Version	Change Description	Date
v.1.0	Initial version	30.04.26
v.1.1	Added the Hosts table. Added the names of the new variables to the test program description	21.05.26
v.1.2	Updated the Hosts table. Updated the test program description to reflect the change of the authorization method from OAuth2 to API key	23.07.26

 

Hosts

 

Variable Name	PREPROD SANDBOX	PREPROD LIVE	PROD SANDBOX	PROD LIVE
apiHost	sandbox.preprod.api.upc.ua	live.preprod.api.upc.ua	sandbox.api.upc.ua	live.api.upc.ua

 

Account Information Service (AIS)

1. Test Scenarios for Creating an Account Consent

Test Case #1. Create a "detailed" Consent | POST /consents/account-access

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user is registered in the system.
• The user has a valid access token (see API Keys).

 

Test Steps

• Select the provider for which the Consent will be created and record the providerId.
• Select the list of accounts for which the Consent will be created and record the IBANs.
• Send the following API request:

 

POST https://{apiHost}/providers/{providerId}/ais/v2/consents/account-access

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

TPP-Redirect-URI: "https://google.com"

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // generated API key for the application

PSU-IP-Address: "1.1.1.1"

TPP-Explicit-Authorisation-Preferred: true

Client-SCA-Approach-Preference: decoupled

// OR: Client-SCA-Approach-Preference: redirect

PSU-ID: "+380971112233" // Optional when Client-SCA-Approach-Preference is redirect

PSU-ID-Type: "PHONE" // Optional when Client-SCA-Approach-Preference is redirect

 

BODY

{
  "access": {
    "payments": [
      {
        "account": {
          "iban": "UA1234567890123456789012134567"
        },
        "rights": [
          "accountDetails",
          "balances",
          "transactions"
        ]
      }
    ]
  },
  "consentType": "detailed",
  "recurringIndicator": true,
  "validTo": "2026-06-28",
  "frequencyPerDay": "4"
}

 

Expected Result

1. A Consent of type "detailed" is created.
2. The response contains a consentId.

 

Example Response

{
  "consentStatus": "received",
  "consentId": "019c0916-ef4d-7228-babe-e0b2a03d57dd",
  "_links": {
    "self": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c0916-ef4d-7228-babe-e0b2a03d57dd"
    },
    "status": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c0916-ef4d-7228-babe-e0b2a03d57dd/status"
    },
    "startAuthorisation": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c0916-ef4d-7228-babe-e0b2a03d57dd/authorisations"
    }
  }
}

 

Test Case #2. Create an "accountList" Consent | POST /consents/account-access

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

The user is registered in the system.

The user has a valid access token (see API Keys).

 

Test Steps

Select the provider for which the Consent will be created and record the providerId.

Send the following API request:

 

POST https://{apiHost}/providers/{providerId}/ais/v2/consents/account-access

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

TPP-Redirect-URI: "https://google.com"

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

PSU-IP-Address: "1.1.1.1"

TPP-Explicit-Authorisation-Preferred: true

Client-SCA-Approach-Preference: decoupled

// OR: Client-SCA-Approach-Preference: redirect

PSU-ID: "+380971112233" // Optional when Client-SCA-Approach-Preference is redirect

PSU-ID-Type: "PHONE" // Optional when Client-SCA-Approach-Preference is redirect

 

BODY

{
  "access": {
    "payments": [
      {
        "rights": [
          "accountDetails",
          "balances",
          "transactions"
        ]
      }
    ]
  },
  "consentType": "accountList",
  "recurringIndicator": true,
  "validTo": "2026-06-28",
  "frequencyPerDay": "4"
}

 

Expected Result

A Consent of type "accountList" is created.

The response contains a consentId.

 

Example Response

{
  "consentStatus": "received",
  "consentId": "019c0916-ef4d-7228-babe-e0b2a03d57dd",
  "_links": {
    "self": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c0916-ef4d-7228-babe-e0b2a03d57dd"
    },
    "status": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c0916-ef4d-7228-babe-e0b2a03d57dd/status"
    },
    "startAuthorisation": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c0916-ef4d-7228-babe-e0b2a03d57dd/authorisations"
    }
  }
}

 

Test Case #3. Create an "aspspManaged" Consent | POST /consents/account-access

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Important

The "aspspManaged" consent type is supported only from specification version 2.2.0 (2.0.6).

