This guide explains how to test the Payments and Accounts APIs of the 'Payment and Accounts' API product. A Client ID and Client Secret has been included in the attached Postman collection for convenience. However, you should sign up to the portal, create an application and subscribe to the 'Payment and Accounts' API product. This will give you your own Client ID and Client Secret for invoking the APIs. Please refer to the Getting Started page for instructions on how to do this.  

Postman collection to test STET Accounts APIs

Below you can find the link to a test suite with the steps required to test the STET Accounts APIs. It includes HTTP requests with sample headers and test data.

Postman is a free REST test tool, you can download if from here. Save the content of the link below as a .json file and then import it in the tool as a test collection.

Link to postman collection to test STET PSD2 APIs

The rest of this page explains the steps implemented in the test suite. You can use this information as a guidance for the logic you need to implement in your application to be able to execute a payment.

Steps to test STET Accounts APIs

1.Obtain consent from the customer to access accounts information

You start the three legged OAuth2.0 flow that will enable the ASPSP (the bank) to authenticate the customer and capture its consent to access accounts information.

Using a web browser, invoke the URL below to emulate the customer giving consent for accessing accounts information (changing the values as required).

      https://api.eu.apiconnect.ibmcloud.com/cmarcoliukibmcom-open-banking-agg...

URL Parameters

First, as a Bank's account owner, you have to authenticate directly with your (favorite) bank. 2 accounts are provided for the test purpose. You can choose one of the them, the default is Jean Martin's account.

1. login: Anne-Dubois - password: no specific password, enter any character
2. login: Jean-Martin - password: no specific password, enter any character. This is the default account

If you use login 'Anne-Dubois' you are bound to Bank's account owner Anne Dubois (with accountId "100" and "101"), otherwise you are Jean Martin (with accountId "200" and "201")

A second authentication is required to access the consent page and give access to accounts information. A 6 digit code is enforced and you need to provide the right value. For this, you have to install (on Mac, Linux, Windows PC or Smartphone) the Authy app: .

Example of the Authy app UI:

 

Then, once you are "strongly" authenticated you can select the accounts you want to consent an access to for the TPP app (AISPapp in the following example):

Follow the UI flow and at the end, take note of the authorisation code appended to the URL (e.g. http://localhost/redirect?code=xxxxxxxxxxxxx).

2. Get the access token required to access accounts information

Following the OAuth2.0 protocol, you know exchange the access code for the access token required for step 4. If you want you can see, following the instruction of step 3, how is token is linked to the accounts information access approved by the customer.

Call the POST /oauth2/token endpoint in the StetAccountsPSUOAuth2Security API. The following must be passed in the headers and body of the HTTP request (changing the values as required).

Body

 Take note of the access token in the response data.

3. Introspect the access token (optional)

Note that this step is not required for accessing accounts information, however looking at the content of the access token wil help you understand how the system is working, behind the scenes.

Call the  POST /oauth2/introspect endpoint in the  StetAccountsPSUOAuth2Security API to obtain the data contained inside of the access token. The following must be passed in the headers of the HTTP request  (changing the values as required).

Header

Body

4. Access accounts information

You can now use the access token to access accounts information, as well as accounts related transactions, balances report and control coverage of an account.

Call the GET /v1/accounts endpoint in the PSD2 ASPSP services API to access accounts information. The following must be passed in the headers of the HTTP request  (changing the values as required).

Headers

5. Access transactions of an account

 You can now use the access token to access accounts transactions.

Call the GET /v1/accounts/{accountId}/transactions endpoint in the PSD2 ASPSP services API to access transactions of an account. The following must be passed in the headers and body of the HTTP request  (changing the values as required).

Headers

6. Access balances report of an account

You can now use the access token to access accounts balances report.

Call the GET /v1/accounts/{accountId}/balances-report endpoint in the PSD2 ASPSP services API to access balances report of an account. The following must be passed in the headers of the HTTP request  (changing the values as required).

Headers

7. Control coverage of accounts

 You can now use the access token to control coverage of accounts.

Call the GET /v1/accounts/coverage-control endpoint in the PSD2 ASPSP services API to control coverage of an accounts. The following must be passed in the headers of the HTTP request  (changing the values as required).

 Headers

Body

Take note of the result element in the response data (JSON): true or false