Start the authorisation process for a signing basket

v1.0.0

Create an authorisation sub-resource and start the authorisation process of a signing basket. The message might in addition transmit authentication and authorisation related data.

This method is iterated n times for a n times SCA authorisation in a corporate context, each creating an own authorisation sub-endpoint for the corresponding PSU authorising the signing-baskets.

The ASPSP might make the usage of this access method unnecessary in case of only one SCA process needed, since the related authorisation resource might be automatically created by the ASPSP after the submission of the payment data with the first POST signing basket call.

The start authorisation process is a process which is needed for creating a new authorisation or cancellation sub-resource.

This applies in the following scenarios:

The ASPSP has indicated with a 'startAuthorisation' hyperlink in the preceding payment initiation response that an explicit start of the authorisation process is needed by the TPP. The 'startAuthorisation' hyperlink can transport more information about data which needs to be uploaded by using the extended forms:
- 'startAuthorisationWithPsuIdentfication',
- 'startAuthorisationWithPsuAuthentication'
- 'startAuthorisationWithEncryptedPsuAuthentication'
- 'startAuthorisationWithAuthentciationMethodSelection'
The related payment initiation cannot yet be executed since a multilevel SCA is mandated.
The ASPSP has indicated with a 'startAuthorisation' hyperlink in the preceding payment cancellation response that an explicit start of the authorisation process is needed by the TPP. The 'startAuthorisation' hyperlink can transport more information about data which needs to be uploaded by using the extended forms as indicated above.
The related payment cancellation request cannot be applied yet since a multilevel SCA is mandate for executing the cancellation.
The signing basket needs to be authorised yet.

Input

{
  "type": "object",
  "properties": {
    "Digest": {
      "type": "string"
    },
    "PSU-Accept": {
      "type": "string"
    },
    "PSU-Accept-Charset": {
      "type": "string"
    },
    "PSU-Accept-Encoding": {
      "type": "string"
    },
    "PSU-Accept-Language": {
      "type": "string"
    },
    "PSU-Corporate-ID": {
      "type": "string"
    },
    "PSU-Corporate-ID-Type": {
      "type": "string"
    },
    "PSU-Device-ID": {
      "type": "string"
    },
    "PSU-Geo-Location": {
      "type": "string"
    },
    "PSU-Http-Method": {
      "type": "string",
      "enum": [
        "GET",
        "POST",
        "PUT",
        "PATCH",
        "DELETE"
      ]
    },
    "PSU-ID": {
      "type": "string"
    },
    "PSU-ID-Type": {
      "type": "string"
    },
    "PSU-IP-Address": {
      "type": "string",
      "format": "ipv4"
    },
    "PSU-IP-Port": {
      "type": "string"
    },
    "PSU-User-Agent": {
      "type": "string"
    },
    "Signature": {
      "type": "string"
    },
    "TPP-Nok-Redirect-URI": {
      "type": "string",
      "format": "uri"
    },
    "TPP-Notification-Content-Preferred": {
      "type": "string"
    },
    "TPP-Notification-URI": {
      "type": "string"
    },
    "TPP-Redirect-Preferred": {
      "type": "boolean"
    },
    "TPP-Redirect-URI": {
      "type": "string",
      "format": "uri"
    },
    "TPP-Signature-Certificate": {
      "type": "string",
      "format": "byte"
    },
    "X-Request-ID": {
      "type": "string"
    },
    "basketId": {
      "type": "string",
      "description": "Resource identification of the generated signing basket resource."
    }
  },
  "required": [
    "X-Request-ID",
    "basketId"
  ],
  "additionalProperties": false
}

