{"swagger":"2.0","info":{"title":"Open Bank Project API","description":"An Open Source API for Banks. (c) TESOBE GmbH. 2011 - 2024. Licensed under the AGPL and commercial licences.","contact":{"name":"TESOBE GmbH. / Open Bank Project","url":"https://openbankproject.com","email":"contact@tesobe.com"},"version":"v4.0.0"},"host":"obp-api-sandbox.nmbbank.co.tz","basePath":"/","schemes":["http","https"],"securityDefinitions":{"directLogin":{"type":"apiKey","description":"https://github.com/OpenBankProject/OBP-API/wiki/Direct-Login","in":"header","name":"Authorization"},"gatewayLogin":{"type":"apiKey","description":"https://github.com/OpenBankProject/OBP-API/wiki/Gateway-Login","in":"header","name":"Authorization"}},"security":[{"directLogin":[],"gatewayLogin":[]}],"paths":{"/obp/v4.0.0/banks/{BANK_ID}/accounts-held":{"get":{"tags":["Account","Account Information Service (AIS)","View-Custom","PSD2"],"summary":"Get Accounts Held","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"
Get Accounts held by the current User if even the User has not been assigned the owner View yet.
Can be used to onboard the account to the API - since all other account and transaction endpoints require views to be assigned.
optional request parameters:
whole url example:
/banks/BANK_ID/accounts-held?account_type_filter=330,CURRENT+PLUS&account_type_filter_operation=INCLUDE
Authentication is Mandatory
","operationId":"getAccountsHeld","parameters":[{"in":"path","name":"BANK_ID","description":"The bank id","required":true,"type":"string"}],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/CoreAccountsHeldJsonV300"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/banks/{BANK_ID}/accounts/{ACCOUNT_ID}/account-access":{"put":{"tags":["Account-Access","View-Custom","Account","User","OwnerViewRequired"],"summary":"Revoke/Grant User access to View","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Revoke/Grant the logged in User access to the views identified by json.
Authentication is Mandatory and the user needs to be an account holder or has owner view access.
","operationId":"revokeGrantUserAccessToViews","parameters":[{"in":"body","name":"body","description":"PostRevokeGrantAccountAccessJsonV400 object that needs to be added.","required":true,"schema":{"$ref":"#/definitions/PostRevokeGrantAccountAccessJsonV400"}},{"in":"path","name":"ACCOUNT_ID","description":"The account id","required":true,"type":"string"},{"in":"path","name":"BANK_ID","description":"The bank id","required":true,"type":"string"}],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/RevokedJsonV400"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/banks/{BANK_ID}/accounts/{ACCOUNT_ID}/account-access/grant":{"post":{"tags":["Account-Access","View-Custom","Account","User","OwnerViewRequired"],"summary":"Grant User access to View","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Grants the User identified by USER_ID access to the view identified by VIEW_ID.
Authentication is Mandatory and the user needs to be account holder.
","operationId":"grantUserAccessToView","parameters":[{"in":"body","name":"body","description":"PostAccountAccessJsonV400 object that needs to be added.","required":true,"schema":{"$ref":"#/definitions/PostAccountAccessJsonV400"}},{"in":"path","name":"ACCOUNT_ID","description":"The account id","required":true,"type":"string"},{"in":"path","name":"BANK_ID","description":"The bank id","required":true,"type":"string"}],"responses":{"201":{"description":"Success","schema":{"$ref":"#/definitions/ViewJsonV300"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/banks/{BANK_ID}/accounts/{ACCOUNT_ID}/account-access/revoke":{"post":{"tags":["Account-Access","View-Custom","Account","User","OwnerViewRequired"],"summary":"Revoke User access to View","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Revoke the User identified by USER_ID access to the view identified by VIEW_ID.
Authentication is Mandatory and the user needs to be account holder.
","operationId":"revokeUserAccessToView","parameters":[{"in":"body","name":"body","description":"PostAccountAccessJsonV400 object that needs to be added.","required":true,"schema":{"$ref":"#/definitions/PostAccountAccessJsonV400"}},{"in":"path","name":"ACCOUNT_ID","description":"The account id","required":true,"type":"string"},{"in":"path","name":"BANK_ID","description":"The bank id","required":true,"type":"string"}],"responses":{"201":{"description":"Success","schema":{"$ref":"#/definitions/RevokedJsonV400"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/banks/{BANK_ID}/accounts/{ACCOUNT_ID}/permissions":{"get":{"tags":["View-Custom","Account","User","Entitlement"],"summary":"Get access","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Returns the list of the permissions at BANK_ID for account ACCOUNT_ID, with each time a pair composed of the user and the views that he has access to.
