{ "info": { "_postman_id": "99dae078-0506-4357-b65b-7e54c27db03f", "name": "Bankdata Payment sandbox (v1 + v2)", "description": "1. Import this collection and the **Payment Sandbox** environment; select the environment.\n \n2. Fill in `clientId`, `x-api-key` and `redirectUri` from your sandbox sign-up (`twoLeggedScope` is pre-filled with `pisprepare`).\n \n3. In **Settings > Certificates**, add your **tpptst100.pfx** test client certificate for BOTH hosts `sandbox-cert-api.sydbank.dk` (resource server) and `sandbox-cert-auth.sydbank.dk` (mTLS token server).\n \n4. Through the various requests you can then initiate a payment, read it, start authorisation and get an example of the flow that is required to obtain the 3-legged OAuth/SCA flow token.\n \n5. The sandbox API relies on static data for the response which is why transaction status doesn't change despite making various requests to the endpoints.\n \n\nServers: resource = `sandbox-cert-api.sydbank.dk`, OAuth authorize (TLS) = `sandbox-auth.sydbank.dk`, OAuth token (mTLS) = `sandbox-cert-auth.sydbank.dk`. See [https://www.bankdata.dk/developers/api/security](https://www.bankdata.dk/developers/api/security).", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "_exporter_id": "26240900" }, "item": [ { "name": "0 - Authentication (2-legged)", "item": [ { "name": "OIDC discovery", "event": [ { "listen": "test", "script": { "exec": [ "const w = pm.response.json();", "pm.test('discovery OK', () => pm.response.to.have.status(200));", "pm.environment.set('authorizationEndpoint', w.authorization_endpoint);", "// Token calls MUST use the mTLS-fronted endpoint. Never fall back to the top-level", "// (TLS) token_endpoint - that host presents no client certificate and the AS rejects", "// the request with 'invalid_client'.", "if (w.mtls_endpoint_aliases && w.mtls_endpoint_aliases.token_endpoint) {", " pm.environment.set('mtlsTokenEndpoint', w.mtls_endpoint_aliases.token_endpoint);", "}", "console.log('mTLS token endpoint:', pm.environment.get('mtlsTokenEndpoint'));" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "noauth" }, "method": "GET", "header": [], "url": { "raw": "{{certAuthHost}}/oidc/.well-known/openid-configuration", "host": [ "{{certAuthHost}}" ], "path": [ "oidc", ".well-known", "openid-configuration" ] }, "description": "Discovers authorization_endpoint and the mTLS token_endpoint. This document is served over mTLS on sandbox-cert-auth.sydbank.dk, so the tpptst100.pfx client certificate must be configured for that host." }, "response": [] }, { "name": "Get 2-legged access token (client credentials)", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('2-legged token issued', () => pm.response.to.have.status(200));", "const b = pm.response.json();", "pm.environment.set('accessToken', b.access_token);", "console.log('2-legged access_token stored in {{accessToken}}');" ] } } ], "request": { "auth": { "type": "noauth" }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "key": "grant_type", "value": "client_credentials" }, { "key": "client_id", "value": "{{clientId}}" }, { "key": "scope", "value": "{{twoLeggedScope}}" } ] }, "url": { "raw": "{{mtlsTokenEndpoint}}/", "host": [ "{{mtlsTokenEndpoint}}" ], "path": [ "" ] }, "description": "mTLS-protected token endpoint (sandbox-cert-auth.sydbank.dk). Uses the tpptst100.pfx client certificate. Stores the token in {{accessToken}}." }, "response": [] } ] }, { "name": "1 - Initiate Payment", "item": [ { "name": "domestic-credit-transfers (v1)", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('initiation 201', () => pm.response.to.have.status(201));", "const resp=pm.response.json();", "const