 

Prerequisites

The user is registered in the system.

The user has a valid access token (see API Keys).

 

Test Steps

Select the provider for which the Consent will be created and record the providerId.

Send the following API request:

 

POST https://{apiHost}/providers/{providerId}/ais/v2.0/consents/account-access

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

TPP-Redirect-URI: "https://google.com"

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

PSU-IP-Address: "1.1.1.1"

TPP-Explicit-Authorisation-Preferred: true

Client-SCA-Approach-Preference: decoupled

// OR: Client-SCA-Approach-Preference: redirect

PSU-ID: "+380971112233" // Optional when Client-SCA-Approach-Preference is redirect

PSU-ID-Type: "PHONE" // Optional when Client-SCA-Approach-Preference is redirect

 

BODY

{
  "access": {
    "payments": [
      {
        "rights": [
          "accountDetails",
          "balances",
          "transactions"
        ]
      }
    ]
  },
  "consentType": "aspspManaged",
  "recurringIndicator": true,
  "validTo": "2026-06-28",
  "frequencyPerDay": "4"
}

 

Expected Result

A Consent of type "aspspManaged" is created.

The response contains a consentId.

 

Example Response

{
  "consentStatus": "received",
  "consentId": "019c0916-ef4d-7228-babe-e0b2a03d57dd",
  "_links": {
    "self": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c0916-ef4d-7228-babe-e0b2a03d57dd"
    },
    "status": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c0916-ef4d-7228-babe-e0b2a03d57dd/status"
    },
    "startAuthorisation": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c0916-ef4d-7228-babe-e0b2a03d57dd/authorisations"
    }
  }
}

 

2. Test Scenarios for Consent Authorization

Test Case #4. Consent Authorization | POST /consents/account-access/{consent-id}/authorisations

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user has a valid access token (see API Keys).
• A Consent has already been created (see Test Cases #1, #2, or #3), and the consentId has been recorded.

 

Test Steps

1. Send the following API request:

 

POST https://{apiHost}/providers/{providerId}/ais/v2/consents/account-access/{consent-id}/authorisations

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

TPP-Redirect-URI: "https://google.com"

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

PSU-IP-Address: "1.1.1.1"

TPP-Explicit-Authorisation-Preferred: true

Client-SCA-Approach-Preference: decoupled

// OR: Client-SCA-Approach-Preference: redirect

PSU-ID: "+380971112233" // Optional when Client-SCA-Approach-Preference is redirect

PSU-ID-Type: "PHONE" // Optional when Client-SCA-Approach-Preference is redirect

 

BODY

{}

 

1. An authorization is created for the Consent.
2. The response contains scaStatus and authorisationId.

 

Example Response

{
  "consentStatus": "received",
  "consentId": "019c7aab-5419-7046-bcf5-e718134e0adc",
  "_links": {
    "self": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c7aab-5419-7046-bcf5-e718134e0adc"
    },
    "status": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c7aab-5419-7046-bcf5-e718134e0adc/status"
    },
    "startAuthorisation": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c7aab-5419-7046-bcf5-e718134e0adc/authorisations"
    }
  }
}

 

For Client-SCA-Approach-Preference: redirect

1. Follow the scaRedirect link (when Client-SCA-Approach-Preference is set to redirect) or initiate SCA through another channel (when Client-SCA-Approach-Preference is set to decoupled).
2. On the Sandbox page, an interface is available that allows you to approve or reject the authorization request.
3. Approve the authorization by clicking "Accept".

 

For Client-SCA-Approach-Preference: decoupled

Example Response

{
  "scaStatus": "finalised",
  "_links": {
    "scaStatus": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c7b2e-6a91-7644-ae5d-c2617e6931d5/authorisations/019c7b2e-7c47-7d5b-beb5-593ac088df1e"
    }
  },
  "authorisationId": "019c7b2e-7c47-7d5b-beb5-593ac088df1e",
  "psuMessage": "Authorize payment in Bank's mobile application"
}

 

In the Sandbox environment, an emulator is available that automatically confirms the authorization one second after it is created.

