Sandbox for API Testing

When adding an App for Sandbox

Required field information:

Software jwks endpoint. This is similar to the jwks endpoint, but you will put in any revoked certificates that you no longer use.
Software redirect URIs. These are the specific URI's that AIB will redirect back to that are in the your control with an authorization code

In order to allow the TPP to control rotating their keys in their own site, the revoked endpoint isn't being used in the sandbox. You should host your own jkws on your website.

When calling endpoints in Sandbox

x-fapi-financial-id for Sandbox is 0015800000jf9VgAAI

The Consent ID obtained from the first POST Request is used in JWT

Sample Requests and Responses

Obtain Access Token

Request:

curl -X POST \
https://sandbox.aib.ie/security/v2/oauth/token \
-H 'Accept: */*' \
-H 'Authorization: Basic OVhxS3FJTDVWR1RFUlNFczZTR2k0SklQQ3plS3ZHVUc6cGY1TXN2V3Z3VUxUOHZpa1FxYUVPOEVHR3hCSFNZSU8=' \
-H 'Cache-Control: no-cache' \
-H 'Connection: keep-alive' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-H 'Host: sandbox.aib.ie' \
-H 'Origin: https://tpp.domain.com/' \
-H 'Postman-Token: b53900d0-2bc8-416e-9f6a-da4b41fd064b,4fc80540-5595-44a4-b828-3a20e6f07230' \
-H 'User-Agent: PostmanRuntime/7.15.0' \
-H 'accept-encoding: gzip, deflate' \
-H 'cache-control: no-cache' \
-H 'content-length: 53' \
-d 'grant_type=client_credentials&scope=openid%20accounts'

Response: 200 OK

{

"access_token": "YHOYFyxGBihjHGMPypxuzTx5qClj",
"token_type": "Bearer",
"expires_in": 3599,
"scope": "accounts",
"refresh_token": null,
"application_name": "qwe4d8f0-1234-4073-8f56-364dbcc9ejkl",
"client_id": "U8y5qIL5VGTERSEs6SGi4JIPCzeKvHJK",
"developer.email": "support@tpp.domain.com",
"api_product_list": "[PISP_sandbox, AISP_sandbox]",
"issued_at": "1560871652381",
"refresh_count": "0",
"refresh_token_issued_at": null,
"refresh_token_status": null,
"refresh_token_expires_in": 0,
"state": null,
"status": "approved"

}

Obtain consent ID

POST https://sandbox.aib.ie/v2/sandbox/open-banking/v3.1/account-access-consents
'Host: sandbox.aib.ie' \
'Authorization: Bearer’ YHOYFyxGBihjHGMPypxuzTx5qClj \
'Content-Type: application/json
x-fapi-financial-id: 0015800000jf9VgAAI
'Cache-Control: no-cache' \
'Postman-Token: 30dbc313-559a-4b14-a1c6-3c95c4747498,89b760e7-c755-4085-8e00-89e1caeabae7' \

{

"Data": {
"Permissions": [
"ReadAccountsBasic",
ReadBalances,
ReadTransactionsDetail
],
"ExpirationDateTime":"2019-09-25T08:12:00.2345",
"TransactionFromDateTime":"2019-01-01T08:12:00.2345",
"TransactionToDateTime":"2019-02-18T08:12:00.2345"

}
"Risk": {}
}

Response (guide only)

{

"Data":{
"Consentid":"urn:aib:payment:account-access-consents:v3.1:58b3c604b3064f9e98fed1afa2c8e97d"
...

}

Note: this consentid is used in the JWT.

Auto consent - obtain code

Request:

curl -X GET \
'https://sandbox.aib.ie/security/v2/sandbox-auto-consents/? redirect_uri=https://tpp.domain.com/&client_id=9XqKqIL5VGTERSEs6SGi4JIPCzeKvGUG&response_type=code%20id_token&request=eyJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJodHRwczpcL1wvc2FuZGJveC5haWIuaWUiLCJzY29wZSI6Im9wZW5pZCBhY2NvdW50cyIsImlzcyI6IjlYcUtxSUw1VkdURVJTRXM2U0dpNEpJUEN6ZUt2R1VHIiwiY2xhaW1zIjp7ImlkX3Rva2VuIjp7Im9wZW5iYW5raW5nX2ludGVudF9pZCI6eyJ2YWx1ZSI6IjlYcUtxSUw1VkdURVJTRXM2U0dpNEpJUEN6ZUt2R1VHIiwiZXNzZW50aWFsIjoidHJ1ZSJ9fX0sInJlc3BvbnNlX3R5cGUiOiJjb2RlIGlkX3Rva2VuIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6XC9cL2RlYmFwYXkuZG9ja2VyMS5kZXZzb2Z0LmN6XC8iLCJzdGF0ZSI6IjEiLCJjbGllbnRfaWQiOiI5WHFLcUlMNVZHVEVSU0VzNlNHaTRKSVBDemVLdkdVRyJ9.nE0GeELXm25_8yoi3mRgoLTtuyzGB079Rklgg5AHaaD-8INOhUclF_1YUozbvqp3&scope=openid%20accounts&state=1&customer_id=2345' \
-H 'Accept: */*' \
-H 'Authorization: Bearer YHOYFyxGBihjHGMPypxuzTx5qClj' \
-H 'Cache-Control: no-cache' \
-H 'Connection: keep-alive' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-H 'Host: sandbox.aib.ie' \
-H 'Origin: https://tpp.domain.com/' \
-H 'Postman-Token: 30dbc313-559a-4b14-a1c6-3c95c4747498,89b760e7-c755-4085-8e00-89e1caeabae7' \
-H 'User-Agent: PostmanRuntime/7.15.0' \
-H 'accept-encoding: gzip, deflate' \
-H 'cache-control: no-cache'