Output

{
  "type": "object",
  "description": "Body of the JSON response for a Start SCA authorisation request.",
  "required": [
    "_links",
    "authorisationId",
    "scaStatus"
  ],
  "properties": {
    "_links": {
      "type": "object",
      "description": "A list of hyperlinks to be recognised by the TPP. The actual hyperlinks used in the\nresponse depend on the dynamical decisions of the ASPSP when processing the request.\n\n**Remark:** All links can be relative or full links, to be decided by the ASPSP.\n\nType of links admitted in this response, (further links might be added for ASPSP defined\nextensions):\n\n- 'scaRedirect':\n  In case of an SCA Redirect Approach, the ASPSP is transmitting the link to which to\n  redirect the PSU browser.\n- 'scaOAuth':\n  In case of a SCA OAuth2 Approach, the ASPSP is transmitting the URI where the configuration of the Authorisation Server can be retrieved. The configuration follows the OAuth 2.0 Authorisation Server Metadata specification.\n* 'confirmation': \n  Might be added by the ASPSP if either the \"scaRedirect\" or \"scaOAuth\" hyperlink is returned \n  in the same response message. \n  This hyperlink defines the URL to the resource which needs to be updated with \n    * a confirmation code as retrieved after the plain redirect authentication process with the ASPSP authentication server or\n    * an access token as retrieved by submitting an authorization code after the integrated OAuth based authentication process with the ASPSP authentication server.\n- 'updatePsuIdentification': \n  The link to the authorisation or cancellation authorisation sub-resource, \n  where PSU identification data needs to be uploaded.\n- 'startAuthorisationWithPsuAuthentication':\n  The link to the authorisation or cancellation authorisation sub-resource,\n  where PSU authentication data needs to be uploaded.\n- 'startAuthorisationWithEncryptedPsuAuthentication':\n    Same as startAuthorisactionWithPsuAuthentication where the authentication data need to be encrypted on\n    application layer in uploading.\n- 'selectAuthenticationMethod':\n  The link to the authorisation or cancellation authorisation sub-resource,\n  where the selected authentication method needs to be uploaded.\n  This link is contained under exactly the same conditions as the data element 'scaMethods'.\n- 'authoriseTransaction':\n  The link to the authorisation or cancellation authorisation sub-resource,\n  where the authorisation data has to be uploaded, e.g. the TOP received by SMS.\n- 'scaStatus':\n  The link to retrieve the scaStatus of the corresponding authorisation sub-resource.\n",
      "properties": {
        "authoriseTransaction": {
          "type": "object",
          "description": "Link to a resource.",
          "properties": {
            "href": {
              "type": "string",
              "description": "Link to a resource."
            }
          }
        },
        "confirmation": {
          "type": "object",
          "description": "Link to a resource.",
          "properties": {
            "href": {
              "type": "string",
              "description": "Link to a resource."
            }
          }
        },
        "scaOAuth": {
          "type": "object",
          "description": "Link to a resource.",
          "properties": {
            "href": {
              "type": "string",
              "description": "Link to a resource."
            }
          }
        },
        "scaRedirect": {
          "type": "object",
          "description": "Link to a resource.",
          "properties": {
            "href": {
              "type": "string",
              "description": "Link to a resource."
            }
          }
        },
        "scaStatus": {
          "type": "object",
          "description": "Link to a resource.",
          "properties": {
            "href": {
              "type": "string",
              "description": "Link to a resource."
            }
          }
        },
        "selectAuthenticationMethod": {
          "type": "object",
          "description": "Link to a resource.",
          "properties": {
            "href": {
              "type": "string",
              "description": "Link to a resource."
            }
          }
        },
        "startAuthorisationWithEncryptedPsuAuthentication": {
          "type": "object",
          "description": "Link to a resource.",
          "properties": {
            "href": {
              "type": "string",
              "description": "Link to a resource."
            }
          }
        },
        "startAuthorisationWithPsuAuthentication": {
          "type": "object",
          "description": "Link to a resource.",
          "properties": {
            "href": {
              "type": "string",
              "description": "Link to a resource."
            }
          }
        },
        "updatePsuIdentification": {
          "type": "object",
          "description": "Link to a resource.",
          "properties": {
