openapi: 3.0.0
tags:
    - name: accounts
      description: 'Listing of accounts'
    - name: consents
      description: 'Managing consents'
    - name: payments
      description: 'Initiate payments'
info:
  version: "1.0.0"
  title: FIBANK Albania PSD2 Implementation
  description: FIBANK Albania PSD2 API based on the <a href="../static/Implementation Guidelines V1.3.12_20220701.pdf">Berlin Group NextGen PSD2 v1.3.12</a> (01.07.2020)
  contact:
    name: FIBANK Albania
    email: psd2@fibank.al
    url: https://www.fibank.al/
  license:
    name: Creative Commons Attribution-NoDerivatives 4.0 International Public License
    url: https://creativecommons.org/licenses/by-nd/4.0/
servers:
  - url: https://xs2a.fibank.al/v1
    description: Production
components:
  schemas:
    AuthorisationId:
      description: Resource identification of the related SCA.
      type: string
      example: '1234'
    ConsentId:
      type: string
      description: 'Identification of the consent resource as it is used in the API structure. Shall be contained, if a consent resource was generated.'
      example: '1234'
    TransactionFeeIndicator:
      type: boolean
    ScaStatus:
      type: string
      description: This data element is containing information about the status of the SCA method applied. This is free text but might be coded in a future version of the specification.
      enum:
        - received
        - psuIdentified
        - psuAuthenticated
        - scaMethodSelected
        - started
        - finalised
        - failed
        - exempted
    ServiceLevelCode:
      type: string
      enum:
        - SDVA
        - NEXT
        - SPOT
    PsuMessage:
      type: string
      description: 'Text to be displayed to the PSU'
    PsuName:
      type: string
      description: 'Name of the PSU.'
      maxLength: 60
    AccountOwner:
      description: 'Identifies a Person that acts as an account owner'
      type: object
      required:
        - name
      properties:
        name:
          description: Account owner name
          type: string
          maxLength: 70
        role:
          type: string
          enum:
            - owner
            - legalRepresentative
            - authorisedUser
    PaymentId:
      type: string
      description: 'resource identification of the generated payment initiation resource.'
      example: "4d452646-bc2a-400a-9930-7ef88c555b58"
    HrefType:
      type: object
      required:
        - href
      properties:
        href:
          type: string
    ConsentStatus:
      type: string
      enum:
        - received
        - rejected
        - valid
        - revokedByPsu
        - expired
        - terminatedByTpp
      description: 'authentication status of the consent'
      example: 'received'
    Currency:
      type: string
      pattern: '^[A-Z]{3}$'
      description: ISO 4217 Alpha 3 currency code
      maxLength: 3
      example: 'ALL'
    ChargeBearer:
      type: string
      enum:
        - DEBT
        - CRED
        - SHAR
    ExchangeRate:
      type: object
      required:
        - currencyFrom
        - currencyTo
        - rate
        - rateDate
      properties:
        currencyFrom:
          $ref: '#/components/schemas/Currency'
        currencyTo:
          $ref: '#/components/schemas/Currency'
        rate:
          type: string
        rateDate:
          type: string
          format: date
          example: '2017-10-30'
    Address:
      type: object
      required:
        - country
        - street
      properties:
        street:
          type: string
          maxLength: 140
        country:
          type: string
          pattern: '^[A-Z]{2}$'
    Amount:
      type: object
      required:
        - amount
        - currency
      properties:
        amount:
          type: string
          description: 'The amount given with fractional digits, where fractions must be compliant to the currency definition. Up to 14 significant figures. Negative amounts are signed by minus. The decimal separator is a dot.'
          example: '2'
        currency:
          $ref: '#/components/schemas/Currency'
    AccountReference:
      type: object
      description: 'This type is containing any account identification which can be used on payload-level to address specific accounts. The ASPSP will document which account reference type it will support. Exactly one of the attributes defined as "conditional" shall be used.'
      required:
        - iban
      properties:
        iban:
          type: string
          example: 'AL47212110090000000235698741'
          description: This data element can be used in the body of the Consent Request Message for retrieving account access consent from this account. This data elements is used for payment accounts which have no IBAN.
    AccountAccess:
      type: object
      properties:
        accounts:
          type: array
          items:
            $ref: '#/components/schemas/AccountReference'
          minItems: 1
          description: 'Is asking for detailed account information. If the array is empty, the TPP is asking for an accessible account list. This may be restricted in a PSU/ASPSP authorization dialogue.'
        balances:
          type: array
          items:
            $ref: '#/components/schemas/AccountReference'
          minItems: 1
          description: 'Is asking for balances of the addressed accounts. If the array is empty, the TPP is asking for the balances of all accessible account lists. This may be restricted in a PSU/ASPSP authorization dialogue'
        transactions:
          type: array
          items:
            $ref: '#/components/schemas/AccountReference'
          minItems: 1
          description: 'Is asking for transactions of the addressed accounts. If the array is empty, the TPP is asking for the transactions of all accessible account lists. This may be restricted in a PSU/ASPSP authorization dialogue'
        availableAccounts:
          type: string
          enum:
            - allAccounts
          description: 'Optional if supported by API provide. Only the values "allAccounts" is admitted.'
          example: 'allAccounts'
        availableAccountsWithBalance:
          type: string
          enum:
            - allAccounts
          description: 'Optional if supported by API provide. Only the values "allAccounts" is admitted.'
          example: 'allAccounts'
        allPsd2:
          type: string
          enum:
            - allAccounts
          description: 'Optional if supported by API provide. Only the value "allAccounts" is admitted.'
          example: 'allAccounts'
    AccountDetails:
      type: object
      required:
        - resourceId
        - iban
        - currency
        - displayName
        - status
        - usage
      properties:
        resourceId:
          type: string
          maxLength: 35
          description: This is the data element to be used in the path when retrieving data from a dedicated account.
        iban:
          type: string
          description: 'This data element can be used in the body of the Consent Request Message for retrieving account access consent from this payment account.'