Authentication is Mandatory
and the user needs to have access to the owner view.
Returns the list of the views at BANK_ID for account ACCOUNT_ID that a user identified by PROVIDER_ID at their provider PROVIDER has access to.
All url parameters must be %-encoded, which is often especially relevant for USER_ID and PROVIDER.
Authentication is Mandatory
The user needs to have access to the owner view.
","operationId":"getPermissionForUserForBankAccount","parameters":[{"in":"path","name":"PROVIDER","description":"the user PROVIDER","required":true,"type":"string"},{"in":"path","name":"PROVIDER_ID","description":"The provider id","required":true,"type":"string"},{"in":"path","name":"ACCOUNT_ID","description":"The account id","required":true,"type":"string"},{"in":"path","name":"BANK_ID","description":"The bank id","required":true,"type":"string"}],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/ViewsJsonV300"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/banks/{BANK_ID}/accounts/{ACCOUNT_ID}/user-account-access":{"post":{"tags":["Account-Access","View-Custom","Account","User","OwnerViewRequired","DAuth"],"summary":"Create (DAuth) User with Account Access","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"This endpoint is used as part of the DAuth solution to grant access to account and transaction data to a smart contract on the blockchain.
Put the smart contract address in username
For provider use "dauth"
This endpoint will create the (DAuth) User with username and provider if the User does not already exist.
Authentication is Mandatory and the logged in user needs to be account holder.
For information about DAuth see below:
DAuth is an experimental authentication mechanism that aims to pin an ethereum or other blockchain Smart Contract to an OBP "User".
In the future, it might be possible to be more specific and pin specific actors (wallets) that are acting within the smart contract, but so far, one smart contract acts on behalf of one User.
Thus, if a smart contract "X" calls the OBP API using the DAuth header, OBP will get or create a user called X and the call will proceed in the context of that User "X".
DAuth is invoked by the REST client (caller) including a specific header (see step 3 below) in any OBP REST call.
When OBP receives the DAuth token, it creates or gets a User with a username based on the smart_contract_address and the provider based on the network_name. The combination of username and provider is unique in OBP.
If you are calling OBP-API via an API3 Airnode, the Airnode will take care of constructing the required header.
When OBP detects a DAuth header / token it first checks if the Consumer is allowed to make such a call. OBP will validate the Consumer ip address and signature etc.
Note: The DAuth flow does not require an explicit POST like Direct Login to create the token.
Permissions may be assigned to an OBP User at any time, via the UserAuthContext, Views, Entitlements to Roles or Consents.
Note: DAuth is NOT enabled on this instance!
Note: The DAuth client is responsible for creating a token which will be trusted by OBP absolutely!
To use DAuth:
Set up properties in your props file
# -- DAuth --------------------------------------# Define secret used to validate JWT token# jwt.public_key_rsa=path-to-the-pem-file# Enable/Disable DAuth communication at all# In case isn't defined default value is false# allow_dauth=false# Define comma separated list of allowed IP addresses# dauth.host=127.0.0.1# -------------------------------------- DAuth--
Please keep in mind that property jwt.public_key_rsa is used to validate JWT token to check it is not changed or corrupted during transport.