 

Expected Result

1. The user is redirected to Google (or to another URL specified in TPP-Redirect-URI when using a non-Sandbox environment).
2. A subsequent GET request for the Consent status should return valid (see Test Case #5).

 

3. Test Scenarios for Consent and Consent Authorization Verification

Test Case #5. Retrieve Consent Status | GET /consents/account-access/{consent-id}/status

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user has a valid access token (see API Keys).
• A Consent has already been created (see Test Cases #1, #2, or #3), and the consentId has been recorded.

 

Test Steps

1. Send the following API request:

 

GET https://{apiHost}/providers/{providerId}/ais/v2/consents/account-access/{consent-id}/status

 

HEADERS

(unchanged)

 

BODY

null

 

Expected Result

The response body contains the current Consent status.

 

Example Response

{
  "consentStatus": "valid"
}

 

Test Case #6. Retrieve All Authorisations for a Consent | GET /consents/account-access/{consent-id}/authorisations

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user has a valid access token (see API Keys).
• A Consent has already been created (see Test Cases #1, #2, or #3), and the consentId has been recorded.

 

Test Steps

1. Send the following API request:

 

GET https://{apiHost}/providers/{providerId}/ais/v2/consents/account-access/{consent-id}/authorisations

 

HEADERS

(unchanged)

 

BODY

null

 

Expected Result

The response body contains the list of authorization IDs associated with the Consent.

 

Example Response

{
  "authorisationIds": [
    "019c0e6d-1ef7-7f4e-a552-d7cec5ff34d9"
  ]
}

 

Test Case #7. Retrieve the Status of a Specific Consent Authorisation | GET /consents/account-access/{consent-id}/authorisations/{authorisation-id}

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user has a valid access token (see API Keys).
• A Consent has already been created (see Test Cases #1, #2, or #3), and the consentId has been recorded.
• An authorization has been created for the Consent (see Test Case #4), and the authorisationId has been recorded (see Test Case #6).

 

Test Steps

1. Send the following API request:

 

GET https://{apiHost}/providers/{providerId}/ais/v2/consents/account-access/{consent-id}/authorisations/{authorisation-id}

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

 

BODY

null

 

Expected Result

1. The response body contains the current status of the Consent authorization.

 

Example Response

{
  "scaStatus": "finalised",
  "_links": {
    "scaStatus": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c0e6c-f7cf-70f7-983f-05df521de43d/authorisations/019c0e6d-1ef7-7f4e-a552-d7cec5ff34d9"
    },
    "scaRedirect": {
      "href": "https://portal.preprod.api.upc.ua/sca-client/mock/upc/bfdb6794-bcb8-4dde-9f3b-07acf73ef202/019c0e6d-1ef7-7f4e-a552-d7cec5ff34d9/consent"
    }
  },
  "authorisationId": "019c0e6d-1ef7-7f4e-a552-d7cec5ff34d9"
}

 

Test Case #8. Retrieve Consent Details | GET /consents/account-access/{consent-id}

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user has a valid access token (see API Keys).
• A Consent has already been created (see Test Cases #1, #2, or #3), and the consentId has been recorded.

 

Test Steps

1. Send the following API request:

 

GET https://{apiHost}/providers/{providerId}/ais/v2/consents/account-access/{consent-id}

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

 

BODY

{}

 

Expected Result

1. The response body contains the Consent details, including the current status, access rights, consent type, validity period, and other relevant information.

 

Example Response

{
  "consentStatus": "valid",
  "_links": {
    "self": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c0e6c-f7cf-70f7-983f-05df521de43d"
    },
    "status": {
      "href": "/sandbox/ais/v2.0/consents/account-access/019c0e6c-f7cf-70f7-983f-05df521de43d/status"
    },
    "account": {
      "href": "/sandbox/ais/v2.0/accounts"
    }
  },
  "access": {
    "payments": [
      {
        "rights": [
          "accountDetails",
          "balances",
          "transactions"
        ]
      }
    ]
  },
  "consentType": "accountList",
  "recurringIndicator": true,
  "validTo": "2026-06-28",
  "frequencyPerDay": 4,
  "combinedServiceIndicator": false
}

 

Test Case #9. Revoke a Consent | DELETE /consents/account-access/{consent-id}

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user has a valid access token (see API Keys).
• A Consent has already been created (see Test Cases #1, #2, or #3), and the consentId has been recorded.