          example: 'AL47212110090000000235698741'
        pan:
          type: string
          maxLength: 35
          description: 'Primary Account Number (PAN) of a card, can be tokenized by the ASPSP due to PCI DSS requirements. This data element can be used in the body of the Consent Request Message for retrieving account access consent from this card.'
        maskedPan:
          type: string
          maxLength: 35
          description: 'Primary Account Number (PAN) of a card, can be tokenized by the ASPSP due to PCI DSS requirements. This data element can be used in the body of the Consent Request Message for retrieving account access consent from this card.'
        currency:
          $ref: '#/components/schemas/Currency'
        displayName:
          type: string
          maxLength: 35
          description: Name of the account as defined by the PSU within online channels.
        ownerName:
          type: string
          maxLength: 60
          description: Name of the legal account owner.
        product:
          type: string
          maxLength: 35
          description: Product Name of the Bank for this account, proprietary definition
        cashAccountType:
          type: string
          description: ExternalCashAccountType1Code from ISO 20022
        bic:
          type: string
          pattern: '[a-zA-Z]{4}[a-zA-Z]{2}[2-9a-zA-Z][0-9a-np-zA-NP-Z](([0-9a-wy-zA-WY-Z][0-9a-zA-Z]{2})|([xX]{3})|)'
          description: The BIC associated to the account.
        linkedAccounts:
          type: string
          maxLength: 70
          description: Case of a set of pending card transactions, the APSP will provide the relevant cash account the card is set up on.
        usage:
          type: string
          maxLength: 140
          description: 'Specifies the usage of the account - PRIV: private personal account - ORGA: professional account'
          example: 'PRIV'
        details:
          type: string
          maxLength: 140
          description: 'Specifications that might be provided by the ASPSP - characteristics of the account - characteristics of the relevant card'
        balances:
          type: array
          items:
            $ref: '#/components/schemas/Balance'
        _links:
          $ref: "#/components/schemas/LinksAccountDetails"
    AccountReport:
      type: object
      required:
        - booked
        - _links
      properties:
        booked:
          type: array
          items:
            $ref: '#/components/schemas/Transaction'
        pending:
          type: array
          items:
            $ref: '#/components/schemas/Transaction'
        _links:
          $ref: "#/components/schemas/LinksAccountReport"
    Balance:
      type: object
      required:
        - balanceAmount
        - balanceType
        - referenceDate
      properties:
        balanceAmount:
          $ref: '#/components/schemas/Amount'
        balanceType:
          type: string
          enum:
            - authorised
            - closingBooked
            - excpected
            - interimAvailable
            - openingBooked
          example: 'closingBooked'
        referenceDate:
          type: string
          format: date
          example: '2017-10-30'
        lastCommittedTransaction:
          type: string
          maxLength: 35
          description: 'Reference of last accounted document'
    TransactionStatus:
      type: string
      enum:
       - ACCC
       - ACCP
       - ACSC
       - ACSP
       - ACTC
       - ACWC
       - ACWP
       - CANC
       - PART
       - PATC
       - PDNG
       - RCVD
       - RJCT
      example: 'ACTC'
    Transaction:
      type: object
      required:
        - transactionId
        - transactionAmount
        - bookingDate
        - valueDate
      properties:
        transactionId:
          type: string
          description: 'Can be used as access-id in the API, where more details on an transaction is offered.'
        entryReference:
          type: string
          description: 'Is the identification of the transaction as used e.g. for reference for deltafunction on application level. The same identification as for example used within camt.05x messages'
          maxLength: 35
        bookingDate:
          type: string
          format: date
          description: The Date when an entry is posted to an account on the ASPSPs books.
          example: '2024-10-30'
        valueDate:
          type: string
          format: date
          description: The Date at which assets become available to the account owner in case of a credit
          example: '2024-10-30'
        transactionAmount:
          $ref: '#/components/schemas/Amount'
        creditorName:
          type: string
          description: Identification of Creditors, e.g. a SEPA Creditor ID
          maxLength: 70
        creditorAgent:
          type: string
          description: The BIC associated to the account.
          maxLength: 15
        creditorAgentName:
          type: string
          description: Bank Name of the Merchant.
          maxLength: 140
        creditorAccount:
          $ref: '#/components/schemas/AccountReference'
        ultimateCreditor:
          type: string
          maxLength: 70
        debtorName:
          type: string
          description: Name of the debtor if a "Credited" transaction
          maxLength: 50
        debtorAccount:
          $ref: '#/components/schemas/AccountReference'
        remittanceInformationUnstructured:
          type: string
          maxLength: 140
          description: Reference to be transported in the field.
        proprietaryBankTransactionCode:
          type: string
          maxLength: 35
          description: 'proprietary bank transaction code as used within a community or within an ASPSP e.g. for MT94x based transaction reports'
          example: 'PMNT-RCVD-ESDD'
    Links:
      type: object
      properties:
        scaRedirect:
          $ref: '#/components/schemas/HrefType'
        self:
          $ref: '#/components/schemas/HrefType'
        status:
          $ref: '#/components/schemas/HrefType'
        scaStatus:
          $ref: '#/components/schemas/HrefType'
    LinksAuthorisation:
      type: object
      properties:
        scaRedirect:
          $ref: '#/components/schemas/HrefType'
        scaStatus:
          $ref: '#/components/schemas/HrefType'
    LinksAccountDetails:
      type: object
      properties:
        balances:
          $ref: '#/components/schemas/HrefType'
        transactions:
          $ref: '#/components/schemas/HrefType'
    LinksAccountReport:
      type: object
      required:
        - account
      properties:
        account:
          $ref: '#/components/schemas/HrefType'
        first:
          $ref: '#/components/schemas/HrefType'
        next:
          $ref: '#/components/schemas/HrefType'
        previous:
          $ref: '#/components/schemas/HrefType'
        last:
          $ref: '#/components/schemas/HrefType'
    Authentication:
      type: object
      required:
        - authenticationType
        - authenticationMethodId
      properties:
        authenticationType:
          type: string
          enum:
            - SMS_OTP
        authenticationMethodId:
          type: string
          maxLength: 35
          description: 'An identification provided by the ASPSP for the later identification of the authentication method selection.'
          example: "sotp"
        name:
          type: string
          description: 'This is the name of the authentication method defined by the PSU in the Online Banking frontend of the ASPSP. Alternatively this could be a description provided by the ASPSP like "SMS OTP on phone +49160 xxxxx 28". This name shall be used by the TPP when presenting a list of authentication methods to the PSU, if available.'
        explanation:
          type: string
          description: 'detailed information about the sca method for the PSU.'