req=pm.request;", "pm.environment.set('paymentId', resp.paymentId);", "pm.environment.set('paymentVersion', req.url.path[1]);", "pm.environment.set('paymentProduct', req.url.path[3]);" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "POST", "header": [ { "key": "x-api-key", "value": "{{x-api-key}}" }, { "key": "X-Request-ID", "value": "{{$guid}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"debtorAccount\": {\n \"bban\": 99991234567890,\n \"currency\": \"DKK\"\n },\n \"instructedAmount\": {\n \"currency\": \"DKK\",\n \"amount\": \"1234.56\"\n },\n \"creditorAccount\": {\n \"bban\": 99992233445566,\n \"currency\": \"DKK\"\n },\n \"remittanceInformationStructured\": {\n \"reference\": \"Text to receiving account\"\n },\n \"requestedExecutionDate\": \"2045-12-02\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{resourceHost}}/{{basePath}}/v1/payments/domestic-credit-transfers", "host": [ "{{resourceHost}}" ], "path": [ "{{basePath}}", "v1", "payments", "domestic-credit-transfers" ] } }, "response": [] }, { "name": "instant-domestic-credit-transfers (v1)", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('initiation 201', () => pm.response.to.have.status(201));", "const resp=pm.response.json();", "const req=pm.request;", "pm.environment.set('paymentId', resp.paymentId);", "pm.environment.set('paymentVersion', req.url.path[1]);", "pm.environment.set('paymentProduct', req.url.path[3]);" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "var moment = require('moment')\r", "pm.environment.set(\"requestedExecutionDate\", moment().format(\"YYYY-MM-DD\"))" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"debtorAccount\": {\n \"bban\": 99991234567890,\n \"currency\": \"DKK\"\n },\n \"instructedAmount\": {\n \"currency\": \"DKK\",\n \"amount\": \"1234.56\"\n },\n \"creditorAccount\": {\n \"bban\": 99992233445566,\n \"currency\": \"DKK\"\n },\n \"remittanceInformationStructured\": {\n \"reference\": \"Text to receiving account\"\n },\n \"remittanceInformationUnstructuredArray\": [\n \"Instant transfer must have \",\n \"requested execution date = today \"\n ],\n \"requestedExecutionDate\": \"{{requestedExecutionDate}}\"\n}" }, "url": { "raw": "{{resourceHost}}/{{basePath}}/v1/payments/instant-domestic-credit-transfers", "host": [ "{{resourceHost}}" ], "path": [ "{{basePath}}", "v1", "payments", "instant-domestic-credit-transfers" ] } }, "response": [] }, { "name": "intraday-domestic-credit-transfers (v1)", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('initiation 201', () => pm.response.to.have.status(201));", "const resp=pm.response.json();", "const req=pm.request;", "pm.environment.set('paymentId', resp.paymentId);", "pm.environment.set('paymentVersion', req.url.path[1]);", "pm.environment.set('paymentProduct', req.url.path[3]);" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "var moment = require('moment')\r", "pm.environment.set(\"requestedExecutionDate\", moment().format(\"YYYY-MM-DD\"))" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"debtorAccount\": {\n \"bban\": 99991234567890,\n \"currency\": \"DKK\"\n },\n \"instructedAmount\": {\n \"currency\": \"DKK\",\n \"amount\": \"1234.56\"\n },\n \"creditorAccount\": {\n \"bban\": 99992233445566,\n \"currency\": \"DKK\"\n },\n \"remittanceInformationStructured\": {\n \"reference\": \"Text to receiving account\"\n },\n \"remittanceInformationUnstructuredArray\": [\n \"Further information to creditor 01\",\n \"Further information to creditor 02\",\n \"Further information to creditor 03\",\n \"Further information to creditor 04\",\n \"Further information to creditor 05\"\n ],\n \"requestedExecutionDate\": \"{{requestedExecutionDate}}\"\n}" }, "url": { "raw": "{{resourceHost}}/{{basePath}}/v1/payments/intraday-domestic-credit-transfers", "host": [ "{{resourceHost}}" ], "path": [ "{{basePath}}", "v1", "payments", "intraday-domestic-credit-transfers" ] } }, "response": [] }, { "name": "periodic-payments/domestic-credit-transfers (v1)", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('initiation 201', () => pm.response.to.have.status(201));", "const resp=pm.response.json();", "const req=pm.request;", "pm.environment.set('paymentId', resp.paymentId);", "pm.environment.set('paymentVersion', req.url.path[1]);", "pm.environment.set('paymentProduct', req.url.path[3]);" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "var moment = require('moment')\r", "pm.environment.set(\"startDate\", moment().add(1, 'days').format(\"YYYY-MM-DD\"))\r", "pm.environment.set(\"endDate\", moment().add(1, 'years').format(\"YYYY-MM-DD\"))" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"debtorAccount\": {\n \"bban\": \"99992233445566\",\n \"currency\": \"DKK\"\n },\n \"instructedAmount\": {\n \"currency\": \"DKK\",\n \"amount\": \"1234.56\"\n },\n \"creditorAccount\": {\n \"bban\": \"99992233445566\",\n \"currency\": \"DKK\"\n },\n \"remittanceInformationStructured\": {\n \"reference\": \"RIF REF\"\n },\n \"startDate\": \"{{startDate}}\",\n \"endDate\": \"{{endDate}}\",\n \"frequency\": \"Monthly\",\n \"dayOfExecution\": \"1\",\n \"executionRule\": \"preceding\"\n}" }, "url": { "raw": "{{resourceHost}}/{{basePath}}/v1/periodic-payments/domestic-credit-transfers", "host": [ "{{resourceHost}}" ], "path": [ "{{basePath}}", "v1", "periodic-payments", "domestic-credit-transfers" ] } }, "response": [] }, { "name": "sepa-credit-transfers (v2)", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('initiation 201', () => pm.response.to.have.status(201));", "const resp=pm.response.json();", "const req=pm.request;", "pm.environment.set('paymentId', resp.paymentId);", "pm.environment.set('paymentVersion', req.url.path[1]);", "pm.environment.set('paymentProduct', req.url.path[3]);" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "var moment = require('moment')\r", "pm.environment.set(\"requestedExecutionDate\", moment().add(1, 'days').format(\"YYYY-MM-DD\"))" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "POST", "header": [ { "key": "x-api-key", "value": "{{x-api-key}}" }, { "key": "X-Request-ID", "value": "{{$guid}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}" }, { "key": "PSU-ID", "value": "{{psuId}}" } ], "body": { "mode": "raw", "raw": "{\n \"debtorAccount\": {\n \"bban\": \"99998888888888\"\n },\n \"paymentIdentification\": {\n \"endToEndId\": \"endToEndIdentification\"\n },\n \"requestedExecutionDate\": \"{{requestedExecutionDate}}\",\n \"instructedAmount\": {\n \"currency\": \"EUR\",\n \"amount\": \"1234.56\"\n },\n \"creditorAccount\": {\n \"iban\": \"DE89370400440532013000\"\n },\n \"creditor\": {\n \"name\": \"Baerenhausen Arboretum\"\n },\n \"remittanceInformationUnstructured\": [\n \"Text to creditor, max 35 chars....X\"\n ]\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{resourceHost}}/{{basePath}}/v2/payments/sepa-credit-transfers", "host": [ "{{resourceHost}}" ], "path": [ "{{basePath}}", "v2", "payments", "sepa-credit-transfers" ] } }, "response": [] }, { "name": "cross-border-credit-transfers (v2)", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('initiation 201', () => pm.response.to.have.status(201));", "const resp=pm.response.json();", "const req=pm.request;", "pm.environment.set('paymentId', resp.paymentId);", "pm.environment.set('paymentVersion', req.url.path[1]);", "pm.environment.set('paymentProduct', req.url.path[3]);" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "POST", "header": [ { "key": "x-api-key", "value": "{{x-api-key}}" }, { "key": "X-Request-ID", "value": "{{$guid}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}" }, { "key": "PSU-ID", "value": "{{psuId}}" } ], "body": { "mode": "raw", "raw": "{\n \"debtorAccount\": {\n \"bban\": \"99991234567890\"\n },\n \"paymentIdentification\": {\n \"endToEndId\": \"endToEndIdentification\"\n },\n \"instructedAmount\": {\n \"currency\": \"USD\",\n \"amount\": \"777.77\"\n },\n \"creditorAccount\": {\n \"iban\": \"BH67BMAG00001299123456\"\n },\n \"creditor\": {\n \"name\": \"Bahrain International Circuit\",\n \"postalAddress\": {\n \"streetName\": \"Streetname\",\n \"buildingNumber\": \"123\",\n \"postCode\": \"889900\",\n \"townName\": \"Metropolis\",\n \"country\": \"BH\"\n }\n },\n \"creditorAgent\": {\n \"financialInstitutionId\": {\n \"bic\": \"ARABBHBMMAN\"\n }\n },\n \"chargeBearer\": \"SHAR\",\n \"remittanceInformationUnstructured\": [\n \"Text to creditor, max 35 chars....X\"\n ],\n \"requestedExecutionDate\": \"{{requestedExecutionDate}}\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{resourceHost}}/{{basePath}}/v2/payments/cross-border-credit-transfers", "host": [ "{{resourceHost}}" ], "path": [ "{{basePath}}", "v2", "payments", "cross-border-credit-transfers" ] } }, "response": [] }, { "name": "Get payment details", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('details 200', () => pm.response.to.have.status(200));" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "GET", "header": [ { "key": "x-api-key", "value": "{{x-api-key}}" }, { "key": "X-Request-ID", "value": "{{$guid}}" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "url": { "raw": "{{resourceHost}}/openbanking-payment/{{paymentVersion}}/payments/{{paymentProduct}}/{{paymentId}}", "host": [ "{{resourceHost}}" ], "path": [ "openbanking-payment", "{{paymentVersion}}", "payments", "{{paymentProduct}}", "{{paymentId}}" ] } }, "response": [] }, { "name": "Get payment status", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('status 200', () => pm.response.to.have.status(200));" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "GET", "header": [ { "key": "x-api-key", "value": "{{x-api-key}}" }, { "key": "X-Request-ID", "value": "{{$guid}}" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "url": { "raw": "{{resourceHost}}/{{basePath}}/{{paymentVersion}}/payments/{{paymentProduct}}/{{paymentId}}/status", "host": [ "{{resourceHost}}" ], "path": [ "{{basePath}}", "{{paymentVersion}}", "payments", "{{paymentProduct}}", "{{paymentId}}", "status" ] } }, "response": [] } ] }, { "name": "2 - Authorisation", "item": [ { "name": "Start authorisation", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('authorisation started (201)', () => pm.response.to.have.status(201));", "const b = pm.response.json();", "if (b.authorisationId) pm.environment.set('authorisationId', b.authorisationId);", "if (b._links) {", " if (b._links.scaOAuth) pm.environment.set('scaOAuth', b._links.scaOAuth.href);", " if (b._links.scaStatus) pm.environment.set('scaStatus', b._links.scaStatus.href);", "}", "console.log('scaOAuth (well-known) URL:', pm.environment.get('scaOAuth'));" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "POST", "header": [ { "key": "x-api-key", "value": "{{x-api-key}}" }, { "key": "X-Request-ID", "value": "{{$guid}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}" }, { "key": "PSU-ID", "value": "{{psuId}}" } ], "url": { "raw": "{{resourceHost}}/{{basePath}}/{{paymentVersion}}/payments/{{paymentProduct}}/{{paymentId}}/authorisations", "host": [ "{{resourceHost}}" ], "path": [ "{{basePath}}", "{{paymentVersion}}", "payments", "{{paymentProduct}}", "{{paymentId}}", "authorisations" ] }, "description": "Starts SCA. Returns _links.scaOAuth (well-known