 

Test Steps

1. Send the following API request:

 

DELETE https://{apiHost}/providers/{providerId}/ais/v2/consents/account-access/{consent-id}

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

 

BODY

null

 

Expected Result

A response with HTTP status 204 No Content is returned.

When the Consent status is subsequently requested (see Test Case #5), the status should be terminatedByTpp or revokedByPsu, depending on who initiated the revocation.

 

4. Test Scenarios for Using an Account Consent

 

IMPORTANT: Prerequisites for the following test cases

• The user has a valid access token (see API Keys).
• A Consent has been created (see Test Cases #1, #2, or #3) and its status is valid (see Test Case #5).
• The consentId has been recorded.
   

 

Test Case #10. Retrieve the List of Accounts | GET /accounts

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Test Steps

1. Send the following API request:

 

GET https://{apiHost}/providers/{providerId}/ais/v2/accounts

 

QUERY PARAMETERS

withBalance: boolean // Ignored if the Consent does not grant access to account balances.

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

Consent-ID: "{consentId}"

PSU-IP-Address: "8.8.8.8"

PSU-Corporate-ID: "123456789" // Optional

PSU-Corporate-ID-Type: "PHONE" // Optional

 

BODY

null

 

Expected Result

Returns the list of accounts that match the access rights granted by the Consent. If the Consent includes access to account balances, the response also includes the balances for each account.

 

Example Response (without balances)

{
  "accounts": [
    {
      "iban": "UA1234567890123456789012134567",
      "currency": "UAH",
      "resourceId": "e555222c-6304-40aa-9933-7952e2fd9999",
      "name": "Current account",
      "cashAccountType": "CACC",
      "_links": {
        "balances": {
          "href": "/sandbox/ais/v2.0/accounts/{resourceId}/balances"
        },
        "transactions": {
          "href": "/sandbox/ais/v2.0/accounts/{resourceId}/transactions?dateFrom=2017-01-01&bookingStatus=both"
        }
      }
    }
  ]
}

 

Example Response (with balances)

{
  "accounts": [
    {
      "iban": "UA313220000000026007233566001",
      "currency": "UAH",
      "resourceId": "e555222c-6304-40aa-9933-7952e2fd9999",
      "name": "Current account",
      "cashAccountType": "CACC",
      "balances": [
        {
          "balanceAmount": {
            "currency": "UAH",
            "amount": "500000.00"
          },
          "balanceType": "closingBooked"
        },
        {
          "balanceAmount": {
            "currency": "UAH",
            "amount": "500000.00"
          },
          "balanceType": "expected"
        }
      ],
      "_links": {
        "balances": {
          "href": "/sandbox/ais/v2.0/accounts/{resourceId}/balances"
        },
        "transactions": {
          "href": "/sandbox/ais/v2.0/accounts/{resourceId}/transactions?dateFrom=2017-01-01&bookingStatus=both"
        }
      }
    }
  ]
}

 

Test Case #11. Retrieve Account Details | GET /accounts/{account-id}

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Test Steps

1. Send the following API request:

 

GET https://{apiHost}/providers/{providerId}/ais/v2/accounts/{account-id}

 

QUERY PARAMETERS

withBalance: boolean // Ignored if the Consent does not grant access to account balances.

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

Consent-ID: "{consentId}"

PSU-IP-Address: "8.8.8.8"

PSU-Corporate-ID: "123456789" // Optional

PSU-Corporate-ID-Type: "PHONE" // Optional

 

BODY

null

 

Expected Result

Returns the account details if the Consent grants the required access rights. If the Consent includes access to account balances and withBalance=true, the response also includes the balances for the account.

