Skip to main content
While PSD2 (Payment Services Directive 2) has mandated that banks must open their systems to third-parties, and provide interfaces for them to initiate payments and retrieve account information, in the UK it is the Open Banking Implementation Entity (OBIE) that defines how banks are to provide this information securely through APIs and data structures. In order to bring some synergy across the European banks, the Berlin Group which is a pan-European initiative has implemented a common API standard called NextGenPSD2. While these efforts have greatly improved how Open Banking can be consumed in member countries, there are some differences in how you communicate to these banks.

​
Payments

  • In order to initiate a payment from an account from an Institution that belongs to the Berlin Group, the payer object and all its mandatory properties are required. This currently holds true for every Institution provided by Yapily that is in Europe (not including UKI)
When making a payment from an account held within the UK to an account held in Europe, the payer object is not required since the payment is executed by an Institution that is a member of the Open Banking UK specification.
  • The payment reference unlike an Institution in order the Open Banking UK specification can be more than 18 characters.

​
Response Codes

CodeStatusDescriptionYapily Response
200OKPUT, GET Response Codes. OK200
201CREATEDPOST response code where Payment Initiation or Consent Request was correctly performed.201
202ACCEPTEDDELETE response code, where a payment resource can be cancelled in general, but where a cancellation authorisation is needed in addition.200
204NO_CONTENTDELETE response code where a consent resource was successfully deleted. The code indicates that the request was performed, but no content was returned200
400FORMAT_ERRORFormat of certain request fields are not matching the XS2A requirements.
400PARAMETER_NOT_CONSISTENTParameters submitted by TPP are not consistent. This applies only for query parameters.
400PARAMETER_NOT_SUPPORTEDThe parameter is not supported by the API provider. This code should only be used for parameters that are described as “optional if supported by API provider.
400PERIOD_INVALIDRequested time period out of bound.
400RESOURCE_BLOCKEDThe addressed resource is not addressable by this request, since it is blocked e.g. by a grouping in a signing basket.
400SCA_INVALIDMethod Application on authorisation resource (e.g. Confirmation Request) blocked since SCA status of the resource equals “failed”.
400SCA_METHOD_UNKNOWNAddressed SCA method in the Authentication Method Select Request is unknown or cannot be matched by the ASPSP with the PSU.
400SERVICE_INVALIDThe addressed service is not valid for the addressed resources or the submitted data.
400TIMESTAMP_INVALIDTimestamp not in accepted time period.
401CERTIFICATE_BLOCKEDSignature/corporate seal certificate has been blocked by the ASPSP or the related NCA.401
401CERTIFICATE_EXPIREDSignature/corporate seal certificate is expired.401
401CERTIFICATE_INVALIDThe contents of the signature/corporate seal certificate are not matching PSD2 general PSD2 or attribute requirements.401
401CERTIFICATE_MISSINGSignature/corporate seal certificate was not available in the request but is mandated for the corresponding.401
401CERTIFICATE_REVOKEDSignature/corporate seal certificate has been revoked by QSTP.401
401CONSENT_INVALIDThe consent was created by this TPP but is not valid for the addressed service/resource.401
401CONSENT_EXPIREDThe consent was created by this TPP but has expired and needs to be renewed.401
401CORPORATE_ID_INVALIDThe PSU-Corporate-ID cannot be matched by the addressed ASPSP.401
401PSU_CREDENTIALS_INVALIDThe PSU-ID cannot be matched by the addressed ASPSP or is blocked, or a password resp. OTP was not correct. Additional information might be added.401
401ROLE_INVALIDThe TPP does not have the correct PSD2 role to access this service.401
401SIGNATURE_INVALIDApplication layer eIDAS Signature for TPP authentication is not correct.401
401SIGNATURE_MISSINGApplication layer eIDAS Signature for TPP authentication is mandated by the ASPSP but is missing.401
401TOKEN_UNKNOWNThe OAuth2 token cannot be matched by the ASPSP relative to the TPP.401
401TOKEN_INVALIDThe OAuth2 token is associated to the TPP but is not valid for the addressed service/resource.401
401TOKEN_EXPIREDThe OAuth2 token is associated to the TPP but has expired and needs to be renewed.401
403CONSENT_UNKNOWNThe Consent-ID cannot be matched by the ASPSP relative to the TPP.403
403RESOURCE_EXPIREDThe addressed resource is associated with the TPP but has expired, not addressable anymore.403
403SERVICE_BLOCKEDThis service is not reachable for the addressed PSU due to a channel independent blocking by the ASPSP403
404RESOURCE_UNKNOWNThe addressed resource is unknown relative to the TPP.
409STATUS_INVALIDThe addressed resource does not allow additional authorisation.
500INTERNAL SERVER ERRORInternal server error occurred.424
501SERVICE UNAVAILABLEThe ASPSP server is currently unavailable. Generally, this is a temporary state.424
CodeStatusDescription
400EXECUTION_DATE_INVALIDThe requested execution date is not a valid execution date for the ASPSP.
400PAYMENT_FAILEDThe payment initiation POST request failed during the initial process. Additional information may be provided by the ASPSP.
401REQUIRED_KID_MISSINGThe payment initiation has failed due to a missing KID.
403PRODUCT_INVALIDThe addressed payment product is not available for the PSU.
404PRODUCT_UNKNOWNThe addressed payment product is not supported by the ASPSP.
405CANCELLATION_INVALIDThe addressed payment is not cancellable e.g. due to cut off time passed or legal constraints.
CodeStatusDescription
400SESSIONS_NOT_SUPPORTEDThe combined service flag may not be used with this ASPSP.
401CONSENT_INVALIDThe consent definition is not complete or invalid. In case of being not complete, the bank is not supporting a completion of the consent towards the PSU.
406REQUESTED_FORMATS_INVALIDThe requested formats in the Accept header entry are not matching the formats offered by the ASPSP.
429ACCESS_EXCEEDEDThe access on the account has been exceeding the consented multiplicity without PSU involvement per day.