The Fund Confirmation Service (FCS) API provides a service to query the availability of a specific amount at the point in time of the call.
Access to the FCS API is controlled through the general onboarding/enrollment flow. I.e. the API is only accessible to valid TPPs, who have completed the enrollment in order to upload and verify their qualified certificates. By accessing the API, you confirm that you already have status as an authorized TPP - or (for sandbox access only) that your application has been submitted to a local NCA and is pending approval. Only TPPs who can document their authorization status are elegible for support.
The FCS API is part of the general PSD2 XS2A implementation and works in the same security context. In addition to the information contained below, all communication, headers and additional steps adhere to the general security model and flows. Refer to this link for up to date information on required security headers.
The API is implemented against Berlin Group XS2A version 1.3.
Note about this version This version of the FCS API now also supports testing of security, consent and SCA flows in sandbox with full security context.
- The sandbox API works on (stateless) mocked account data, while SCA, security and consent flows are identical to production.
- The security model for TPP enrollment and PSU authentication/authorization is implemented and enforced for both production and sandbox API
Access to API Endpoints
Production and sandbox access: Prior to calling the API the TPP must complete the (one-time) process for Onboarding on a per-bank basis. Separate API URL/host endpoints are required for each bank under the BEC Umbrella. Consult the Environments section for information on URL schemas in production and sandbox environments. See list of included ASPSPs and their corresponding urls by following this link. The X-IBM-Client-Id attribute is not required in this version.
This endpoint returns true if queried amount is available on the account.
ID of the request (in UUID format), unique to the call (generated by the initiating party, who must ensure uniqueness).
Shall be provided if the consent of the PSU has been provided through the consent process as defined in [XS2A-COFC].