    MessageCode:
      type: string
      enum:
        # ServiceUnspecificHTTPErrorCodes
        - CERTIFICATE_INVALID
        - CERTIFICATE_EXPIRED
        - CERTIFICATE_BLOCKED
        - CERTIFICATE_REVOKED
        - CERTIFICATE_MISSING
        - ROLE_INVALID
        - SIGNATURE_INVALID
        - SIGNATURE_MISSING
        - FORMAT_ERROR
        - PARAMETER_NOT_SUPPORTED
        - PSU_CREDENTIALS_INVALID
        - SERVICE_INVALID
        - SERVICE_BLOCKED
        - CONSENT_UNKNOWN
        - CONSENT_INVALID
        - CONSENT_EXPIRED
        - TOKEN_UNKNOWN
        - TOKEN_INVALID
        - TOKEN_EXPIRED
        - RESOURCE_UNKNOWN
        - RESOURCE_EXPIRED
        - TIMESTAMP_INVALID
        - PERIOD_INVALID
        - SCA_METHOD_UNKNOWN
        - STATUS_INVALID
        # PISSpecificHTTPErrorCodes
        - PRODUCT_INVALID
        - PRODUCT_UNKNOWN
        - PAYMENT_FAILED
        - REQUIRED_KID_MISSING
        - EXECUTION_DATE_INVALID
        # AISSpecificHTTPErrorCodes
        - SESSIONS_NOT_SUPPORTED
        - ACCESS_EXCEEDED
        - REQUESTED_FORMATS_INVALID
        # PIISSpecificErrorCodes
        - CARD_INVALID
        - NO_PIIS_ACTIVATION
      example: TOKEN_INVALID
    TppMessage:
      type: object
      required:
        - category
        - code
      properties:
        category:
          type: string
          enum:
            - WARNING
            - ERROR
          example: 'ERROR'
        code:
          $ref: '#/components/schemas/MessageCode'
        text:
          type: string
          maxLength: 512
          example: 'additional text information of the ASPSP up to 512 characters'
        path:
          type: string
    TppMessages:
      type: object
      required:
        - tppMessages
      properties:
        tppMessages:
          type: array
          items:
            $ref: '#/components/schemas/TppMessage'
    RecurringIndicator:
      type: boolean
      description: '"true" if the consent is for recurring access to the account data "false", if the consent is for one access to the account data'
    CreateAuthorisationResponse:
      type: object
      required:
        - authorisationId
        - scaStatus
        - _links
      properties:
        authorisationId:
          $ref: '#/components/schemas/AuthorisationId'
        scaStatus:
          $ref: '#/components/schemas/ScaStatus'
        psuMessage:
          $ref: '#/components/schemas/PsuMessage'
        _links:
          $ref: '#/components/schemas/LinksAuthorisation'
    CreateConsentRequest:
      type: object
      required:
        - access
        - recurringIndicator
        - validUntil
        - frequencyPerDay
      properties:
        access:
          $ref: '#/components/schemas/AccountAccess'
        recurringIndicator:
          $ref: '#/components/schemas/RecurringIndicator'
        validUntil:
          type: string
          format: date
          description: 'This parameter is requesting a valid until date for the requested consent. The content is the local ASPSP date in ISODate Format, e.g. 2020-06-30. The date cannot be later than 180 days from now.'
          example: '2024-11-30'
        frequencyPerDay:
          type: integer
          description: 'This field indicates the requested maximum frequency for an access per day. For a one-off access, this attribute is set to "1".'
          example: 4
    CreateConsentResponse:
      type: object
      required:
        - consentId
        - consentStatus
        - _links
      properties:
        consentId:
          $ref: '#/components/schemas/ConsentId'
        consentStatus:
          $ref: '#/components/schemas/ConsentStatus'
        chosenScaMethod:
          $ref: '#/components/schemas/Authentication'
        psuMessage:
          $ref: '#/components/schemas/PsuMessage'
        _links:
          $ref: '#/components/schemas/Links'
    TaxCustomsTransfers:
      type: object
      required:
        - instructedAmount
        - creditorAccount
        - creditorName
        - remittanceInformationUnstructured
        - declarationFundsOrigin
        - taxCustomsPaymentDetails
      properties:
        debtorAccount:
          $ref: '#/components/schemas/AccountReference'
        instructedAmount:
          $ref: '#/components/schemas/Amount'
        creditorAccount:
          $ref: '#/components/schemas/AccountReference'
        creditorName:
          type: string
          maxLength: 26
        requestedExecutionDate:
          type: string
          format: date
        debtorName:
          type: string
          maxLength: 50
        remittanceInformationUnstructured:
          type: string
          maxLength: 100
        declarationFundsOrigin:
          type: string
          maxLength: 256
        taxCustomsPaymentDetails:
          $ref: '#/components/schemas/taxCustomsPaymentDetails'

    taxCustomsPaymentDetails:
      type: object
      required:
        - taxSerialNumber
        - payerId
      properties:
        taxSerialNumber:
          type: string
          maxLength: 20
        payerId:
          type: string
          maxLength: 10
    CreditTransfers:
      type: object
      required:
        - instructedAmount
        - creditorAccount
        - creditorName
        - creditorAddress
        - remittanceInformationUnstructured
      properties:
        debtorAccount:
          $ref: '#/components/schemas/AccountReference'
        instructedAmount:
          $ref: '#/components/schemas/Amount'
        creditorAccount:
          $ref: '#/components/schemas/AccountReference'
        creditorName:
          type: string
          maxLength: 26
        remittanceInformationUnstructured:
          type: string
          maxLength: 70
        creditorAddress:
          $ref: '#/components/schemas/Address'
        requestedExecutionDate:
          type: string
          format: date
        debtorName:
          type: string
          maxLength: 50
        paymentCode:
          type: string
          maxLength: 3
        chargeBearer:
           type: string
           enum:
            - CRED
            - SHAR
        serviceLevel:
          type: string
          enum:
            - URGP
    CrossBorderTransfers:
      type: object
      required:
        - instructedAmount
        - creditorAccount
        - creditorName
        - creditorAddress
        - creditorAgentName
        - chargeBearer
        - serviceLevel
        - remittanceInformationUnstructured
      properties:
        debtorAccount:
          $ref: '#/components/schemas/AccountReference'
        instructedAmount:
          $ref: '#/components/schemas/Amount'
        creditorAccount:
          $ref: '#/components/schemas/AccountReference'
        creditorName:
          type: string
          maxLength: 140
        creditorAgent:
          type: string
          maxLength: 15
        creditorAgentName:
          type: string
          description: Bank Name of the Receiver.