 

Example Response (without balances)

{
  "iban": "UA1234567890123456789012134567",
  "currency": "UAH",
  "resourceId": "e555222c-6304-40aa-9933-7952e2fd9999",
  "name": "Current account",
  "cashAccountType": "CACC",
  "_links": {
    "balances": {
      "href": "/sandbox/ais/v2.0/accounts/{resourceId}/balances"
    },
    "transactions": {
      "href": "/sandbox/ais/v2.0/accounts/{resourceId}/transactions?dateFrom=2017-01-01&bookingStatus=both"
    }
  }
}

 

Example Response (with balances)

{
  "account": {
    "iban": "UA313220000000026007233566001",
    "currency": "UAH",
    "resourceId": "e55022cc-6304-40aa-9733-7952e2fd9597",
    "name": "Current account",
    "cashAccountType": "CACC",
    "balances": [
      {
        "balanceAmount": {
          "currency": "UAH",
          "amount": "500000.00"
        },
        "balanceType": "closingBooked"
      }
    ],
    "_links": {
      "balances": {
        "href": "/sandbox/ais/v2.0/accounts/e55022cc-6304-40aa-9733-7952e2fd9597/balances"
      },
      "transactions": {
        "href": "/sandbox/ais/v2.0/accounts/e55022cc-6304-40aa-9733-7952e2fd9597/transactions?dateFrom=2017-01-01&bookingStatus=both"
      }
    }
  }
}

 

Test Case #12. Retrieve Account Transactions | GET /accounts/{account-id}/transactions

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Test Steps

1. Send the following API request:

 

GET https://{apiHost}/providers/{providerId}/ais/v2/accounts/{account-id}/transactions

 

QUERY PARAMETERS

withBalance: boolean // Ignored if the Consent does not grant access to balances.

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

Consent-ID: "{consentId}"

PSU-IP-Address: "8.8.8.8"

PSU-Corporate-ID: "123456789" // Optional

PSU-Corporate-ID-Type: "PHONE" // Optional

 

BODY

null

 

Expected Result

Returns transaction details if the Consent grants the required access rights.

 

Example Response

{
  "account": {
    "iban": "UA313220000000026007233566001",
    "currency": "UAH"
  },
  "transactions": {
    "booked": [
      {
        "transactionId": 123,
        "debtor": {
          "name": "Debtor name"
        },
        "debtorAccount": {
          "iban": "LV80BANK0000435195001",
          "currency": "EUR"
        },
        "creditor": {
          "name": "Creditor name"
        },
        "creditorAccount": {
          "iban": "LV80BANK0000435195321",
          "currency": "EUR"
        },
        "transactionAmount": {
          "currency": "EUR",
          "amount": 123.32
        },
        "bookingDate": "12.12.2012",
        "valueDate": "12.12.2012",
        "remittanceInformationUnstructured": "Some details"
      }
    ],
    "pending": [],
    "_links": {
      "account": {
        "href": "/sandbox/ais/v2.0/accounts/c59ab17b-6a71-4052-aef5-72165783f4bf"
      }
    }
  },
  "size": 0,
  "limit": 20
}

 

Test Case #13. Retrieve Transaction Details | GET /accounts/{account-id}/transactions/{transactionId}

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Test Steps

1. Send the following API request:

 

GET https://{apiHost}/providers/{providerId}/ais/v2/accounts/{account-id}/transactions/{transaction-id}

 

QUERY PARAMETERS

dateFrom: date // Required. Format: YYYY-MM-DD.

bookingStatus: string // Required. Possible values: booked, pending, both.

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

Consent-ID: "{consentId}"

PSU-IP-Address: "8.8.8.8"

PSU-Corporate-ID: "123456789" // Optional

PSU-Corporate-ID-Type: "PHONE" // Optional

 

BODY

null

 

Expected Result

Returns the transaction details if the Consent grants the required access rights.

