Open banking Client API Specifications

Replace VPN with Public Key Infrastructure

These methods must be developed with PKI,(Contis has used x509 certificates to implement PKI. There will be 2 pairs of PKI certificates (Public & Private)

Client certificates.
Contis certificates

Client must share their certificate/public key with Contis, the certificate can be provided by you, alternatively Contis can generate the certificate pair. Contis will encrypt the sensitive field data using client’s public key and then whole request payload will be used to generate digital signature using Contis’ private key. This signature will be passed in request header as “x-signature” field.

Contis will share certificate/public key to client(s) to verify the signature generated & passed in each request by Contis. This public key will be used to verify the digital signature which can be found in request header as “x-signature” field at client end. This key can be used to encrypt any sensitive field(s) such as password, OTP etc. if it is passed in response. If any such fields found in response, Contis will decrypt those using Contis’ private key for further use.

For example:

Client certificate pair:

Contis certificate pair:

Contis will encrypt OTP = “12345678” using client public key will be

Z4aLdv/PDodBy2rQvHICPu52Xv8LxUpt/DH3n01V9uWIbUpWREkoayT0kDizogkvuO+aDogiVxbWDyDV4u2ua/u24O0KSG6gqRSjL9aOkuFSgQl9yy3MVcHcMRyuylFWTTIH9GAw0c+ghKBvXtq4caUe3IrSKUNIbx7E3b7bpmHrlEVQs1PXl8OAg62Nk4b/3ya6tfmNpzdYIrR+k6m50zHqGHInA1IE6/4vwmmBI0IUILWz1Kk7PRcgl5Wcnewi8YqkCKB1Wo7hGrKosuqNRyZz0rooK0a9MtLnbmJTxmpG9c8+aXnSqvj0UGpeI6RPW+aUKoSf0nz70YkXsoV5zw==

This value will be passed in request data field OTPCode. Which client need to decrypt using their associated private key.
To generate signature, Contis will use their private key.

For example request,

Username: testUser
Password: testPassword

Password will be encrypted with client public key. So client can decrypt it with private key at their end.

So here, as per above Public/Private keys set.

Password will be a,

JwhxoahH+qH0DT3bF4JgzfdM33aIKXwdmv+NZNK+EE4Vigp26ShiQ4W+GOh+gKISF7L2BUhP0F4lNVxSUqJtuL6uWLkZG3ExNNDdqG17/Qw28udxe0hj0y//JXmB7reLC15SN68cJr6wUATC0R4oGmZ4/NoEM3xtvtMfh9ar/WYGpR1vEYEX3wpq/z6id5N7ISuxepJDNpv6cFI5Rhae0IWEMqsE6T9PXo4py/cArclfFZ+fec3oSR4gQ1spTc+4cSjrW2KtUyZxhddLJlWw3CcQyXirasZW5DM6SUyuQPq/DA3Y829OuqNi5MM/r/R/qkEGgnFBH2NNjpxWxf20zg==

{
    "Username": "testUser", 
    "Password": "JwhxoahH+qH0DT3bF4JgzfdM33aIKXwdmv+NZNK+EE4Vigp26ShiQ4W+GOh+gKISF7L2BUhP0F4lNVxSUqJtuL6uWLkZG3ExNNDdqG17/Qw28udxe0hj0y//JXmB7reLC15SN68cJr6wUATC0R4oGmZ4/NoEM3xtvtMfh9ar/WYGpR1vEYEX3wpq/z6id5N7ISuxepJDNpv6cFI5Rhae0IWEMqsE6T9PXo4py/cArclfFZ+fec3oSR4gQ1spTc+4cSjrW2KtUyZxhddLJlWw3CcQyXirasZW5DM6SUyuQPq/DA3Y829OuqNi5MM/r/R/qkEGgnFBH2NNjpxWxf20zg==", 
    "RequestReference": "Test Request"
}

Signature of the above request will be

bozrGbY3qz/TpYtImKAaxdJapzmzqTRKOljTKbQCPLxlvf9LHTwC43+LIK48CaqhLBkzKk0UGBPqMwgCEZzi8m9y86O/A1tT1aHSAthFldndTjtj/HjKhh2Dk3luf4tuW+UkfZgmI6vBmfTGRKslMFWm/q3X4zP5ktjmRMwmpmzz5DbSx/hFzDEqLZpBscANR5U50by+d+0RU/kHS3M4PqKp2bZDVSSwFZ1eGJOIcHy2yy2qya1+SIoq4sSBI1dE3SB5WpMKSWu6pC1M/okibsEOCHnnZbYHmGF8PQDVmUSKQBkz6nW/8U3znh5su1MbzPAuCi9B9OQagPXm+JoT9w==

which will be passed in request header in “x-signature” request header.

