCR</b></td>
            <td><b>ING</b></td>
            <td><b>BRD</b></td>
            <td><b>RZB</b></td>
            <td><b>CEC</b></td>
            <td><b>FB</b></td>
            <td><b>UNC</b></td>
            <td><b>REV</b></td>
            <td><b>OTP</b></td>
            <td><b>LIB</b></td>
            <td><b>GRT</b></td>
            <td><b>ALPH</b></td>
        </tr>
        <tr>
                <td>bookingStatus </td>
                <td>M </td>
                <td>M </td>
                <td>N.R. </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>N.R. </td>
                <td>M  </td>
                <td>M</td>
            </tr>
            <tr>
                <td>dateFrom </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M  </td>
                <td>M</td>
            </tr>
            <tr>
                <td>dateTo </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M </td>
                <td>M  </td>
                <td>M</td>
            </tr>
        </table>
        
        * <b>M – mandatory</b> 
        * <b>N.R. – not requested </b>
        
        Banks with pagination include a "next" parameter in the API response. If "next" has a value, another page of transactions is available. When "next" is null, there are no more pages. 
        
        To access the next page, the partner must include the "next" parameter and its value (link) in the header of the request. 
        <b>Note</b> that "next" is tied to the "dateFrom" and "dateTo" parameters, so changing this period requires a new GetTransactions call with updated dates to retrieve transactions for that new period.
        
        Transactions are sent either bulk or with pagination, as following:
        
        <table>
            <tr>
                <td><b>Bank</b> </td>
                <td><b>How the transactions are sent</b>  </td>
            </tr>
            <tr>
                <td>BT </td>
                <td>100 transactions / page  </td>
            </tr>
            <tr>
                <td>BCR </td>
                <td>Bulk  </td>
            </tr>
            <tr>
                <td>CEC </td>
                <td>Bulk  </td>
            </tr>
            <tr>
                <td>BRD </td>
                <td>200 transactions / page  </td>
            </tr>
            <tr>
                <td>ING </td>
                <td>20 transactions / page  </td>
            </tr>
            <tr>
                <td>REV </td>
                <td>50 transactions / page  </td>
            </tr>
            <tr>
                <td>UNC </td>
                <td>400 transactions / page  </td>
            </tr>
            <tr>
                <td>RZB </td>
                <td>50 transactions / page  </td>
            </tr>
            <tr>
                <td>OTP </td>
                <td>Bulk  </td>
            </tr>
            <tr>
                <td>LIB </td>
                <td>Bulk  </td>
            </tr>
            <tr>
                <td>FB </td>
                <td>Bulk  </td>
            </tr>
            <tr>
                <td>GRT </td>
                <td>Bulk  </td>
            </tr>
            <tr>
                <td>ALPH</td>
                <td>Bulk</td>
            </tr>
        </table>
        
        To be considered that <b>transactionID</b> is not sent by the following banks:
          - BRD - the endToEndId can be used as an alternative;
          - ING - not sent in most cases;
          - UNC;
          - OTP.
          
        API must be called with Authorization header containing the **access_token** value received on Authenticate step.
      operationId: getTransactions
      parameters:
        - name: bankName
          in: path
          required: true
          schema:
            type: string
        - name: resourceId
          in: path
          required: true
          schema:
            type: string
        - name: internalConsentId
          in: path
          required: true
          schema:
            type: integer
        - name: PSU-IP-Address
          in: header
          required: true
          schema:
            type: string
        - name: dateFrom
          in: query
          required: true
          schema:
            type: string
            format: date
        - name: dateTo
          in: query
          required: true
          schema:
            type: string
            format: date
        - name: bookingStatus
          in: query
          required: false
          schema:
            type: string
        - name: next
          in: header
          required: false
          schema:
            type: string
        - name: isCardAccount
          in: query
          required: false
          schema:
            type: boolean
            default: false
      responses:
        200:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TransactionsResponse'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  /core/rest/api/accounts/{bankName}/{resourceId}/{internalConsentId}/transactions/{transactionId}/details:
    get:
      tags:
        - Step 4 - Account Information
      summary: Transaction details
      description: >
        This API returns the same information as GetTransactions but only for a specific transaction (you must complete the "transactionId" and "resourceId").
        
        
        Only BT, BCR, CEC and GRT have implemented this API.
        
        
        The partner will use the access_token in the process of reading transactions details for the provided internalConsentId.
        