The following videos are available:
* DAuth in local environment
HEADER:ALGORITHM & TOKEN TYPE
{ "alg": "RS256", "typ": "JWT"}
PAYLOAD:DATA
{ "smart_contract_address": "0xe123425E7734CE288F8367e1Bb143E90bb3F051224", "network_name": "AIRNODE.TESTNET.ETHEREUM", "msg_sender": "0xe12340927f1725E7734CE288F8367e1Bb143E90fhku767", "consumer_key": "0x1234a4ec31e89cea54d1f125db7536e874ab4a96b4d4f6438668b6bb10a6adb", "timestamp": "2021-11-04T14:13:40Z", "request_id": "0Xe876987694328763492876348928736497869273649"}
VERIFY SIGNATURE
RSASHA256( base64UrlEncode(header) + "." + base64UrlEncode(payload),) your-RSA-key-pair
Here is an example token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzbWFydF9jb250cmFjdF9hZGRyZXNzIjoiMHhlMTIzNDI1RTc3MzRDRTI4OEY4MzY3ZTFCYjE0M0U5MGJiM0YwNTEyMjQiLCJuZXR3b3JrX25hbWUiOiJFVEhFUkVVTSIsIm1zZ19zZW5kZXIiOiIweGUxMjM0MDkyN2YxNzI1RTc3MzRDRTI4OEY4MzY3ZTFCYjE0M0U5MGZoa3U3NjciLCJjb25zdW1lcl9rZXkiOiIweDEyMzRhNGVjMzFlODljZWE1NGQxZjEyNWRiNzUzNmU4NzRhYjRhOTZiNGQ0ZjY0Mzg2NjhiNmJiMTBhNmFkYiIsInRpbWVzdGFtcCI6IjIwMjEtMTEtMDRUMTQ6MTM6NDBaIiwicmVxdWVzdF9pZCI6IjBYZTg3Njk4NzY5NDMyODc2MzQ5Mjg3NjM0ODkyODczNjQ5Nzg2OTI3MzY0OSJ9.XSiQxjEVyCouf7zT8MubEKsbOBZuReGVhnt9uck6z6k
Using your favorite http client:
GET https://obp-api-sandbox.nmbbank.co.tz/obp/v3.0.0/users/current
Body
Leave Empty!
Headers:
DAuth: your-jwt-from-step-above
Here is it all together:
GET https://obp-api-sandbox.nmbbank.co.tz/obp/v3.0.0/users/current HTTP/1.1
Host: localhost:8080
User-Agent: curl/7.47.0
Accept: /
DAuth: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzbWFydF9jb250cmFjdF9hZGRyZXNzIjoiMHhlMTIzNDI1RTc3MzRDRTI4OEY4MzY3ZTFCYjE0M0U5MGJiM0YwNTEyMjQiLCJuZXR3b3JrX25hbWUiOiJFVEhFUkVVTSIsIm1zZ19zZW5kZXIiOiIweGUxMjM0MDkyN2YxNzI1RTc3MzRDRTI4OEY4MzY3ZTFCYjE0M0U5MGZoa3U3NjciLCJjb25zdW1lcl9rZXkiOiIweDEyMzRhNGVjMzFlODljZWE1NGQxZjEyNWRiNzUzNmU4NzRhYjRhOTZiNGQ0ZjY0Mzg2NjhiNmJiMTBhNmFkYiIsInRpbWVzdGFtcCI6IjIwMjEtMTEtMDRUMTQ6MTM6NDBaIiwicmVxdWVzdF9pZCI6IjBYZTg3Njk4NzY5NDMyODc2MzQ5Mjg3NjM0ODkyODczNjQ5Nzg2OTI3MzY0OSJ9.XSiQxjEVyCouf7zT8MubEKsbOBZuReGVhnt9uck6z6k
CURL example
curl -v -H 'DAuth: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzbWFydF9jb250cmFjdF9hZGRyZXNzIjoiMHhlMTIzNDI1RTc3MzRDRTI4OEY4MzY3ZTFCYjE0M0U5MGJiM0YwNTEyMjQiLCJuZXR3b3JrX25hbWUiOiJFVEhFUkVVTSIsIm1zZ19zZW5kZXIiOiIweGUxMjM0MDkyN2YxNzI1RTc3MzRDRTI4OEY4MzY3ZTFCYjE0M0U5MGZoa3U3NjciLCJjb25zdW1lcl9rZXkiOiIweDEyMzRhNGVjMzFlODljZWE1NGQxZjEyNWRiNzUzNmU4NzRhYjRhOTZiNGQ0ZjY0Mzg2NjhiNmJiMTBhNmFkYiIsInRpbWVzdGFtcCI6IjIwMjEtMTEtMDRUMTQ6MTM6NDBaIiwicmVxdWVzdF9pZCI6IjBYZTg3Njk4NzY5NDMyODc2MzQ5Mjg3NjM0ODkyODczNjQ5Nzg2OTI3MzY0OSJ9.XSiQxjEVyCouf7zT8MubEKsbOBZuReGVhnt9uck6z6k' https://obp-api-sandbox.nmbbank.co.tz/obp/v3.0.0/users/current
You should receive a response like:
{ "user_id": "4c4d3175-1e5c-4cfd-9b08-dcdc209d8221", "email": "", "provider_id": "0xe123425E7734CE288F8367e1Bb143E90bb3F051224", "provider": "ETHEREUM", "username": "0xe123425E7734CE288F8367e1Bb143E90bb3F051224", "entitlements": { "list": [] }}
The file, dauth.scala handles the DAuth,
We:
-> Check if Props allow_dauth is true -> Check if DAuth header exists -> Check if getRemoteIpAddress is OK -> Look for "token" -> parse the JWT token and getOrCreate the user -> get the data of the user
Parameter names and values are case sensitive.