 

Example Response

{
  "account": {
    "iban": "LV80BANK0000435195001",
    "currency": "EUR"
  },
  "transactionsDetails": {
    "transactionId": 123,
    "debtor": {
      "name": "Debtor name"
    },
    "debtorAccount": {
      "iban": "LV80BANK0000435195001",
      "currency": "EUR"
    },
    "creditor": {
      "name": "Creditor name"
    },
    "creditorAccount": {
      "iban": "LV80BANK0000435195321",
      "currency": "EUR"
    },
    "transactionAmount": {
      "currency": "EUR",
      "amount": 123.32
    },
    "bookingDate": "12.12.2012",
    "valueDate": "12.12.2012",
    "remittanceInformationUnstructured": "Some details"
  }
}

 

Payment Initiation Service (PIS)

 

1. Payment Initiation Service Test Scenarios

 

Test Case #1. Create a Payment Initiation | POST /payments/instant-credit-transfers | POST /payments/credit-transfers

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user is registered in the system.
• The user has a valid access token (see API Keys).

 

Test Steps

1. Select the provider for which the payment will be created and record the providerId.
2. Select the {payment-product} type: instant-credit-transfers or credit-transfers.
3. Send the following API request:

 

POST https://{apiHost}/providers/{provider-id}/pis/v2/payments/{payment-product}

 

HEADERS

X-Request-ID: 123e4567-e89b-12d3-a456-426614174000 // {uuid}

PSU-IP-Address: "1.1.1.1"

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

 

BODY

{
  "debtorAccount": {
    "iban": "UA313220000000026007233566001",
    "currency": "UAH"
  },
  "instructedAmount": {
    "currency": "UAH",
    "amount": "12.21"
  },
  "creditor": {
    "name": "Coden Postal",
    "creditorId": "CP122540",
    "creditorIdType": "PSPT"
  },
  "creditorAccount": {
    "iban": "UA633220000000029908753443001",
    "currency": "UAH"
  },
  "remittanceInformationUnstructured": [
    "Some details"
  ]
}

 

Expected Result

1. A payment is created with "transactionStatus": "RCVD".
2. The response contains a "paymentId".

 

Example Response

{
  "transactionStatus": "RCVD",
  "paymentId": "019cfaf3-6d52-76a0-9064-969a181c03ee",
  "_links": {
    "self": {
      "href": "/sandbox/pis/v2.0/payments/instant-credit-transfers/019cfaf3-6d52-76a0-9064-969a181c03ee"
    },
    "status": {
      "href": "/sandbox/pis/v2.0/payments/instant-credit-transfers/019cfaf3-6d52-76a0-9064-969a181c03ee/status"
    },
    "startAuthorisation": {
      "href": "/sandbox/pis/v2.0/payments/instant-credit-transfers/019cfaf3-6d52-76a0-9064-969a181c03ee/authorisations"
    }
  }
}

 

Test Case #2. Start Payment Authorization | POST /payments/{payment-product}/{payment-id}/authorisations

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user has a valid access token (see API Keys).
• A payment has already been created (see Test Case #1), and the paymentId has been recorded.

 

IMPORTANT

The {payment-product} type in the request must match the type used to create the payment in Test Case #1.

Possible values for {payment-product} are instant-credit-transfers and credit-transfers.

 

Test Steps

1. Send the following API request:

 

POST https://{apiHost}/providers/{provider-id}/pis/v2/payments/{payment-product}/{payment-id}/authorisations

 

HEADERS

X-Request-ID: 123e4567-e89b-12d3-a456-426614174000

Client-Redirect-URI: https://google.com

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

PSU-ID: "2353909119" // Use this value for Sandbox

PSU-ID-Type: "PHONE"

 

BODY

{}

 

Expected Result

1. The payment authorization is created.
2. The response contains scaStatus and authorisationId.

 

Example Response

{
  "scaStatus": "received",
  "_links": {
    "scaStatus": {
      "href": "/sandbox/pis/v2.0/payments/instant-credit-transfers/019cfb75-7982-78b5-9a50-b92813afcd7b/authorisations/019cfb75-8e7d-755d-bbc2-e1e5928a3698"
    },
    "scaRedirect": {
      "href": "https://portal.preprod.api.upc.ua/sca-client/mock/upc/bfdb6794-bcb8-4dde-9f3b-07acf73ef202/019cfb75-8e7d-755d-bbc2-e1e5928a3698/consent"
    }
  },
  "authorisationId": "019cfb75-8e7d-755d-bbc2-e1e5928a3698"
}

 

For Client-SCA-Approach-Preference: redirect

In the Sandbox environment, payment confirmation can be emulated for the user with PSU-ID: "2353909119".