        
        API must be called with Authorization header containing the **access_token** value received on Authenticate step.
      operationId: getTransactionDetails
      parameters:
        - name: bankName
          in: path
          required: true
          schema:
            type: string
        - name: resourceId
          in: path
          required: true
          schema:
            type: string
        - name: transactionId
          in: path
          required: true
          schema:
            type: string
        - name: PSU-IP-Address
          in: header
          required: true
          schema:
            type: string
        - name: internalConsentId
          in: path
          required: true
          schema:
            type: integer
      responses:
        200:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TransactionDetailsResponse'
              # example:
              #   status: '200'
              #   messageStatus: Success
              #   payload:
              #     transactionId: string
              #     endToEndId: string
              #     bookingDate: '2018-10-02'
              #     valueDate: '2018-10-02'
              #     transactionAmount:
              #       currency: string
              #       amount: 0
              #     transactionType: string
              #     creditorName: string
              #     creditorAccount:
              #       iban: string
              #       currency: string
              #       name: string
              #     debtorName: string
              #     debtorAccount:
              #       iban: string
              #       currency: string
              #       name: string
              #     remittanceInformationUnstructured: string
              #     executionDateTime: '2022-07-10T21:00:00Z'
        400:
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequest'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Unauthorized'
        404:
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFound'
        503:
          description: Service Temporarily Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailable'
  
  
 