          maxLength: 140
        creditorAddress:
          $ref: '#/components/schemas/Address'
        remittanceInformationUnstructured:
          type: string
          maxLength: 140
        declarationFundsOrigin:
          type: string
          maxLength: 256
        requestedExecutionDate:
          type: string
          format: date
        chargeBearer:
          $ref: '#/components/schemas/ChargeBearer'
        serviceLevel:
          $ref: '#/components/schemas/ServiceLevelCode'
  # Reusable path, query, header and cookie parameters
  parameters:
    accountId:
      name: accountId
      in: path
      description: 'This identification is denoting the addressed account. The accountId is retrieved by using a "Read Account List" call. The accountId is the "resourceId" attribute of the account structure. Its value is constant at least throughout the lifecycle of a given consent.'
      required: true
      schema:
        type: string
    authorisationId:
      name: authorisationId
      in: path
      description: Resource identification of the related SCA.
      required: true
      schema:
        type: string
      example: '1234'
    transactionId:
      name: transactionId
      in: path
      description: Transaction ID
      required: true
      schema:
        type: string
      example: '1234570'
    resourceId:
      name: resourceId
      in: path
      description: This identification is given by the attribute resourceId of the corresponding entry of a transaction list.
      required: true
      schema:
        type: string
        maxLength: 35
      example: '3dc3d5b3-7023-4848-9853-f5400a64e80f'
    consentId:
      name: consentId
      in: path
      description: ID of the corresponding consent object as returned by an Account Information Consent Request
      required: true
      schema:
        type: string
      example: '1234'
    paymentService:
      name: paymentService
      in: path
      description: Payment service
      required: true
      schema:
        type: string
        enum:
          - "payments"
    paymentProduct:
      name: paymentProduct
      in: path
      description: The addressed payment product endpoint, e.g. for SEPA Credit Transfers (SCT). The ASPSP will publish which of the payment products/endpoints will be supported.
      required: true
      schema:
        type: string
        enum:
          - domestic-credit-transfers
          - domestic-tax-customs-transfers
          - cross-border-transfers
      example: 'domestic-credit-transfers'
    paymentId:
      name: paymentId
      in: path
      description: payment Id
      required: true
      schema:
       type: string
      example: '1234'
    withBalance:
      name: withBalance
      in: query
      description: 'If contained, this function reads the list of accessible payment accounts including the booking balance, if granted by the PSU in the related consent and available by the ASPSP. This parameter might be ignored by the ASPSP.'
      required: false
      schema:
        type: boolean
    X-Request-ID:
      name: X-Request-ID
      in: header
      description: 'ID of the request, unique to the call, as determined by the initiating party.'
      required: true
      schema:
        type: string
        format: uuid
      example: '123e4567-e89b-12d3-a456-426655440000'
    Consent-ID:
      name: Consent-ID
      in: header
      description: 'Shall be contained since "Establish Consent Transaction" was performed via this API before.'
      required: true
      schema:
        type: string
      example: '1234'
    dateFrom:
      name: dateFrom
      in: query
      description: 'Starting date (inclusive the date dateFrom) of the transaction list, mandated if no delta access is required'
      example: '2024-01-01'
      required: false
      schema:
        type: string
        format: date
    dateTo:
      name: dateTo
      in: query
      description: 'End date (inclusive the data dateTo) of the transaction list, default is now if not given.'
      required: false
      example: '2024-12-31'
      schema:
        type: string
        format: date
    entryReferenceFrom:
      name: entryReferenceFrom
      in: query
      description: 'This data attribute is indicating that the AISP is in favour to get all transactions after the transaction with identification entryReferenceFrom alternatively to the above defined period. This is a implementation of a delta access. If this data element is contained, the entries "dateFrom" and "dateTo" might be ignored by the ASPSP if a delta report is supported.'
      required: false
      schema:
        type: string
    bookingStatus:
      name: bookingStatus
      in: query
      description: 'Permitted codes are "booked", "pending" and "both "booked" shall be supported by the ASPSP. To support the "pending" and "both" feature is optional for the ASPSP, Error code if not supported in the online banking frontend'
      required: true
      schema:
        type: string
        enum:
          - booked
          - pending
          - both
          - information
      example: 'booked'
    PSU-IP-Address:
      name: PSU-IP-Address
      in: header
      description: The forwarded IP Address header field consists of the corresponding HTTP request IP Address field between PSU and TPP.
      required: false
      schema:
        type: string
        format: ipv4
      example: 127.0.0.1
    PSU-IP-Address_mandatory:
      name: PSU-IP-Address
      in: header
      description: The forwarded IP Address header field consists of the corresponding HTTP request IP Address field between PSU and TPP.
      required: true
      schema:
        type: string
        format: ipv4
      example: 127.0.0.1
    PSU-Accept-Language:
      name: PSU-Accept-Language
      in: header
      description: The forwarded IP Accept header fields consist of the corresponding HTTP request Accept header fields between PSU and TPP, if available.