Similarly, contis will generate and pass digital signature for each request. In response, client has to generate the signature using client’s private key of response payload which will be verified by contis at their end using client’s public key. If any sensitive data fields are there in response, client has to encrypt it using contis’ public key and then need to generate signature of response payload.

Specifications:

M = Mandatory O= Optional

1. Client API

VerifyConsumerCredential

Client is responsible to block the Consumer Login, when consumer is failed to provide correct username and password.

Request object: VerifyConsumerCredentialReq

DataMember	Type	Required M/O	Remarks
Username	string (100)	M	Consumer username
Password	string (400)	M	This input will be encrypted using client public key.
RequestReference	string (50)	M	Unique Reference number associated with API request. Should provide reference number in each API request for tracking/auditing purpose of actions performed at contis platform.

Response object: VerifyConsumerCredentialRes

DataMember	Type	Required M/O	Remarks
ConsumerID	Integer	M	ConsumerID provided by Contis at time of creating new Consumer.
ResponseCode	EnumResponseCode	M	Any of response code provided by Contis.
ResponseMessage	String (200)	O	Response message in case of error/success description.
RequestReference	String (50)	M	Should provide reference number in each API request for tracking/auditing purpose of actions performed at contis platform.

Custom Enum DataType:

Enum	ResponseCode
0	Success
200	Invalid Credential
500	Internal Error
400	Invalid Request
404	Consumer Not Found

BlockConsumerLogin

Contis will call this method to block consumer login at client end, when consumer will be failed to provide correct OTP.

Request object: BlockConsumerLoginReq

DataMember	Type	Required M/O	Remarks
ConsumerID	Integer	M	ConsumerID returned during successful VerifyConsumerCredential request.
RequestReference	string (50)	M	Unique Reference number associated with API request. Should provide reference number in each API request for tracking/auditing purpose of actions performed at contis platform.

Response object: BlockConsumerLoginRes

DataMember	Type	Required M/O	Remarks
ResponseCode	EnumResponseCode	M	Any of response code provided by Contis.
ResponseMessage	String (200)	O	Response message in case of error/success description.
RequestReference	String (50)	M	Should provide reference number in each API request for tracking/auditing purpose of actions performed at contis platform.

2. Contis API

Once, Consumer has approved the access consent of their account(s), Contis is allowing their Consumer to revoke the access any time they wish.

To achieve this function Contis has developed Consent APIs.

For more detail of implementation, please follow the link below,

https://apireference.contis.com/docs/API/Consent

VerifyConsumerCredential

Request:

{
    "Username": "testUser",
    "Password": "JwhxoahH+qH0DT3bF4JgzfdM33aIKXwdmv+NZNK+EE4Vigp26ShiQ4W+GOh+gKISF7L2BUhP0F4lNVxSUqJtuL6uWLkZG3ExNNDdqG17/Qw28udxe0hj0y//JXmB7reLC15SN68cJr6wUATC0R4oGmZ4/NoEM3xtvtMfh9ar/WYGpR1vEYEX3wpq/z6id5N7ISuxepJDNpv6cFI5Rhae0IWEMqsE6T9PXo4py/cArclfFZ+fec3oSR4gQ1spTc+4cSjrW2KtUyZxhddLJlWw3CcQyXirasZW5DM6SUyuQPq/DA3Y829OuqNi5MM/r/R/qkEGgnFBH2NNjpxWxf20zg==",
    "RequestReference": "Test Request"
}

Signature of the above request will be

bozrGbY3qz/TpYtImKAaxdJapzmzqTRKOljTKbQCPLxlvf9LHTwC43+LIK48CaqhLBkzKk0UGBPqMwgCEZzi8m9y86O/A1tT1aHSAthFldndTjtj/HjKhh2Dk3luf4tuW+UkfZgmI6vBmfTGRKslMFWm/q3X4zP5ktjmRMwmpmzz5DbSx/hFzDEqLZpBscANR5U50by+d+0RU/kHS3M4PqKp2bZDVSSwFZ1eGJOIcHy2yy2qya1+SIoq4sSBI1dE3SB5WpMKSWu6pC1M/okibsEOCHnnZbYHmGF8PQDVmUSKQBkz6nW/8U3znh5su1MbzPAuCi9B9OQagPXm+JoT9w==