components:
  schemas:
    HubInitconsentResponse:
      type: object
      properties:
        status:
          type: integer
          example: 200
        messageStatus:
          type: string
          example: Success
        payload:
          $ref: '#/components/schemas/InitConsentResponse'
    Links:
      type: object
      properties:
        scaOAuth:
          $ref: '#/components/schemas/ScaOAuth'
    ScaOAuth:
      type: object
      properties:
        href:
          type: string
    AccountsInitConsent:
      type: object
      properties:
        iban:
          type: string
        currency:
          type: string
    InitConsentRequest:
      required:
        - TCaccepted
        - codeBank
        - periodOfValid
        - psuEmail
        - psuIntermediarId
        - redirectURL
      type: object
      properties:
        codeBank:
          type: string
        periodOfValid:
          maximum: 180
          minimum: 90
          type: integer
          format: int32
        psuEmail:
          type: string
        psuIntermediarId:
          type: string
        redirectURL:
          type: string
        allAccounts:
          type: array
          items:
            $ref: '#/components/schemas/AccountsInitConsent'
        TCaccepted:
          type: boolean
    GenericResponse:
      type: object
      properties:
        status:
          type: integer
          format: int32
        messageStatus:
          type: string
        moreDetails:
          type: object
          additionalProperties:
            type: object
        payload:
          type: object
    PsuEmailResponse:
      type: object
      properties:
        status:
          type: integer
          example: 200
        messageStatus:
          type: string
          example: Success
        payload:
          $ref: '#/components/schemas/PsuEmail'
    PsuEmailRequest:
      required:
        - psuEmail
      type: object
      properties:
        psuEmail:
          type: string
    Access:
      type: object
      properties:
        accounts:
          type: array
          items:
            $ref: '#/components/schemas/PartyAccount'
        balances:
          type: array
          items:
            $ref: '#/components/schemas/PartyAccount'
        transactions:
          type: array
          items:
            $ref: '#/components/schemas/PartyAccount'
        availableAccounts:
          type: string
    ConsentResponse:
      type: object
      properties:
        status:
          type: integer
          example: 200
        messageStatus:
          type: string
          example: Success
        payload:
          $ref: '#/components/schemas/Consent'
    Consent:
      type: object
      properties:
        access:
          $ref: '#/components/schemas/Access'
        consentStatus:
          type: string
        frequencyPerDay:
          type: integer
          format: int32
        lastActionDate:
          type: string
          format: date-time
        validUntil:
          type: string
          format: date-time
        recurringIndicator:
          type: boolean
        combinedServiceIndicator:
          type: boolean
        creationDate:
          type: string
          format: date-time
    PartyAccount:
      type: object
      properties:
        iban:
          type: string
        currency:
          type: string
        name:
          type: string
    ResponseConsentStatus:
      type: object
      properties:
        status:
          type: integer
          example: 200
        messageStatus:
          type: string
          example: Success
        payload:
          $ref: '#/components/schemas/Status'
    Status:
      type: object
      properties:
        consentStatus:
          type: string
    BanksDto:
      type: object
      properties:
        id:
          type: integer
          format: int32
        code:
          type: string
        name:
          type: string
        logo:
          type: string
        active:
          type: boolean
        bic:
          type: string
        requiredParameters:
          $ref: '#/components/schemas/RequiredParameters'
    BanksResponse:
      type: object
      properties:
        status:
          type: integer
          example: 200
        messageStatus:
          type: string
          example: Success
        payload:
          type: array
          items:
            $ref: '#/components/schemas/BanksDto'
    RequiredParameters:
      type: object
      properties:
        requiresPSUIdType:
          type: boolean
        requiresPSUId:
          type: boolean
        requiresIban:
          type: boolean
    Amount:
      type: object
      properties:
        currency:
          type: string
        amount:
          type: number
          format: double
    TransactionsResponse:
      type: object
      properties:
        status:
          type: integer
          example: 200
        messageStatus:
          type: string
          example: Success
        payload:
          $ref: '#/components/schemas/TransactoinResponse'
    TransactoinResponse:
      type: object
      properties:
        acocunt:
          $ref: '#/components/schemas/Account'
        transactions:
          $ref: '#/components/schemas/Booked'
    TransactionDetailsResponse:
      type: object
      properties:
        status:
          type: integer
          example: 200
        messageStatus:
          type: string
          example: Success
        payload:
          $ref: '#/components/schemas/BookedTransactionsDetails'
    Booked:
      type: object
      properties:
        booked:
          type: array
          items:
            $ref: '#/components/schemas/BookedTransactions'
        pendding:
          type: array
          items:
            $ref: '#/components/schemas/BookedTransactions'
        links:
          $ref: '#/components/schemas/Next'
    Next:
      type: object
      properties:
        next:
          $ref: '#/components/schemas/Href'
    Href:
      type: object
      properties:
        href:
          type: string
    BookedTransactions:
      type: object
      properties:
        transactionId:
          type: string
        entryReference:
          type: string
        endToEndId:
          type: string
        bookingDate:
          type: string
        valueDate:
          type: string
        executionDateTime:
          type: string
        transactionAmount:
          $ref: '#/components/schemas/Amount'
        transactionType:
          type: string
        exchangeRate:
          type: array
          items:
            $ref: '#/components/schemas/ExchangeRate'
        creditorName:
          type: string
        creditorAccount:
          $ref: '#/components/schemas/PartyAccount'
        debtorName:
          type: string
        debtorAccount:
          $ref: '#/components/schemas/PartyAccount'
        remittanceInformationUnstructured:
          type: string
        proprietaryBankTransactionCode:
          type: string
        merchantDetails:
          $ref: '#/components/schemas/MerchantDetails'
        additionalInformation:
          type: string
        smartRemittance:
          $ref: '#/components/schemas/SmartRemittance'
        transactionStatus:
          type: string
        creditDebitIndicator:
          type: string
    ExchangeRate:
      type: object
      properties:
        currencyFrom:
          type: string
        rateFrom:
          type: number
          format: double
        currencyTo:
          type: string
        rateDate:
          type: string
          format: date
    MerchantDetails:
      type: object
      properties:
        merchantName:
          type: string