      required: false
      schema:
        type: string
      example: 'sq'
    PSU-User-Agent:
      name: PSU-User-Agent
      in: header
      description: The forwarded Agent header field of the HTTP request between PSU and TPP, if available.
      required: false
      schema:
        type: string
    TPP-Redirect-URI:
      name: TPP-Redirect-URI
      in: header
      description: 'URI of the TPP, where the transaction flow shall be redirected to after a Redirect.'
      required: false
      schema:
        type: string
        format: uri
  # Security scheme definition (see Authentication)
  # securitySchemes:
  # Reusable request bodies
  # requestBodies:
  # Reusable responses, such as 401 Unauthorized or 400 Bad Request
  responses:
    '400BadRequest':
      description: Validation error occurred. This code will cover malformed syntax in request or incorrect data in payload.
      headers:
        Content-Language:
          $ref: '#/components/headers/Content-Language'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TppMessages'
    '401Unauthorized':
      description: The TPP or the PSU is not correctly authorized to perform the request. Retry the request with correct authentication information.
      headers:
        Content-Language:
          $ref: '#/components/headers/Content-Language'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TppMessages'
    '403Forbidden':
      description: Returned if the resource that was referenced in the path exists but cannot be accessed by the TPP or the PSU. This code should only be used for non-sensitive id references as it will reveal that the resource exists even though it cannot be accessed.
      headers:
        Content-Language:
          $ref: '#/components/headers/Content-Language'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TppMessages'
    '404NotFound':
      description: Returned if the resource that was referenced in the path does not exist or cannot be referenced by the TPP or the PSU. When in doubt if a specific id in the path is sensitive or not, use the HTTP response code 404 instead of the HTTP response code 403.
    '405MethodNotAllowed':
      description: This code is only sent when the HTTP method (PUT, POST, DELETE, GET etc.) is not supported on a specific endpoint. It has nothing to do with the consent, payment or account information data model.
    '406NotAcceptable':
      description: The ASPSP cannot generate the content that the TPP specified in the Accept header.
    '408RequestTimeout':
      description: The server is still working correctly, but an individual request has timed out.
    '409Conflict':
      description: The request could not be completed due to a conflict with the current state of the target resource.
      headers:
        Content-Language:
          $ref: '#/components/headers/Content-Language'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TppMessages'
    '413RequestEntityTooLarge':
      description: A 413 request entity too large error occurs when a request made from a client is too large to be processed by the web server.
    '415UnsupportedMedia':
      description: The TPP has supplied a media type which the ASPSP does not support.
    '429TooManyRequests':
      description: The TPP has exceeded the number of requests allowed by the consent or by the RTS.
      headers:
        Content-Language:
          $ref: '#/components/headers/Content-Language'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TppMessages'
    '500InternalServerError':
      description: Internal server error occurred.
    '503ServiceUnavailable':
      description: The ASPSP server is currently unavailable. Generally, this is a temporary state.
    default:
      description: Unexpected Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TppMessage'
  # Reusable response headers
  headers:
    Content-Language:
      required: false
      schema:
        type: string
        example: 'en'
      description: 'Language of the response'
    Location:
      required: true
      schema:
        type: string
      description: 'Location of the created resource.'
      example: 'https://www.testbank.com/psd2/v1/payments/sepa-credit-transfers/1234'
    X-Request-ID:
      required: true
      schema:
        type: string
        format: uuid
        example: '123e4567-e89b-12d3-a456-426655440000'
      description: 'ID of the request, unique to the call, as determined by the initiating party.'
    ASPSP-SCA-Approach:
      required: false
      schema:
        type: string
        enum:
          - REDIRECT
        example: 'REDIRECT'
      description: 'Possible values are: EMBEDDED / DECOUPLED / REDIRECT. OAuth will be subsumed by the value REDIRECT'
  # Reusable examples
  #examples:
  # Reusable links
  #links:
  # Reusable callbacks
  #callbacks:
paths:
  '/accounts':
    get:
      tags:
        - accounts
      summary: list of accounts
      description: 'Reads a list of bank accounts, with balances where required. It is assumed that a consent of the PSU to this access is already given and stored on the ASPSP system. The addressed list of accounts depends then on the PSU ID and the stored consent addressed by consentId, respectively the OAuth2 access token.'
      operationId: getAccounts
      parameters:
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/Consent-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"
        - $ref: "#/components/parameters/withBalance"
      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
            Content-Language:
              $ref: '#/components/headers/Content-Language'
          content:
            application/json:
              schema:
                type: object
                required:
                  - accounts
                properties:
                  accounts:
                    type: array
                    items:
                      $ref: '#/components/schemas/AccountDetails'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '406':
          $ref: '#/components/responses/406NotAcceptable'
        '408':
          $ref: '#/components/responses/408RequestTimeout'
        '429':
          $ref: '#/components/responses/429TooManyRequests'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/accounts/{accountId}':
    get:
      tags:
        - accounts
      summary: account details
      description: 'Reads a list of bank accounts, with balances where required. It is assumed that a consent of the PSU to this access is already given and stored on the ASPSP system. The addressed list of accounts depends then on the PSU ID and the stored consent addressed by consentId, respectively the OAuth2 access token.'
      operationId: getAccountbyId
      parameters:
        - $ref: "#/components/parameters/accountId"
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/Consent-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"
        - $ref: "#/components/parameters/withBalance"
      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
          content:
            application/json:
              schema:
                type: object
                required:
                  - account
                properties:
                  account:
                    $ref: '#/components/schemas/AccountDetails'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '406':
          $ref: '#/components/responses/406NotAcceptable'
        '408':
          $ref: '#/components/responses/408RequestTimeout'
        '429':
          $ref: '#/components/responses/429TooManyRequests'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/accounts/{accountId}/balances':
    get:
      tags:
        - accounts
      summary: balances for account
      description: Reads the balance list for a given account.