discovery URL) used below." }, "response": [] }, { "name": "Get Authorisation SCA status", "event": [ { "listen": "test", "script": { "exec": [ "pm.test(\"Response is OK\", function() {", " pm.response.to.have.status(200);", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "body": { "mode": "raw", "raw": "" }, "url": { "raw": "{{resourceHost}}/{{basePath}}/{{scaStatus}}", "host": [ "{{resourceHost}}" ], "path": [ "{{basePath}}", "{{scaStatus}}" ] }, "description": "Check the status for Strong Customer Authorisation." }, "response": [] }, { "name": "Get SCA OAuth well-known", "event": [ { "listen": "test", "script": { "exec": [ "const w = pm.response.json();", "pm.test('sca well-known OK', () => pm.response.to.have.status(200));", "pm.environment.set('authorizationEndpoint', w.authorization_endpoint);", "if (w.mtls_endpoint_aliases && w.mtls_endpoint_aliases.token_endpoint) {", " pm.environment.set('mtlsTokenEndpoint', w.mtls_endpoint_aliases.token_endpoint);", "}" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "noauth" }, "method": "GET", "header": [], "url": { "raw": "{{scaOAuth}}/", "host": [ "{{scaOAuth}}" ], "path": [ "" ] }, "description": "GET the .well-known document from _links.scaOAuth to discover authorization_endpoint and the mTLS token_endpoint." }, "response": [] }, { "name": "Build SCA authorization URL (see console)", "event": [ { "listen": "prerequest", "script": { "exec": [ "// PKCE (S256) + authorization URL construction (Berlin Group 1.3 ch.13 requires S256)", "function rnd(n){var s='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';var o='';for(var i=0;i>> OPEN THIS URL IN A BROWSER TO COMPLETE SCA <<<');", "console.log(url);", "console.log('After SCA your redirect URI receives a ?code= parameter. Because that code is very short-lived, the code->token exchange (request 8) is meant to be done automatically by your backend on the callback - see request 8 for the exact request to replicate.');" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "test", "script": { "exec": [ "pm.test('authorization endpoint reachable', () => pm.expect(pm.response.code).to.be.oneOf([200,302,400,401,403]));" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "noauth" }, "method": "GET", "header": [], "url": { "raw": "{{authorizationEndpoint}}/", "host": [ "{{authorizationEndpoint}}" ], "path": [ "" ] }, "description": "Send this request to run the pre-request script, which builds a fresh PKCE code_verifier/challenge and the full authorization URL (scope=pis:{paymentId}, acr={{acr}}). Copy {{authorizationUrl}} (also logged to the console) into a browser and complete the PSU login/SCA. Your redirect URI then receives a ?code= parameter. Because that code is very short-lived, the exchange request after this is intended to be automated by your backend on the callback - the exchange request documents the exact call to replicate server-side." }, "response": [] }, { "name": "Exchange code for 3-legged token (reference / template only)", "event": [ { "listen": "test", "script": { "exec": [ "const b = pm.response.json();", "pm.test('3-legged token issued', () => pm.response.to.have.status(200));", "if (pm.response.code === 200) {", " pm.environment.set('accessToken3L', b.access_token);", " if (b.refresh_token) pm.environment.set('refreshToken', b.refresh_token);", "}" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "noauth" }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "key": "grant_type", "value": "authorization_code" }, { "key": "code", "value": "{{authCode}}" }, { "key": "code_verifier", "value": "{{codeVerifier}}" }, { "key": "client_id", "value": "{{clientId}}" }, { "key": "redirect_uri", "value": "{{redirectUri}}" } ] }, "url": { "raw": "{{mtlsTokenEndpoint}}/", "host": [ "{{mtlsTokenEndpoint}}" ], "path": [ "" ] }, "description": "REFERENCE / TEMPLATE ONLY - not intended to be run by hand.