    SmartRemittance:
      type: object
      properties:
        creditorName:
          type: string
        creditorAccount:
          type: string
        debtorName:
          type: string
        debtorAccount:
          type: string
        fiscalRegistrationNumber:
          type: string
        transactionDetails:
          type: string
        cardNumber:
          type: string
        transactionType:
          type: string
        merchantName:
          type: string
        transactionFee:
          type: string
        exchangeRate:
          type: string
        currencyExchanged:
          type: string
        identificationId:
          type: string
    ResponseAccounts:
      type: object
      properties:
        status:
          type: integer
          example: 200
        messageStatus:
          type: string
          example: Success
        payload:
          type: array
          items:
            $ref: '#/components/schemas/Account'
    ResponseAccountDetails:
      type: object
      properties:
        status:
          type: integer
          example: 200
        messageStatus:
          type: string
          example: Success
        payload:
          $ref: '#/components/schemas/Account'
    Account:
      type: object
      properties:
        resourceId:
          type: string
        iban:
          type: string
        currency:
          type: string
        name:
          type: string
        ownerName:
          type: string
        product:
          type: string
        cashAccountType:
          type: string
        status:
          type: string
        bic:
          type: string
        accountOfficerDescription:
          type: string
        openingDate:
          type: string
        customerSector:
          type: string
        customerType:
          type: string
        accountUsage:
          type: string
        workingBalance:
          type: boolean
        onlineActualBalance:
          type: boolean
        balances:
          type: array
          items:
            $ref: '#/components/schemas/BalanceAccount'
        sortCodeAccountNumber:
          type: string
        isCardAccount:
          type: boolean
    BalanceAccount:
      type: object
      properties:
        balanceAmount:
          $ref: '#/components/schemas/Amount'
        balanceType:
          type: string
        referenceDate:
          type: string
        creditLimitIncluded:
          type: string
        creditDebitIndicator:
          type: string
    ResponseBalances:
      type: object
      properties:
        status:
          type: integer
          example: 200
        messageStatus:
          type: string
          example: Success
        payload:
          $ref: '#/components/schemas/Balances'
    Balances:
      type: object
      properties:
        account:
          $ref: '#/components/schemas/PartyAccount'
        balances:
          type: array
          items:
            $ref: '#/components/schemas/Balance'
    Balance:
      type: object
      properties:
        balanceAmount:
          $ref: '#/components/schemas/Amount'
        balanceType:
          type: string
        referenceDate:
          type: string
        creditLimitIncluded:
          type: string
        creditDebitIndicator:
          type: string
        lastChangeDateTime:
          type: string
        lastCommittedTransaction:
          type: string
        transactionStatus:
          type: string
    DeleteResponse:
      type: object
      properties:
        status:
          type: integer
          example: 200
        messageStatus:
          type: string
          example: Success
        payload:
          $ref: '#/components/schemas/Delete'
    Delete:
      type: object
      properties:
         message:
          type: string
    BookedTransactionsDetails:
      type: object
      properties:
        transactionId:
          type: string
        entryReference:
          type: string
        endToEndId:
          type: string
        bookingDate:
          type: string
        valueDate:
          type: string
        executionDateTime:
          type: string
        transactionAmount:
          $ref: '#/components/schemas/Amount'
        transactionType:
          type: string
        exchangeRate:
          type: array
          items:
            $ref: '#/components/schemas/ExchangeRate'
        creditorName:
          type: string
        creditorAccount:
          $ref: '#/components/schemas/PartyAccount'
        debtorName:
          type: string
        debtorAccount:
          $ref: '#/components/schemas/PartyAccount'
        remittanceInformationUnstructured:
          type: string
        proprietaryBankTransactionCode:
          type: string
        merchantDetails:
          $ref: '#/components/schemas/MerchantDetails'
        additionalInformation:
          type: string
    ResponseAccessToken:
      title: ResponseAccessToken
      type: object
      properties:
        status:
          type: integer
          example: 200
        messageStatus:
          type: string
          example: Success
        payload:
          $ref: '#/components/schemas/AuthResponse'
    AuthResponse:
      title: AuthResponse
      type: object
      properties:
        internalConsentId:
          type: integer
        access_token:
          type: string
        refresh_token:
          type: string
    InitConsentResponse:
      title: initConsent
      type: object
      properties:
        consentStatus:
          type: string
        consentId:
          type: string
        _links:
          $ref: '#/components/schemas/Links'
    PsuEmail:
      title: psuEmail
      type: object
      properties:
        existingAccount:
          type: boolean
        message:
          type: string
        t&c:
          type: string
    BadRequest:
      type: object
      properties:
          status:
              type: integer
              example: 400
          messageStatus:
              type: string
              example: Bad request
          source: 
              type: string
              example: SmartAccounts/Bank
          moreDetails:
            type: object
            properties:
              text:
                  type: string
                  example: BAD REQUEST
    Unauthorized:
      type: object
      properties:
        status:
            type: integer
            example: 401
        messageStatus:
            type: string
            example: Unauthorized
        source: 
            type: string
            example: SmartAccounts/Bank
        moreDetails:
          type: object
          properties:
            text:
                type: string
                example: UNAUTHORIZED
    NotFound:
      type: object
      properties:
          status:
              type: integer
              example: 404
          messageStatus:
              type: string
              example: Not found
          source: 
              type: string
              example: SmartAccounts/Bank
          moreDetails:
            type: object
            properties:
              text:
                  type: string
                  example: NOT FOUND
    ServiceUnavailable:
      type: object
      properties:
          status:
              type: integer
              example: 503
          messageStatus:
              type: string
              example: Service Temporarily Unavailable
          source: 
              type: string
              example: SmartAccounts/Bank
          moreDetails:
            type: object
            properties:
              text:
                  type: string
                  example: SERVICE TEMPORARILY UNAVAILABLE