BRD Corporate - Payment Initiation Service (PIS) API

Some General Remarks Related to this version:

-This API definition is based on the Implementation Guidelines of the Berlin Group PSD2 API. It is not a replacement in any sense. The main specification is (at the moment) always the Implementation Guidelines of the Berlin Group PSD2 API.

-This API definition contains the REST-API for requests from the PISP/AISP to the ASPSP.

Fallback

In case the APIs do not work, we have developed a fallback solution that requires accessing the URL https://tppbck-corp.devbrd.ro. This solution allows web scraping with certificate as in the case of a classic request.

Data Types

The character set is UTF 8 encoded. This specification is only using the basic data elements "string", "boolean", "ISODateTime", "ISODate", "UUID" and "integer" and ISO based code lists (with a byte length of 32 bytes). For codes defined by ISO, a reference to the corresponding ISO standard is given in 13.21.

Max35Text, Max70Text, Max140Text and Max512Text are defining strings with a maximum length of 35, 70, 140 and 512 characters respectively.

ASPSPs will accept for strings at least the following character set:

a b c d e f g h i j k l m n o p q r s t u v w x y z

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

0 1 2 3 4 5 6 7 8 9

/ - ? : ( ) . , ' +

Exceptions from these rules are mentioned for the particular service.

HTTP Response Codes

Response codes follow the standard definitions, for instance:

200 OK / 201 Created / etc.

Addition Information inside the body/ Optional for all responses

The TPP receives a message only in case of an event which is identified as an ERROR or WARNING or INFO (as defined by the Berlin Group).

The PSU should receive a message at least in case of a required action of the PSU (e.g. SCA required).

Case: Creation of a consent / creation of payments)

psuMessage: (string)

“psuMessage”: “text” //:”Max512Text //Additional explaining text

// Sample:

//“Dear customer, please login to your Corporate online banking //application and approve the new consent.”

tppMessages: array of messages

“tppMessages”:[ {

“category”:”String”, // ERROR or WARNING :Max

// 35

“code”: “CERTIFICATE_REVOKED”, // Message code – Mandatory

// String Max 35

“path”:”String” //optional MaxText140

“text”:”Max512Text” //Additional explaining text

//Always English

}]

With Corporate APIs, BRD extends the Messages scope also for pure information only. The category includes also “INFO”, in order to support the TPP for the optimization of the workflows.

Beside the categories ERROR and WARNING the system also generates INFO – Messages.

Sample:

Response creation of a consent for account information:

"tppMessages":

[{"category":"INFO", "code":"TPPMSG_AIS_ACCOUNT_CONSENT_CREATED",

"path":"","text":""}],

The Payment Initiation Service (PIS) APIs can be used to initiate payments, query payment details/ status and confirm payments.

The Payment Initiation Services (PIS) APIs allows the following operations:

- Payment initiation

- Payment details

- Payment status

- Payment authorization

- Delete payment

Basic principles:

- Supports GET, POST and DELETE methods.

- Supported Payment Formats: SEPA credit transfer; only XML pain 001 scheme format accepted (for the moment).

- Supported Payments: Single transfers and Bulk Payments.

- For the decoupled approach the user (PSU) will use the BRD Corporate Online Application in order to authorize the transaction with SCA.

- The actual version of BRD implementation for Corporate APIs supports the multilevel authorization of transactions via the TPP.

In order to keep the workflow for a customer/ user as simple as possible the system will create the authorisation resources implicit during the initiation of the transaction at the first step as long as the user is allowed to authorize. It is the assumption that the user who initiates the transaction can also authorize the transaction. If one authorisation is not sufficient, further authorisations are defined explicitly.

- The deactivation of the transaction doesn-t require an authorisation. The originator of this request might be the user or the TPP.

- This API is developed according to specifications of the Berlin-Group NextGenPSD2 Framework.

Payment Initiation

The payment is initiated by the user (PSU) via TPP with PISP role. TPP sends us the information for further processing. ASPSP returns as a response to the payment information request a unique reference number (Payment-ID) and a message for client informing/requesting the PSU for approval of the consent in his BRD Corporate Online Application.

Strong Customer Authentication (SCA) authorization in a decoupled method

The user follows the instructions and starts the BRD Corporate Online Application, using his credentials for authentication in BRD Corporate Online Application. Based on the reference and information about the TPP, the user is able to identify the consent and approve it.

Note: currently, in Sandbox there is no SCA required.

Status of the payment
The response for checking the payment status is used on the basis of the ISO 20022 XML schema "pain.002.001.03".