Response:

{
    "ConsumerID": 55320,
    "ResponseCode": 0,
    "ResponseMessage": "Valid consumer details.",
    "RequestReference": "Test Request"
}

Signature of the above response will be

EJ2DKOV0ddgOGBsskLt9V8eHAIpu/dalD3elh8AtKf3l3wwPONSY0fY1vrdDqUFuU1udNHWlLXFjibFXptlnM4JQ6R9S/vs406BYEkBV4D4Y0WW1D7KQgamKnceyV8YZ+pMkQsSuMB/szrmI5YzcMit+0RetB6snhN4tR2Qet1oTIC0xV3d9ydwLPW4Q+oMuZQtl9pchWECMGQcS0Y78gnBNizCR7OLCJCYW29lhmC0GOzX7a6ZDJF3Gmkd03GlQ+f7+Jjf0zqXO/HytTtnIUmyWTDcbr527ivS+X7FEoiE/KEfQzPqq+J4M3AASn4YJ5j4Wry2Hd4Q4gzkNytaW2g==

BlockConsumerLogin

Request:

{
    "ConsumerID": 55320,
    "RequestReference": "Test Request"
}

Signature of the above request will be

Yy+7ExranzyJNn3BmlB0mXbTOqqdCMA/Svo1qS30aAYbRwWR+fWlSabPB9BuDrt7cwvCj3AcTDLUVhTJYMYmTErtcD92wtrzhaWny7KMXSyggwE156BgUO4KhLO4S5dKNh4nMA4JGdf3dOk+RgrIFpd9/gyygxLBqi6zmrOnclUFFzB7V1iB/h72fyI2WSk9I+BLYysF/ZlqB1iG4lnT8Dn+tAJS6X/ofxBqQCdy5c32dQDRbzBdoyDKnTq/AdjHIV7NjhPYwT7GiteiwFOCCEKL/O/AdO0bahTKBpF5LJ1aK9yG7iFQfSaM+5evWtdZ759YYXCBTDEzFksxo2+Yvw==

Response:

{
    "ResponseCode": 0,
    "ResponseMessage": "User blocked.",
    "RequestReference": "Test Request"
}

Signature of the above response will be

f0+9Ev1F055Ih2p6y84mM8oIjhVtnFRzKuixTcVfHohJvN72Q3LwbfMQ9eLL1y/OtMF93Gn1G92TULYBR7wp3Uw7MwDNAR/5XpbzchYfIdxGgUmUZaLF4McSmRzhfGHUDpMeAcVyakgEaNHbdFOMheq1zNcMa+HzdJlmSz2aGAEz/YJr18+Tth9CrQGPP83MxSmSyAAGE7FXguLEzxpuuzKMNhYfhKjxOCqhggZkj5G+A2EmTiCcOhXeWiD5nyJtLK8t7Ku5fiM/Uj07jdhKw18O5SiigMMT1oS4sXJAV8U1Gm8lKo2FYTMzm3AW/ixYCiF7XRevj9PftqLip4T23w==