      operationId: getBalanceForAccountByAccountId
      parameters:
        - $ref: "#/components/parameters/accountId"
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/Consent-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"
      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
          content:
            application/json:
              schema:
                type: object
                required:
                  - balances
                properties:
                  account:
                    $ref: '#/components/schemas/AccountReference'
                  balances:
                    type: array
                    items:
                      $ref: '#/components/schemas/Balance'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '406':
          $ref: '#/components/responses/406NotAcceptable'
        '408':
          $ref: '#/components/responses/408RequestTimeout'
        '429':
          $ref: '#/components/responses/429TooManyRequests'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/accounts/{accountId}/transactions':
    get:
      tags:
        - accounts
      summary: transactions for account
      description: Read a transaction list For a given account, additional parameters are e.g. the attributes "date_from" and "date_to". If the attribute "withbalance" is used, the ASPSP will add balances to the transaction list. The latter might be provided by the ASPSP anyhow, if transaction lists without balances are not supported.
      operationId: getTransactionsForAccountByAccountId
      parameters:
        - $ref: "#/components/parameters/accountId"
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/Consent-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"
        - $ref: "#/components/parameters/bookingStatus"
        - $ref: "#/components/parameters/withBalance"
        - $ref: "#/components/parameters/dateFrom"
        - $ref: "#/components/parameters/dateTo"
        - $ref: "#/components/parameters/entryReferenceFrom"
      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
          content:
            application/json:
              schema:
                type: object
                properties:
                  account:
                    $ref: '#/components/schemas/AccountReference'
                  transactions:
                    $ref: '#/components/schemas/AccountReport'
                  balances:
                    type: array
                    items:
                      $ref: '#/components/schemas/Balance'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '406':
          $ref: '#/components/responses/406NotAcceptable'
        '408':
          $ref: '#/components/responses/408RequestTimeout'
        '429':
          $ref: '#/components/responses/429TooManyRequests'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/accounts/{accountId}/transactions/{transactionId}':
    get:
      tags:
        - accounts
      summary: transaction details for transaction of an account
      description: Reads transaction details of an addressed transaction.
      operationId: getTransactionByTransactionIdForAccountByAccountId
      parameters:
        - $ref: '#/components/parameters/accountId'
        - $ref: '#/components/parameters/transactionId'
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/Consent-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"

      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
          content:
            application/json:
              schema:
                type: object
                required:
                  - transactionsDetails
                properties:
                  transactionsDetails:
                    $ref: '#/components/schemas/Transaction'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '406':
          $ref: '#/components/responses/406NotAcceptable'
        '408':
          $ref: '#/components/responses/408RequestTimeout'
        '429':
          $ref: '#/components/responses/429TooManyRequests'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/consents':
    post:
      tags:
        - consents
      summary: create a consent
      description: 'Creates a consent resource, defining access rights to dedicated accounts of a given PSU-ID. These accounts must be addressed explicitly in the method as parameters.'
      operationId: createConsent
      parameters:
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address_mandatory"
        - $ref: "#/components/parameters/PSU-Accept-Language"
        - $ref: "#/components/parameters/PSU-User-Agent"
        - $ref: "#/components/parameters/TPP-Redirect-URI"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateConsentRequest'
      responses:
        '201':
          description: Consent Request was correctly performed.
          headers:
            Location:
              $ref: '#/components/headers/Location'
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
            ASPSP-SCA-Approach:
              $ref: '#/components/headers/ASPSP-SCA-Approach'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateConsentResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '415':
          $ref: '#/components/responses/415UnsupportedMedia'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/consents/{consentId}':
    get:
      tags:
        - consents
      summary: get consent details
      operationId: getConsent
      description: 'Reads the exact definition of the given consent resource {consentId}'
      parameters:
        - $ref: '#/components/parameters/consentId'
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"
      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
          content:
            application/json:
              schema:
                type: object
                required:
                  - access
                  - recurringIndicator
                  - validUntil
                  - frequencyPerDay
                  - lastActionDate
                  - consentStatus
                properties:
                  access:
                    $ref: "#/components/schemas/AccountAccess"
                  recurringIndicator:
                    $ref: "#/components/schemas/RecurringIndicator"
                  validUntil:
                    type: string
                    format: date
                  frequencyPerDay:
                    type: integer
                  lastActionDate:
                    type: string
                    format: date
                  consentStatus:
                    $ref: "#/components/schemas/ConsentStatus"
                  _links:
                    type: object
                    properties:
                      account:
                        $ref: '#/components/schemas/HrefType'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    delete:
      tags:
        - consents
      summary: delete consent
      description: Deletes a created consent with ID.
      operationId: deleteConsent
      parameters:
        - $ref: "#/components/parameters/consentId"
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"
      responses:
        '204':
          description: Consent resource was successfully deleted.
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/consents/{consentId}/status':
    get:
      tags:
        - consents
      summary: get status of a consent
      operationId: getStatusForConsentById
      description: Reads the consent status of the addressed consent resource.
      parameters:
        - $ref: '#/components/parameters/consentId'
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"
      responses:
        '200':
          description: 'Consent status'
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
          content:
            application/json:
              schema:
                type: object
                required:
                  - consentStatus
                properties:
                  consentStatus:
                    $ref: '#/components/schemas/ConsentStatus'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/consents/{consentId}/authorisations':
    post:
      tags:
        - consents
      summary: Start the authorisation process for a consent
      operationId: startConsentAuthorisation
      description: |
        Create an authorisation sub-resource and start the authorisation process of a consent.
        The message might in addition transmit authentication and authorisation related data.
      parameters:
        - $ref: "#/components/parameters/consentId"
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address_mandatory"
        - $ref: "#/components/parameters/PSU-Accept-Language"
        - $ref: "#/components/parameters/PSU-User-Agent"
        - $ref: "#/components/parameters/TPP-Redirect-URI"
      responses:
        '201':
          description: Consent Request was correctly performed.
          headers:
            Location:
              $ref: '#/components/headers/Location'
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
            ASPSP-SCA-Approach:
              $ref: '#/components/headers/ASPSP-SCA-Approach'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateAuthorisationResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '415':
          $ref: '#/components/responses/415UnsupportedMedia'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    get:
      tags:
        - consents
      summary: Get consent authorisation sub-resources request
      operationId: getConsentAuthorisation
      description: |
        Return a list of all authorisation subresources IDs which have been created.