            "href": {
              "type": "string",
              "description": "Link to a resource."
            }
          }
        }
      }
    },
    "authorisationId": {
      "type": "string",
      "description": "Resource identification of the related SCA."
    },
    "challengeData": {
      "type": "object",
      "description": "It is contained in addition to the data element 'chosenScaMethod' if challenge data is needed for SCA.\nIn rare cases this attribute is also used in the context of the 'startAuthorisationWithPsuAuthentication' link.\n",
      "properties": {
        "additionalInformation": {
          "type": "string",
          "description": "Additional explanation for the PSU to explain\ne.g. fallback mechanism for the chosen SCA method.\nThe TPP is obliged to show this to the PSU.\n"
        },
        "data": {
          "type": "array",
          "description": "A collection of strings as challenge data.",
          "items": {
            "type": "string"
          }
        },
        "image": {
          "type": "string",
          "format": "byte",
          "description": "PNG data (max. 512 kilobyte) to be displayed to the PSU,\nBase64 encoding, cp. [RFC4648].\nThis attribute is used only, when PHOTO_OTP or CHIP_OTP\nis the selected SCA method.\n"
        },
        "imageLink": {
          "type": "string",
          "description": "A link where the ASPSP will provides the challenge image for the TPP."
        },
        "otpFormat": {
          "type": "string",
          "description": "The format type of the OTP to be typed in. The admitted values are \"characters\" or \"integer\".",
          "enum": [
            "characters",
            "integer"
          ]
        },
        "otpMaxLength": {
          "type": "integer",
          "description": "The maximal length for the OTP to be typed in by the PSU."
        }
      }
    },
    "chosenScaMethod": {
      "type": "object",
      "description": "Authentication object.\n",
      "required": [
        "authenticationMethodId",
        "authenticationType"
      ],
      "properties": {
        "authenticationMethodId": {
          "type": "string",
          "description": "An identification provided by the ASPSP for the later identification of the authentication method selection.\n"
        },
        "authenticationType": {
          "type": "string",
          "description": "Type of the authentication method.\n\nMore authentication types might be added during implementation projects and documented in the ASPSP documentation.\n\n  - 'SMS_OTP': An SCA method, where an OTP linked to the transaction to be authorised is sent to the PSU through a SMS channel.\n  - 'CHIP_OTP': An SCA method, where an OTP is generated by a chip card, e.g. a TOP derived from an EMV cryptogram. \n    To contact the card, the PSU normally needs a (handheld) device. \n    With this device, the PSU either reads the challenging data through a visual interface like flickering or \n    the PSU types in the challenge through the device key pad. \n    The device then derives an OTP from the challenge data and displays the OTP to the PSU.\n  - 'PHOTO_OTP': An SCA method, where the challenge is a QR code or similar encoded visual data\n    which can be read in by a consumer device or specific mobile app.\n    The device resp. the specific app than derives an OTP from the visual challenge data and displays\n    the OTP to the PSU.\n  - 'PUSH_OTP': An OTP is pushed to a dedicated authentication APP and displayed to the PSU.\n  - 'SMTP_OTP': An OTP is sent via email to the PSU.\n",
          "enum": [
            "SMS_OTP",
            "CHIP_OTP",
            "PHOTO_OTP",
            "PUSH_OTP",
            "SMTP_OTP"
          ]
        },
        "authenticationVersion": {
          "type": "string",
          "description": "Depending on the \"authenticationType\".\nThis version can be used by differentiating authentication tools used within performing OTP generation in the same authentication type.\nThis version can be referred to in the ASPSP?s documentation.\n"
        },
        "explanation": {
          "type": "string",
          "description": "Detailed information about the SCA method for the PSU.\n"
        },
        "name": {
          "type": "string",
          "description": "This is the name of the authentication method defined by the PSU in the Online Banking frontend of the ASPSP.\nAlternatively this could be a description provided by the ASPSP like \"SMS OTP on phone +49160 xxxxx 28\".\nThis name shall be used by the TPP when presenting a list of authentication methods to the PSU, if available.\n"
        }
      }
    },
    "psuMessage": {
      "type": "string",
      "description": "Text to be displayed to the PSU."
    },
    "scaMethods": {
      "type": "array",
