Documentation
The XS2A APIs, are developed on the basis of the Berlin Group PSD2 Access to Bank Accounts (XS2A) specification.
- NextGen PSD2 NextGenPSD2 XS2A Framework Implementation Guidelines v1.3.12 (from 01.07.2022)
- OpenAPI YAML specification (Production)
- OpenAPI YAML specification (Upcoming release)
TPP Authentication
Certificate
To access all endpoints of the PSD2 XS2A interface a third party provider (TPP) must present a valid PSD2 compliant Qualified Web Authentication Certificate (QWAC) according to ETSI TS 119 495.2. The certificate must be issued by one of the EU list of trusted providers and must specify the roles for which the provider is authorized:
- Payment initiation (PSP_PI);
- Account information (PSP_AI);
In addition, the certificate must contain in the subject:organizationIdentifier
the auhtorization
number issued by a National
Competent Authority.
In most cases the TPP can access the XS2A interface directly without any notification or registration. In some cases we may be missing the root CA in which cases you should send your certificate to psd2[AT]fibank.al.
Strong Customer Authentication
SCA Approach
Customer authentication is based on Redirect SCA Approach with support for authorisation sub-resources and Implicit Start of the Authorisation Process. After the creation of consent or payment resource the authorisation process is started immediately by implicitly creating an authorisation sub-resource.
The scaRedirect
links will expire if the user is not authenticated within two minutes. After the
user is authenticated, the scaStatus
is changed to psuAuthenticated
and the link
cannot be used anymore for another user authentication. The scaStatus
of the resource will then
change either to finalised
if the user was able to confirm the main resource or to
failed
if the session expired. Additional authorisation sub-resources could be created by an
explicit POST to the corresponding endpoint. They could be used either by the same PSU or by a different PSU to
implement multilevel SCA in case of corporate accounts.
Authentication Channels
Customers of Central Cooperative Bank can use two different channels to access their accounts:
- FIBANK Online - requires the use of Qualified Electronic Signature for login and is available only on desktop browsers.
- FIBANK Mobile - a mobile application available for iOS and Android devices.
A customer can have access to any of the above channels. Because we do not know in advance which is the PSU or
to which channels he has access the scaRedirect
link opens a generic login page where depending on
the device the user will be able to select and login in the appropriate channel.
TPP Redirect
When creating a consent, payment or authorisation sub-resourse, the TPP can pass a
TPP-Redirect-URI
header. The customer will be redirected to this URL when the SCA process finishes
regardless of wether the process was successful or not. The header TPP-Nok-Redirect-URI
currently
is not supported.
The final redirection to the TPP URL could happen on a different channel than the one on which the
scaRedirect
link was initially opened. For example a user is working on a desktop computer and
opens the redirect link in a browser. In certain situations the browser may display a QR code which can be
scanned by the mobile device of the user. The authentication and the confirmation then continues using the FIB
Mobile application and the final redirect to the TPP-Redirect-URI
will happen in an embedded
browser in the mobile application. The TPPs should be aware of this detail and implement the redirect links
accordingly.
Consent Models
The interface supports the following consent models.
Detailed Consent
The TPP submits detailed description of the required level of account access by providing non-empty
access
attributes (accounts
, balances
or transactions
).
Global Consent
The TPP is requesting access to all customer accounts. This is done by submitting one of the following
access
attributes: availableAccounts
, availableAccountsWithBalance
or
allPsd2
with the value allAccounts
. The attribute availableAccounts
requests access only to the account list and does not require a second factor for authentication. The attribute
availableAccountsWithBalance
requests in addition access to balances. Finally, allPsd2
requests full access wich also includes transaction details.
Transaction Report
The list of transactions is always returned ordered in chronological order on the booking date, i.e. the oldest transaction is returned first.
If there are two many transactions for the requested period, the call to the transactions
endpoint will return only an initial porition of the oldest transactions. If there are more, this will be indicated by the presence of the link transactions._links.next
in the response which could be used to retrieve the next batch of transactions. The TPP can also construct this link manually by taking the value of the entryReference
field from the last returned transaction and passing it in the entryReferenceFrom
parameter.
Payments Models
Domestic Transfers Payment
- debtorAccount.iban
must be user bank account, if it is present it will not be possible to select an account when confirming a transfer
-
Transfer in local currency
-
instructedAmount.currency
attribute must be LEK.
-creditorAccount.iban
the receiving bank must be in Albania.
-chargeBearer
mandatory forinstructedAmount.amount
greater than 20,000 LEK. IfinstructedAmount.amount
below 20,000 LEK field is not mandatory to enter, but if you enterchargeBearer
value must beSHAR
.
-serviceLevel
Is only using Transfer in local currency and only possible value isURGP
for AIPS payments. -
Currency transfers within the bank
-
creditorAccount.iban
must be account in Fibank Albania.
-
Own account fund transfer
-
creditorAccount.iban
must be the user account in Fibank Albania.
Tax and Customs Payment
- taxCustomsPaymentDetails.taxSerialNumber
and taxCustomsPaymentDetails.payerId
may be mandatory to enter depending on the organization to which the funds are being transferred
Transfer in foreign currency (Cross Border Transfer)
- debtorAccount.iban
you can only enter an account in a foreign currency.
- creditorAddress.street
you can enter the Recipient's full address.
Developer Portals
The obtain login credentials for the sandbox environment please contact psd2[AT]fibank.al. Also note that sometimes this environment will contain upcoming changes to the API so that the TPPs will be able to test them before release.