OTP Webhook

066|55320|OpenBanking-VerifyPSU-OTP|12345678|SecurityHash

OTP : 12345678
Encrypted OTP : ZWoIGl34dh5rvF8dH8iecjLomv1sV3TZzt238Y+6b772m6m+l3RKhOIyIm7PQF0634ddCVT1nBK6fqUPiTHMzv4xKRiTISCv70n0yxEvPcNZZRtvrSZqTvnKiRkHI4Q4q/OiY75C7azZX79aoKc8yEvp5Kv8UbaFjMLM7W+dcUWio1JLPtsmLisLeUXphFLnHHP+nlUD9KjzcyNfRfNceEL7Um6NLOn5NB1JxLOVQ/j1qVFix8rScNFOJTmwYCGDT8J39rHluicBQnRRa4vMQrW86FuZV9b0+O6eTLIzD/9o9noKEcHcTtoIe7sTVS8n6pVHn3qVUUkjkKm4ngPGsQ==
	        066|55320|OpenBanking-VerifyPSU-OTP|ZWoIGl34dh5rvF8dH8iecjLomv1sV3TZzt238Y+6b772m6m+l3RKhOIyIm7PQF0634ddCVT1nBK6fqUPiTHMzv4xKRiTISCv70n0yxEvPcNZZRtvrSZqTvnKiRkHI4Q4q/OiY75C7azZX79aoKc8yEvp5Kv8UbaFjMLM7W+dcUWio1JLPtsmLisLeUXphFLnHHP+nlUD9KjzcyNfRfNceEL7Um6NLOn5NB1JxLOVQ/j1qVFix8rScNFOJTmwYCGDT8J39rHluicBQnRRa4vMQrW86FuZV9b0+O6eTLIzD/9o9noKEcHcTtoIe7sTVS8n6pVHn3qVUUkjkKm4ngPGsQ==|SecurityHash
security key to generate Hash : 883986C0F101EC37FE366D61952F907E8BBE0060C2069CB3BD8E018053EA3DF1
HashString : 066&55320&OpenBanking-VerifyPSU-OTP&ZWoIGl34dh5rvF8dH8iecjLomv1sV3TZzt238Y+6b772m6m+l3RKhOIyIm7PQF0634ddCVT1nBK6fqUPiTHMzv4xKRiTISCv70n0yxEvPcNZZRtvrSZqTvnKiRkHI4Q4q/OiY75C7azZX79aoKc8yEvp5Kv8UbaFjMLM7W+dcUWio1JLPtsmLisLeUXphFLnHHP+nlUD9KjzcyNfRfNceEL7Um6NLOn5NB1JxLOVQ/j1qVFix8rScNFOJTmwYCGDT8J39rHluicBQnRRa4vMQrW86FuZV9b0+O6eTLIzD/9o9noKEcHcTtoIe7sTVS8n6pVHn3qVUUkjkKm4ngPGsQ==

Request:

{
    "NotificationType": "066",
    "ConsumereID": "55320",
    "OTPType": "OpenBanking-VerifyPSU-OTP",
    "OTPCode": "ZWoIGl34dh5rvF8dH8iecjLomv1sV3TZzt238Y+6b772m6m+l3RKhOIyIm7PQF0634ddCVT1nBK6fqUPiTHMzv4xKRiTISCv70n0yxEvPcNZZRtvrSZqTvnKiRkHI4Q4q/OiY75C7azZX79aoKc8yEvp5Kv8UbaFjMLM7W+dcUWio1JLPtsmLisLeUXphFLnHHP+nlUD9KjzcyNfRfNceEL7Um6NLOn5NB1JxLOVQ/j1qVFix8rScNFOJTmwYCGDT8J39rHluicBQnRRa4vMQrW86FuZV9b0+O6eTLIzD/9o9noKEcHcTtoIe7sTVS8n6pVHn3qVUUkjkKm4ngPGsQ==",
    "SecurityHash": "9cefdb39651bc8e039149ce78cbad0e456074af6d8433538badf447be62d49fc"
}

Signature of the above request will be

m/7zYTjcHUGtjFeDNYfxjaHxQOsTT0wDtj6ZTr1QfjKo4w1PQcV18o32iEPLulHwTPIzzwNG4b8l3YcG0PkT5CzcKVGZ9M3Ohf9PKiYJkJ0N3Y0nxvFKPv12YRSEl9QkeMcPvv6G2i6iAq4TNEu1Q2vD4twV6FjTWqm5ErKoCbDt9ka/hh3cx78JwsWVZGzmrY0k35Orut1R8nQt7WMJusny+HB9LF2VPHrsoLXAcJgvj4i+rUetvmWMsKNx/W6WEElKDqITUxnyURmv/j63nfFAu9ZdhyA2Pm3nRwcKIYnF4Qbuaiw7uNTyA5G2EmddczSxVUDghMPdS+2LfDr2mg==

3. Webhook

OTPWebHook to receive OTP

Request data field OTPCode will be encrypted using Client Public Key.

Contis will send signature in request header name “x-signature”.

Format:
NotificationType|ConsumerID|OTPType|OTPCode|SecurityHash

Sr No	Items	Remarks
1	NotificationType	Unique code to identify the notification. Fixed value: 066
2	ConsumerID	ConsumerID for which OTP sent
3	OTPType	Meaning full description. e.g. OpenBanking-VerifyPSU-OTP
4	OTPCode	8-digit OTP This input will be encrypted using client public key.

E.g. 066|12345678|OpenBanking-VerifyPSU-OTP|12345678|SecurityHash

Development

Open banking Client API Specifications

Replace VPN with Public Key Infrastructure

For example:

Client certificate pair:

Contis certificate pair:

For example request,

1.

Client API

VerifyConsumerCredential

BlockConsumerLogin

2.

Contis API

VerifyConsumerCredential

Request:

Response:

BlockConsumerLogin

Request:

Response:

OTP Webhook

Request:

3.

Webhook

OTPWebHook to receive OTP