      "description": "This data element might be contained, if SCA is required and if the PSU has a choice between different\nauthentication methods.\n\nDepending on the risk management of the ASPSP this choice might be offered before or after the PSU\nhas been identified with the first relevant factor, or if an access token is transported.\n\nIf this data element is contained, then there is also a hyperlink of type 'startAuthorisationWithAuthenticationMethodSelection'\ncontained in the response body.\n\nThese methods shall be presented towards the PSU for selection by the TPP.\n",
      "items": {
        "type": "object",
        "description": "Authentication object.\n",
        "required": [
          "authenticationType",
          "authenticationMethodId"
        ],
        "properties": {
          "authenticationMethodId": {
            "type": "string",
            "description": "An identification provided by the ASPSP for the later identification of the authentication method selection.\n"
          },
          "authenticationType": {
            "type": "string",
            "description": "Type of the authentication method.\n\nMore authentication types might be added during implementation projects and documented in the ASPSP documentation.\n\n  - 'SMS_OTP': An SCA method, where an OTP linked to the transaction to be authorised is sent to the PSU through a SMS channel.\n  - 'CHIP_OTP': An SCA method, where an OTP is generated by a chip card, e.g. a TOP derived from an EMV cryptogram. \n    To contact the card, the PSU normally needs a (handheld) device. \n    With this device, the PSU either reads the challenging data through a visual interface like flickering or \n    the PSU types in the challenge through the device key pad. \n    The device then derives an OTP from the challenge data and displays the OTP to the PSU.\n  - 'PHOTO_OTP': An SCA method, where the challenge is a QR code or similar encoded visual data\n    which can be read in by a consumer device or specific mobile app.\n    The device resp. the specific app than derives an OTP from the visual challenge data and displays\n    the OTP to the PSU.\n  - 'PUSH_OTP': An OTP is pushed to a dedicated authentication APP and displayed to the PSU.\n  - 'SMTP_OTP': An OTP is sent via email to the PSU.\n",
            "enum": [
              "SMS_OTP",
              "CHIP_OTP",
              "PHOTO_OTP",
              "PUSH_OTP",
              "SMTP_OTP"
            ]
          },
          "authenticationVersion": {
            "type": "string",
            "description": "Depending on the \"authenticationType\".\nThis version can be used by differentiating authentication tools used within performing OTP generation in the same authentication type.\nThis version can be referred to in the ASPSP?s documentation.\n"
          },
          "explanation": {
            "type": "string",
            "description": "Detailed information about the SCA method for the PSU.\n"
          },
          "name": {
            "type": "string",
            "description": "This is the name of the authentication method defined by the PSU in the Online Banking frontend of the ASPSP.\nAlternatively this could be a description provided by the ASPSP like \"SMS OTP on phone +49160 xxxxx 28\".\nThis name shall be used by the TPP when presenting a list of authentication methods to the PSU, if available.\n"
          }
        }
      }
    },
    "scaStatus": {
      "type": "string",
      "description": "This data element is containing information about the status of the SCA method applied.\n\nThe following codes are defined for this data type.\n\n  * 'received':\n    An authorisation or cancellation-authorisation resource has been created successfully.\n  * 'psuIdentified':\n    The PSU related to the authorisation or cancellation-authorisation resource has been identified.\n  * 'psuAuthenticated':\n    The PSU related to the authorisation or cancellation-authorisation resource has been identified and authenticated e.g. by a password or by an access token.\n  * 'scaMethodSelected':\n    The PSU/TPP has selected the related SCA routine.\n    If the SCA method is chosen implicitly since only one SCA method is available,\n    then this is the first status to be reported instead of 'received'.\n  * 'unconfirmed':\n    SCA is technically successfully finalised by the PSU, but the authorisation resource needs a confirmation command by the TPP yet. \n  * 'started':\n    The addressed SCA routine has been started.\n  * 'finalised':\n    The SCA routine has been finalised successfully (including a potential confirmation command). \n    This is a final status of the authorisation resource.\n  * 'failed':\n    The SCA routine failed.\n    This is a final status of the authorisation resource.\n  * 'exempted':\n    SCA was exempted for the related transaction, the related authorisation is successful.\n    This is a final status of the authorisation resource.\n",
      "enum": [
        "received",
        "psuIdentified",
        "psuAuthenticated",
        "scaMethodSelected",
        "started",
        "unconfirmed",
        "finalised",
        "failed",
        "exempted"
      ]
    }
  }
}