Response: 302 Found

Location →
https://tpp.domain.com/#code=nmI4zWul&scope=accounts&state=1&id_token=eyJ0eXAiOiJKV1QiLCJraWQiOiJzYW5kYm94LXNpZ25lci5haWIuaWUiLCJhbGciOiJQUzI1NiJ9.eyJpc3MiOiJodHRwczovL3NhbmRib3guYWliLmllIiwiYXVkIjoiOVhxS3FJTDVWR1RFUlNFczZTR2k0SklQQ3plS3ZHVUciLCJzdWIiOiI5WHFLcUlMNVZHVEVSU0VzNlNHaTRKSVBDemVLdkdVRyIsIm9wZW5iYW5raW5nX2ludGVudF9pZCI6IjlYcUtxSUw1VkdURVJTRXM2U0dpNEpJUEN6ZUt2R1VHIiwiYWNyIjoidXJuOm9wZW5iYW5raW5nOnBzZDI6c2NhIiwiZXhwIjoxNTYwODcyMDc4LCJpYXQiOjE1NjA4NzE3NzgsInNfaGFzaCI6ImE0YXljXzgwX09HZGE0Qk9fMW9fVnciLCJjX2hhc2giOiJmc1dJdjU0aWxBeHRLUmU3anZWVnJRIn0.UruCzUCY5kqctsCtm2i11ViS0KKTXrj5YRVEN-x2sCdTR60w8C6mF4TkXShsLpGJRpKjQY9IzESY78WXxsieYq76j6VqC0oVxBje52PzZReczCTPHFJRGf7gPSIjD0qMDN7sHrf2c0cdk3snz19DL84CzUei7b1YoyYLE1zcus0ZzFfb_0m1RL57N7_kb0W93CYw3k1JqfNr_6cX0ConzZ1f8k-K1fjLoR42uKBkaj0u3dD5mmPBskzlsTUikF6J4sYK9PAzs_fk7-eao2GMdnsIBPZdz3nb6Rx21xqhkIpTEgEgztEEJrKOgOT74P3T_HgheZiohaWPP-W4FDYDCA

Obtain refresh token with auth code

Request:

curl -X POST \
https://sandbox.aib.ie/security/v2/oauth/token \
-H 'Accept: */*' \
-H 'Authorization: Basic OVhxS3FJTDVWR1RFUlNFczZTR2k0SklQQ3plS3ZHVUc6cGY1TXN2V3Z3VUxUOHZpa1FxYUVPOEVHR3hCSFNZSU8=' \
-H 'Cache-Control: no-cache' \
-H 'Connection: keep-alive' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-H 'Host: sandbox.aib.ie' \
-H 'Origin: https://tpp.domain.com/' \
-H 'Postman-Token: 2be66e38-058f-4326-b282-4b49264760bf,400d054a-0118-407e-bc94-35f6ea77da11' \
-H 'User-Agent: PostmanRuntime/7.15.0' \
-H 'accept-encoding: gzip, deflate' \
-H 'cache-control: no-cache' \
-H 'content-length: 67' \
-d 'grant_type=authorization_code&code=nmI4zWul&scope=openid%20accounts'