        This function returns an array of hyperlinks to all generated authorisation sub-resources.
      parameters:
        - $ref: "#/components/parameters/consentId"
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"
        - $ref: "#/components/parameters/PSU-Accept-Language"
        - $ref: "#/components/parameters/PSU-User-Agent"
      responses:
        '200':
          description: Consent Request was correctly performed.
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
          content:
            application/json:
              schema:
                type: object
                required:
                  - authorisationIds
                properties:
                  authorisationIds:
                    type: array
                    items:
                      $ref: '#/components/schemas/AuthorisationId'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '415':
          $ref: '#/components/responses/415UnsupportedMedia'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/consents/{consentId}/authorisations/{authorisationId}':
    get:
      tags:
        - consents
      summary: Read the SCA status of the consent authorisation
      operationId: getConsentScaStatus
      description: |
        This method returns the SCA status of a consent initiation's authorisation sub-resource.
      parameters:
        - $ref: "#/components/parameters/consentId"
        - $ref: "#/components/parameters/authorisationId"
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"
        - $ref: "#/components/parameters/PSU-Accept-Language"
        - $ref: "#/components/parameters/PSU-User-Agent"
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - scaStatus
                properties:
                  psuName:
                    $ref: '#/components/schemas/PsuMessage'
                  scaStatus:
                    $ref: '#/components/schemas/ScaStatus'
                  _links:
                    $ref: '#/components/schemas/LinksAuthorisation'
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '415':
          $ref: '#/components/responses/415UnsupportedMedia'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/payments/domestic-credit-transfers':
    post:
      tags:
        - payments
      summary: creates a Albania domestic transfers payment
      description: 'Creates a payment initiation resource addressable under {paymentId} with all data relevant for the corresponding payment product. This is the first step in the API to initiate the related payment.'
      operationId: createPaymentDomestic
      parameters:
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address_mandatory"
        - $ref: "#/components/parameters/PSU-Accept-Language"
        - $ref: "#/components/parameters/PSU-User-Agent"
        - $ref: "#/components/parameters/TPP-Redirect-URI"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreditTransfers'
            example:
              instructedAmount:
                amount: "2"
                currency: "ALL"
              creditorName: "Receiver Merchant"
              chargeBearer: "SHAR"
              serviceLevel: "URGP"
              creditorAccount:
                iban: "AL42202110510000000001422725"
              creditorAddress:
                street: "Main Street 25"
              debtorName: "Name ordering customer"
              remittanceInformationUnstructured: "transfer"
      responses:
        '201':
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - transactionStatus
                  - paymentId
                  - _links
                properties:
                  transactionStatus:
                    $ref: '#/components/schemas/TransactionStatus'
                  paymentId:
                    $ref: '#/components/schemas/PaymentId'
                  transactionFees:
                    $ref: '#/components/schemas/Amount'
                  transactionFeeIndicator:
                    $ref: '#/components/schemas/TransactionFeeIndicator'
                  chosenScaMethod:
                    $ref: '#/components/schemas/Authentication'
                  psuMessage:
                    $ref: '#/components/schemas/PsuMessage'
                  _links:
                    $ref: '#/components/schemas/Links'
          headers:
            Location:
              $ref: '#/components/headers/Location'
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
            ASPSP-SCA-Approach:
              $ref: '#/components/headers/ASPSP-SCA-Approach'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/payments/domestic-tax-customs-transfers':
    post:
      tags:
        - payments
      summary: create a tax and customs payments
      description: 'Creates a payment initiation resource addressable under {paymentId} with all data relevant for the corresponding payment product. This is the first step in the API to initiate the related payment.'
      operationId: TaxCustomsDomesticPayments
      parameters:
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address_mandatory"
        - $ref: "#/components/parameters/PSU-Accept-Language"
        - $ref: "#/components/parameters/PSU-User-Agent"
        - $ref: "#/components/parameters/TPP-Redirect-URI"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TaxCustomsTransfers'
            example:
              instructedAmount:
                amount: "2"
                currency: "ALL"
              creditorName: "BE-SONATO"
              creditorAccount:
                iban: "AL1321511000ALL3000000180600"
              debtorName: "Name ordering customer"
              remittanceInformationUnstructured: "Tax payment ZDDFL info"
              declarationFundsOrigin: "Declaration of origin of funds"
              taxCustomsPaymentDetails:
                taxSerialNumber: "1210115202785B3"
                payerId: "1234567890"

      responses:
        '201':
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - paymentId
                  - transactionStatus
                  - _links
                properties:
                  paymentId:
                    $ref: '#/components/schemas/PaymentId'
                  transactionStatus:
                    $ref: '#/components/schemas/TransactionStatus'
                  transactionFees:
                    $ref: '#/components/schemas/Amount'
                  transactionFeeIndicator:
                    $ref: '#/components/schemas/TransactionFeeIndicator'
                  chosenScaMethod:
                    $ref: '#/components/schemas/Authentication'
                  psuMessage:
                    $ref: '#/components/schemas/PsuMessage'
                  _links:
                    $ref: '#/components/schemas/Links'
          headers:
            Location:
              $ref: '#/components/headers/Location'
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
            ASPSP-SCA-Approach:
              $ref: '#/components/headers/ASPSP-SCA-Approach'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '415':
          $ref: '#/components/responses/415UnsupportedMedia'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/payments/cross-border-transfers':
    post:
      tags:
        - payments
      summary: creates a payment
      description: 'Creates a payment initiation resource addressable under {paymentId} with all data relevant for the corresponding payment product. This is the first step in the API to initiate the related payment.'