\n\nThis documents the exact request a TPP must send to exchange the authorization code for a 3-legged access token: an mTLS POST to the token endpoint on sandbox-cert-auth.sydbank.dk (tpptst100.pfx client certificate) with grant_type=authorization_code, the code, the PKCE code_verifier from the previous step, client_id and the same redirect_uri used in the previous step.\n\nThe authorization code returned to your redirect URI is very short-lived, so manually copying it from the browser and pasting it here before sending is generally not fast enough - this exchange is meant to be performed automatically by the TPP's backend the moment the callback is received. Use this request as the blueprint for that server-side call." }, "response": [] } ] }, { "name": "3 - Cancellation", "item": [ { "name": "Delete sepa-credit-transfers", "event": [ { "listen": "test", "script": { "exec": [ "pm.test(\"Response is OK\", function() {", " pm.response.to.have.status(202);", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "url": { "raw": "{{resourceHost}}/openbanking-payment/v2/payments/sepa-credit-transfers/856b6f2b-5fc9-4d33-9ef8-a05e87559az1", "host": [ "{{resourceHost}}" ], "path": [ "openbanking-payment", "v2", "payments", "sepa-credit-transfers", "856b6f2b-5fc9-4d33-9ef8-a05e87559az1" ] }, "description": "This POST always creates a dummy payment with\npaymentId = 6e528be2-f6fc-4436-8fae-01920b5dee11.\n\nUse the paymentId to GET payment details and payment status.\n\nPOST authorisation and GET authorisation SCA status and authorisation OAuth.\n\n---\nPOST the next payment type and get a new paymentId.\nRepeat the steps to GET payment details/status and POST authorisation." }, "response": [] }, { "name": "Delete cross-border-credit-transfers", "event": [ { "listen": "test", "script": { "exec": [ "pm.test(\"Response is OK\", function() {", " pm.response.to.have.status(202);", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "url": { "raw": "{{resourceHost}}/openbanking-payment/v2/payments/cross-border-credit-trasnfers/bd3295bc-7dd1-4857-9600-104add057ez1", "host": [ "{{resourceHost}}" ], "path": [ "openbanking-payment", "v2", "payments", "cross-border-credit-trasnfers", "bd3295bc-7dd1-4857-9600-104add057ez1" ] } }, "response": [] }, { "name": "Delete domestic-credit-transfers", "event": [ { "listen": "test", "script": { "exec": [ "pm.test(\"Response is OK\", function() {", " pm.response.to.have.status(202);", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "url": { "raw": "{{resourceHost}}/openbanking-payment/v1/payments/domestic-credit-transfers/8a77549c-ad24-4b4b-8a38-14ba516ba2z1", "host": [ "{{resourceHost}}" ], "path": [ "openbanking-payment", "v1", "payments", "domestic-credit-transfers", "8a77549c-ad24-4b4b-8a38-14ba516ba2z1" ] } }, "response": [] }, { "name": "Get payment status - cancelled", "event": [ { "listen": "test", "script": { "exec": [ "pm.test(\"Response is OK\", function() {", " pm.response.to.have.status(200);", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "body": { "mode": "raw", "raw": "" }, "url": { "raw": "{{resourceHost}}/openbanking-payment/v1/payments/domestic-credit-transfers/8a77549c-ad24-4b4b-8a38-14ba516ba2z1/status", "host": [ "{{resourceHost}}" ], "path": [ "openbanking-payment", "v1", "payments", "domestic-credit-transfers", "8a77549c-ad24-4b4b-8a38-14ba516ba2z1", "status" ] }, "description": "This GET returns payment status for the dummy payment referred to in the paymentId." }, "response": [] }, { "name": "Delete domestic-credit-transfers with