Response: 200 OK

{

"access_token": "URfPOw9qEgdsKRMrsR4Hqk4vwnYb ",
"token_type": "Bearer",
"expires_in": 299,
"scope": "accounts",
"refresh_token": "kFA3pXpmWQmMIhvlpjmxkGoGKtJAaJnQ ",
"application_name": "qwe4d8f0-1234-4073-8f56-364dbcc9ejkl",
"client_id": "9XqKqIL5VGTERSEs6SGi4JIPCzeKvGUG",
"developer.email": "support@tpp.domain.com",
"api_product_list": "[PISP_sandbox, AISP_sandbox]",
"issued_at": "1560871788599",
"refresh_count": "0",
"refresh_token_issued_at": "1560871788599",
"refresh_token_status": "approved",
"refresh_token_expires_in": 7775999,
"state": "1",
"status": "approved",
"id_token": "eyJ0eXAiOiJKV1QiLCJraWQiOiJzYW5kYm94LXNpZ25lci5haWIuaWUiLCJhbGciOiJQUzI1NiJ9.eyJpc3MiOiJodHRwczovL3NhbmRib3guYWliLmllIiwiYXVkIjoiOVhxS3FJTDVWR1RFUlNFczZTR2k0SklQQ3plS3ZHVUciLCJzdWIiOiI5WHFLcUlMNVZHVEVSU0VzNlNHaTRKSVBDemVLdkdVRyIsIm9wZW5iYW5raW5nX2ludGVudF9pZCI6IjlYcUtxSUw1VkdURVJTRXM2U0dpNEpJUEN6ZUt2R1VHIiwiYWNyIjoidXJuOm9wZW5iYW5raW5nOnBzZDI6c2NhIiwiZXhwIjoxNTYwODcyMDg4LCJpYXQiOjE1NjA4NzE3ODgsImF0X2hhc2giOiJkemdnckF5dXhZYXF2RVIxSkdDa0pRIn0.YwQyxvTK13BSWUt3MMJrHdGHgg_U7vCILFx8-3W40WEAJ-YnSlMQ59Hc5mSuiL5OuBPlx4HMmuDbuM9XKKNH7Sa5g0EaO7Sk5ahUEKbV9r2LjHmgG-uDV_ZQTSD4nhAhCpsc1A8PwAvFl9zYyWou05xcPjME67-jb-kLhjBdOFNmTMbwTZSkrTJY4TmGPkd7FgFrjDOEAaTIC0Z2z3k0jO7J1FNdOjDyhkAuotSCgzblG-H-PND9_tP6TY74ZYuSfpearb3M_yHvUSYAh_JVHxZTcTNBOlh1C4HV5AlpLsVuc2AIhWg7ErbkTe36pqKpVGnXeNLW_bQ7ePjcT4Qfxw"

}

Swap refresh token for access token

Request:

curl -X POST \
https://sandbox.aib.ie/security/v2/oauth/token \
-H 'Accept: */*' \
-H 'Authorization: Basic OVhxS3FJTDVWR1RFUlNFczZTR2k0SklQQ3plS3ZHVUc6cGY1TXN2V3Z3VUxUOHZpa1FxYUVPOEVHR3hCSFNZSU8=' \
-H 'Cache-Control: no-cache' \
-H 'Connection: keep-alive' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-H 'Host: sandbox.aib.ie' \
-H 'Origin: https://tpp.domain.com/' \
-H 'Postman-Token: 5324a0db-f4d3-49d2-972f-74f5b3577d50,8b602811-9935-4bd7-91da-937f5670afdc' \
-H 'User-Agent: PostmanRuntime/7.15.0' \
-H 'accept-encoding: gzip, deflate' \
-H 'cache-control: no-cache' \
-H 'content-length: 95' \
-d 'grant_type=refresh_token&refresh_token=kFA3pXpmWQmMIhvlpjmxkGoGKtJAaJnQ&scope=openid%20accounts'

Response:

{
"access_token": "LBOeG2JEEvgXSmZcawqAzV6V9zpc",
"token_type": "BearerToken",
"expires_in": 299,
"scope": "accounts",
"refresh_token": "AFzkxqTrdoMxTK6UGPX1ABcAkWeBn1GD",
"application_name": "b47338e4-735e-461e-8ef4-1934d97dc36e",
"client_id": "qZGnQt8drVu3gytpStRBxBeWUPB215f0",
"developer.email": "peter.x.smiley+external@aib.ie",
"api_product_list": "[CBPII, pisp, aisp-sandbox, aisp, CBPII-sandbox, pisp-sanbox]",
"issued_at": "1561623861222",
"refresh_count": "1",
"refresh_token_issued_at": "1561623777090",
"refresh_token_status": "approved",
"refresh_token_expires_in": 7775313,
"state": "b5d3acae-8cd3-47ee-b97a-87e5099f3ede",
"status": "approved"
}

Sample JWT

*Please note that value of "openbanking intent id" was obtained from POST /account-access-consents as above

{ "iss": "U8y5qIL5VGTERSEs6SGi4JIPCzeKvHJK",
"response_type": "code id_token",
"client_id": " U8y5qIL5VGTERSEs6SGi4JIPCzeKvHJK",
"redirect_uri": "https://example.com/tpp/authorized",
"scope": "openid accounts",
"state": "1",
"nonce": "dummy-nonce",
"max_age": 86400,
"claims": {
"userinfo": {
"openbanking_intent_id": {
"value": "urn:aib:payment:account-access-consents:v3.1:58b3c604b3064f9e98fed1afa2c8e97d",
"essential": true }
},
"id_token": {
"openbanking_intent_id": {
"value": "urn:aib:payment:account-access-consents:v3.1:58b3c604b3064f9e98fed1afa2c8e97d",
"essential": true
},
"acr": {
"essential": true
}
}
},
"jti": "33ca23c3-982f-4889-9165-9868cd514323",
"iat": 1540986778,
"exp": 1540990378
}