1. Follow the link in _links.scaRedirect when Client-SCA-Approach-Preference is set to redirect, or initiate SCA through another channel when Client-SCA-Approach-Preference is set to decoupled.
2. On the Sandbox page, an interface is available where the authorization request can be approved or rejected.
3. Confirm the authorization by clicking "Confirm".

 

2. Payment Verification Test Scenarios

 

Test Case #3. Retrieve Payment Details | GET /payments/{payment-product}/{payment-id}

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user has a valid access token (see API Keys).
• A payment has already been created (see Test Cases #1 and #2), and the payment-id has been recorded.

 

Test Steps

1. Send the following API request:

 

GET https://{apiHost}/providers/{provider-id}/pis/{apiGroupVersion}/payments/{payment-product}/{payment-id}

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

 

BODY

null

 

Expected Result

The response body contains the current payment status.

 

Example Response Fragment

{
  "transactionStatus": "RCVD",
  "_links": {
    "self": {
      "href": "/sandbox/pis/v2.0/payments/instant-credit-transfers/019cfbb3-d015-7a47-bd16-76f18e90d58e"
    }
    //...
  }
}

 

Test Case #4. Retrieve Payment Status | GET /payments/{payment-product}/{payment-id}/status

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user has a valid access token (see API Keys).
• A payment has already been created (see Test Cases #1 and #2), and the payment-id has been recorded.

 

Test Steps

1. Send the following API request:

 

GET https://{apiHost}/providers/{provider-id}/pis/{apiGroupVersion}/payments/{payment-product}/{payment-id}/status

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

 

BODY

null

 

Expected Result

The response body contains the current payment status.

 

Example Response Fragment

{
  "transactionStatus": "RCVD"
}

 

Test Case #5. Retrieve Payment Authorisations | GET /payments/{payment-product}/{payment-id}/authorisations

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user has a valid access token (see API Keys).
• A payment has already been created (see Test Cases #1 and #2), and the payment-id has been recorded.

 

Test Steps

1. Send the following API request:

 

GET https://{apiHost}/providers/{provider-id}/pis/{apiGroupVersion}/payments/{payment-product}/{payment-id}/authorisations

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

 

BODY

null

 

Expected Result

The response body contains the available authorisationIds.

 

Example Response

{
  "authorisationIds": [
    "019cfbb3-eee5-771a-b877-89a5a17cd505"
  ]
}

 

Test Case #6. Retrieve Payment Authorisation Details | GET /payments/{payment-product}/{payment-id}/authorisations/{authorisation-id}

 

API Documentation

The requirements for request headers and the request body are described in the documentation for the corresponding API version.

 

Prerequisites

• The user has a valid access token (see API Keys).
• A payment has already been created (see Test Cases #1 and #2), and the payment-id has been recorded.
• The authorisation-id has been recorded (see Test Case #5).

 

Test Steps

1. Send the following API request:

 

GET https://{apiHost}/providers/{provider-id}/pis/{apiGroupVersion}/payments/{payment-product}/{payment-id}/authorisations/{authorisation-id}

 

HEADERS

X-Request-ID: "72ebf0c7-31d4-43be-8786-261bd4e5d8a3" // {uuid}

Content-Type: application/json

X-API-KEY: 111109ee-b4df-427c-0000-f2d8b1c99999 // Generated API key for the application

 

BODY

null

 

Expected Result

The response body contains the authorisation details, including the authorisationId.

 

Example Response

{
  "scaStatus": "finalised",
  "_links": {
    "scaStatus": {
      "href": "/sandbox/pis/v2.0/payments/instant-credit-transfers/019cfbb3-d015-7a47-bd16-76f18e90d58e/authorisations/019cfbb3-eee5-771a-b877-89a5a17cd505"
    },
    "scaRedirect": {
      "href": "https://portal.preprod.api.upc.ua/sca-client/mock/upc/bfdb6794-bcb8-4dde-9f3b-07acf73ef202/019cfbb3-eee5-771a-b877-89a5a17cd505/consent"
    }
  },
  "authorisationId": "019cfbb3-eee5-771a-b877-89a5a17cd505"
}