Each parameter MUST NOT appear more than once per request.
Views in Open Bank Project provide a mechanism for fine grained access control and delegation to Accounts and Transactions. Account holders use the 'owner' view by default. Delegated access is made through other views for example 'accountants', 'share-holders' or 'tagging-application'. Views can be created via the API and each view has a list of entitlements.
Views on accounts and transactions filter the underlying data to redact certain fields for certain users. For instance the balance on an account may be hidden from the public. The way to know what is possible on a view is determined in the following JSON.
Data: When a view moderates a set of data, some fields my contain the value null
rather than the original value. This indicates either that the user is not allowed to see the original data or the field is empty.
There is currently one exception to this rule; the 'holder' field in the JSON contains always a value which is either an alias or the real name - indicated by the 'is_alias' field.
Action: When a user performs an action like trying to post a comment (with POST API call), if he is not allowed, the body response will contain an error message.
Metadata:
Transaction metadata (like images, tags, comments, etc.) will appears ONLY on the view where they have been created e.g. comments posted to the public view only appear on the public view.
The other account metadata fields (like image_URL, more_info, etc.) are unique through all the views. Example, if a user edits the 'more_info' field in the 'team' view, then the view 'authorities' will show the new value (if it is allowed to do it).
Optional
Returns the list of the views created for account ACCOUNT_ID at BANK_ID.
Authentication is Mandatory and the user needs to have access to the owner view.
","operationId":"getViewsForBankAccount","parameters":[{"in":"path","name":"ACCOUNT_ID","description":"The account id","required":true,"type":"string"},{"in":"path","name":"BANK_ID","description":"The bank id","required":true,"type":"string"}],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/ViewsJsonV300"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}},"post":{"tags":["View-Custom","Account"],"summary":"Create Custom View","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Create a custom view on bank account
Authentication is Mandatory and the user needs to have access to the owner view.
The 'alias' field in the JSON can take one of three values:
''(empty string): to use no alias; the view shows the real name of the other account.
The 'hide_metadata_if_alias_used' field in the JSON can take boolean values. If it is set to true
and there is an alias on the other account then the other accounts' metadata (like more_info, url, image_url, open_corporates_url, etc.) will be hidden. Otherwise the metadata will be shown.
The 'allowed_actions' field is a list containing the name of the actions allowed on this view, all the actions contained will be set to true
on the view creation, the rest will be set to false
.
You MUST use a leading _ (underscore) in the view name because other view names are reserved for OBP system views.
","operationId":"createViewForBankAccount","parameters":[{"in":"body","name":"body","description":"CreateViewJsonV300 object that needs to be added.","required":true,"schema":{"$ref":"#/definitions/CreateViewJsonV300"}},{"in":"path","name":"ACCOUNT_ID","description":"The account id","required":true,"type":"string"},{"in":"path","name":"BANK_ID","description":"The bank id","required":true,"type":"string"}],"responses":{"201":{"description":"Success","schema":{"$ref":"#/definitions/ViewJsonV300"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/banks/{BANK_ID}/accounts/{ACCOUNT_ID}/views/{VIEW_ID}":{"delete":{"tags":["View-Custom","Account"],"summary":"Delete Custom View","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Deletes the custom view specified by VIEW_ID on the bank account specified by ACCOUNT_ID at bank BANK_ID
Authentication is Mandatory
","operationId":"deleteViewForBankAccount","parameters":[{"in":"body","name":"body","description":"EmptyClassJson object that needs to be added.","required":true,"schema":{"$ref":"#/definitions/EmptyClassJson"}},{"in":"path","name":"VIEW_ID","description":"The view id","required":true,"type":"string"},{"in":"path","name":"ACCOUNT_ID","description":"The account id","required":true,"type":"string"},{"in":"path","name":"BANK_ID","description":"The bank id","required":true,"type":"string"}],"responses":{"204":{"description":"Success","schema":{"$ref":"#/definitions/EmptyClassJson"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}},"put":{"tags":["View-Custom","Account"],"summary":"Update Custom View","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Update an existing custom view on a bank account
Authentication is Mandatory and the user needs to have access to the owner view.
The json sent is the same as during view creation (above), with one difference: the 'name' field
of a view is not editable (it is only set when a view is created)