      operationId: createPaymentIntl
      parameters:
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address_mandatory"
        - $ref: "#/components/parameters/PSU-Accept-Language"
        - $ref: "#/components/parameters/PSU-User-Agent"
        - $ref: "#/components/parameters/TPP-Redirect-URI"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CrossBorderTransfers'
            example:
              instructedAmount:
                amount: "1.50"
                currency: "EUR"
              chargeBearer: "SHAR"
              serviceLevel: "SPOT"
              creditorName: "Receiver Merchant"
              creditorAccount:
                iban: "BG28FINV91501017499940"
              creditorAgent: "FINVBGSF"
              creditorAgentName: "First Investment Bank"
              creditorAddress:
                country: "BG"
#                city: "Istanbul"
                street: "Creditor Address"
              remittanceInformationUnstructured: "Information for Merchant and payment"
              declarationFundsOrigin: "Declaration of origin of funds"
      responses:
        '201':
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - paymentId
                  - transactionStatus
                  - _links
                properties:
                  paymentId:
                    $ref: '#/components/schemas/PaymentId'
                  transactionStatus:
                    $ref: '#/components/schemas/TransactionStatus'
                  transactionFees:
                    $ref: '#/components/schemas/Amount'
                  transactionFeeIndicator:
                    $ref: '#/components/schemas/TransactionFeeIndicator'
                  chosenScaMethod:
                    $ref: '#/components/schemas/Authentication'
                  psuMessage:
                    $ref: '#/components/schemas/PsuMessage'
                  _links:
                    $ref: '#/components/schemas/Links'
          headers:
            Location:
              $ref: '#/components/headers/Location'
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
            ASPSP-SCA-Approach:
              $ref: '#/components/headers/ASPSP-SCA-Approach'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '415':
          $ref: '#/components/responses/415UnsupportedMedia'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/{paymentService}/{paymentProduct}/{paymentId}':
    get:
      tags:
        - payments
      summary: get payment details
      operationId: getPayment
      description: Reads the details of an initiated payment.
      parameters:
        - $ref: '#/components/parameters/paymentService'
        - $ref: '#/components/parameters/paymentProduct'
        - $ref: '#/components/parameters/paymentId'
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '415':
          $ref: '#/components/responses/415UnsupportedMedia'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/{paymentService}/{paymentProduct}/{paymentId}/status':
    get:
      tags:
        - payments
      summary: get the status of a payment
      operationId: getPaymentStatus
      description: Reads the transaction status of the payment
      parameters:
        - $ref: '#/components/parameters/paymentService'
        - $ref: '#/components/parameters/paymentProduct'
        - $ref: '#/components/parameters/paymentId'
        - $ref: "#/components/parameters/X-Request-ID"
      responses:
        '200':
          description: OK
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
          content:
            application/json:
              schema:
                type: object
                required:
                  - transactionStatus
                properties:
                  transactionStatus:
                    $ref: '#/components/schemas/TransactionStatus'
                  ownerNames:
                    description: 'List of owner names. Should only be delivered after successful SCA.'
                    type: array
                    items:
                      $ref: "#/components/schemas/AccountOwner"
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/{paymentService}/{paymentProduct}/{paymentId}/authorisations':
    post:
      tags:
        - payments
      summary: Start the authorisation process for a payment
      operationId: startPaymentAuthorisation
      description: |
        Create an authorisation sub-resource and start the authorisation process of a payment.
        The message might in addition transmit authentication and authorisation related data.
      parameters:
        - $ref: '#/components/parameters/paymentService'
        - $ref: '#/components/parameters/paymentProduct'
        - $ref: '#/components/parameters/paymentId'
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address_mandatory"
        - $ref: "#/components/parameters/PSU-Accept-Language"
        - $ref: "#/components/parameters/PSU-User-Agent"
        - $ref: "#/components/parameters/TPP-Redirect-URI"
      responses:
        '201':
          description: Consent Request was correctly performed.
          headers:
            Location:
              $ref: '#/components/headers/Location'
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
            ASPSP-SCA-Approach:
              $ref: '#/components/headers/ASPSP-SCA-Approach'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateAuthorisationResponse'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '415':
          $ref: '#/components/responses/415UnsupportedMedia'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    get:
      tags:
        - payments
      summary: Get payment initiation authorisation sub-resources request
      operationId: getPaymentInitiationAuthorisation
      description: |
        Read a list of all authorisation subresources IDs which have been created.

        This function returns an array of hyperlinks to all generated authorisation sub-resources.
      parameters:
        - $ref: '#/components/parameters/paymentService'
        - $ref: '#/components/parameters/paymentProduct'
        - $ref: '#/components/parameters/paymentId'
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"
        - $ref: "#/components/parameters/PSU-Accept-Language"
        - $ref: "#/components/parameters/PSU-User-Agent"
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - authorisationIds
                properties:
                  authorisationIds:
                    type: array
                    items:
                      $ref: '#/components/schemas/AuthorisationId'
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '415':
          $ref: '#/components/responses/415UnsupportedMedia'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  '/{paymentService}/{paymentProduct}/{paymentId}/authorisations/{authorisationId}':
    get:
      tags:
        - payments
      summary: Read the SCA status of the payment authorisation
      operationId: getPaymentScaStatus
      description: |
        This method returns the SCA status of a payment initiation's authorisation sub-resource.
      parameters:
        - $ref: '#/components/parameters/paymentService'
        - $ref: '#/components/parameters/paymentProduct'
        - $ref: '#/components/parameters/paymentId'
        - $ref: "#/components/parameters/authorisationId"
        - $ref: "#/components/parameters/X-Request-ID"
        - $ref: "#/components/parameters/PSU-IP-Address"
        - $ref: "#/components/parameters/PSU-Accept-Language"
        - $ref: "#/components/parameters/PSU-User-Agent"
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                  - scaStatus
                properties:
                  psuName:
                    $ref: '#/components/schemas/PsuMessage'
                  scaStatus:
                    $ref: '#/components/schemas/ScaStatus'
                  _links:
                    $ref: '#/components/schemas/LinksAuthorisation'
          headers:
            X-Request-ID:
              $ref: '#/components/headers/X-Request-ID'
        '400':
          $ref: '#/components/responses/400BadRequest'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '405':
          $ref: '#/components/responses/405MethodNotAllowed'
        '415':
          $ref: '#/components/responses/415UnsupportedMedia'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