link", "event": [ { "listen": "test", "script": { "exec": [ "/*", "Check response for http staus", "*/", "pm.test(\"Response is OK\", function() {", " pm.response.to.have.status(202);", "});", "", "pm.environment.set(\"startAuthorisation\", pm.response.json()._links.startAuthorisation.href);" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "var moment = require('moment')\r", "pm.environment.set(\"requestedExecutionDate\", moment().add(1, 'days').format(\"YYYY-MM-DD\"))" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "url": { "raw": "{{resourceHost}}/openbanking-payment/v1/payments/domestic-credit-transfers/8a77549c-ad24-4b4b-8a38-14ba516ba2z2", "host": [ "{{resourceHost}}" ], "path": [ "openbanking-payment", "v1", "payments", "domestic-credit-transfers", "8a77549c-ad24-4b4b-8a38-14ba516ba2z2" ] } }, "response": [] }, { "name": "Payment cancellation authorisation", "event": [ { "listen": "test", "script": { "exec": [ "pm.test(\"Response is OK\", function() {", " pm.response.to.have.status(201);", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "url": { "raw": "{{resourceHost}}/openbanking-payment/v1/payments/domestic-credit-transfers/8a77549c-ad24-4b4b-8a38-14ba516ba2z2/cancellation-authorisations", "host": [ "{{resourceHost}}" ], "path": [ "openbanking-payment", "v1", "payments", "domestic-credit-transfers", "8a77549c-ad24-4b4b-8a38-14ba516ba2z2", "cancellation-authorisations" ] } }, "response": [] }, { "name": "Authorisation SCA status", "event": [ { "listen": "test", "script": { "exec": [ "pm.test(\"Response is OK\", function() {", " pm.response.to.have.status(200);", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "url": { "raw": "{{resourceHost}}/openbanking-payment/v1/payments/domestic-credit-transfers/8a77549c-ad24-4b4b-8a38-14ba516ba2z2/cancellation-authorisations/aab002e8-80ce-46c9-a3a2-b89e841d4130", "host": [ "{{resourceHost}}" ], "path": [ "openbanking-payment", "v1", "payments", "domestic-credit-transfers", "8a77549c-ad24-4b4b-8a38-14ba516ba2z2", "cancellation-authorisations", "aab002e8-80ce-46c9-a3a2-b89e841d4130" ] }, "description": "Check the status for Strong Customer Authorisation." }, "response": [] }, { "name": "Get payment status - cancelled", "event": [ { "listen": "test", "script": { "exec": [ "pm.test(\"Response is OK\", function() {", " pm.response.to.have.status(200);", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "url": { "raw": "{{resourceHost}}/openbanking-payment/v1/payments/domestic-credit-transfers/8a77549c-ad24-4b4b-8a38-14ba516ba2z2/status", "host": [ "{{resourceHost}}" ], "path": [ "openbanking-payment", "v1", "payments", "domestic-credit-transfers", "8a77549c-ad24-4b4b-8a38-14ba516ba2z2", "status" ] }, "description": "This GET returns payment status for the dummy payment referred to in the paymentId." }, "response": [] }, { "name": "Delete domestic-credit-transfers 409", "event": [ { "listen": "test", "script": { "exec": [ "pm.test(\"Response is OK\", function() {", " pm.response.to.have.status(409);", "});", "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" }, { "key": "X-Request-ID", "value": "{{$guid}}", "type": "text" }, { "key": "PSU-IP-Address", "value": "{{psuIpAddress}}", "type": "text" }, { "key": "x-api-key", "value": "{{x-api-key}}", "type": "text" }, { "key": "Accept", "value": "application/json", "type": "text" }, { "key": "PSU-ID", "value": "{{psuId}}", "type": "text" } ], "url": { "raw": "{{resourceHost}}/openbanking-payment/v1/payments/domestic-credit-transfers/8a77549c-ad24-4b4b-8a38-14ba516ba2z3", "host": [ "{{resourceHost}}" ], "path": [ "openbanking-payment", "v1", "payments", "domestic-credit-transfers", "8a77549c-ad24-4b4b-8a38-14ba516ba2z3" ] } }, "response": [] } ] } ] }