Open Banking Authorization Server

GET A tenant's OpenID provider metadata, FAPI 1.0 Advanced profile

GET /openbanking/{tenantId}/.well-known/openid-configuration

Each tenant that serves open banking is its own issuer, named by the path and never by an X-Tenant header, which is refused when it contradicts the path. The document is the standard shape, not wrapped, because a third party's client library configures itself from it. It advertises only endpoints this deployment serves; the authorization, PAR and token endpoints appear as each is built. Authorization responses are JARM (response_mode=jwt), requests must be pushed and signed, and clients authenticate with private_key_jwt.

Headers

Path parameters

Example

Response: FapiDiscoveryDocumentResponse

curl -X GET "https://api.bridgemoni.com/openbanking/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/.well-known/openid-configuration" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "issuer": "string",
  "jwks_uri": "string",
  "authorization_endpoint": "string",
  "pushed_authorization_request_endpoint": "string",
  "token_endpoint": "string",
  "revocation_endpoint": "string",
  "introspection_endpoint": "string",
  "registration_endpoint": "string",
  "scopes_supported": [
    "string"
  ],
  "response_types_supported": [
    "string"
  ],
  "response_modes_supported": [
    "string"
  ],
  "grant_types_supported": [
    "string"
  ],
  "subject_types_supported": [
    "string"
  ],
  "id_token_signing_alg_values_supported": [
    "string"
  ],
  "authorization_signing_alg_values_supported": [
    "string"
  ],
  "request_object_signing_alg_values_supported": [
    "string"
  ],
  "token_endpoint_auth_methods_supported": [
    "string"
  ],
  "token_endpoint_auth_signing_alg_values_supported": [
    "string"
  ],
  "code_challenge_methods_supported": [
    "string"
  ],
  "require_pushed_authorization_requests": true,
  "require_signed_request_object": true,
  "request_parameter_supported": true,
  "authorization_response_iss_parameter_supported": true,
  "tls_client_certificate_bound_access_tokens": true
}

Responses

GET Authorization endpoint, FAPI 1.0 Advanced profile

GET /openbanking/{tenantId}/authorize

Takes only client_id and a request_uri from PAR. It is not a login page: it is the link the tenant's app registers as a universal/app link, so on a phone with the app installed the operating system opens the app on the approval screen and this page is never fetched. A browser that reaches it is told to continue in the app. Nothing is ever asked for here, and nothing the caller sent is echoed. An unusable request is answered here, never by redirecting to a client, because an unverified redirect is an open redirector.

Headers

Path parameters

Example

Response: string

curl -X GET "https://api.bridgemoni.com/openbanking/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/authorize" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

"string"

Responses

GET A tenant's published signing keys

GET /openbanking/{tenantId}/jwks

The keys a third party uses to verify this tenant's id_tokens and JARM responses. Only this tenant's keys appear, so a signature made under one tenant cannot verify under another. Every key that is not RETIRED is listed; match the kid.

Headers

Path parameters

Example

Response: JsonWebKeySetResponse

curl -X GET "https://api.bridgemoni.com/openbanking/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/jwks" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "keys": [
    {
      "kid": "string",
      "kty": "string",
      "crv": "string",
      "alg": "string",
      "use": "string",
      "x": "string",
      "y": "string"
    }
  ]
}

Responses

POST Push an authorization request (RFC 9126), FAPI 1.0 Advanced profile

POST /openbanking/{tenantId}/par

application/x-www-form-urlencoded, each parameter once. The client authenticates with private_key_jwt (client_assertion_type and client_assertion, audience the issuer, this endpoint or the token endpoint). Every authorization parameter travels in request, a request object signed PS256 or ES256 by the client: response_type code, response_mode jwt, an S256 code_challenge, a registered redirect_uri, scopes within the registration including openid, exp and nbf at most sixty minutes apart, and the open banking intent in claims.id_token.openbanking_intent_id.value. The intent must be one this client created and the customer has not yet answered. The returned request_uri is single-use and short-lived.

Headers

Path parameters

Example

Response: PushedAuthorisationRequestResponse

curl -X POST "https://api.bridgemoni.com/openbanking/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/par" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "request_uri": "string",
  "expires_in": 0
}

Responses

POST Revoke a token (RFC 7009)

POST /openbanking/{tenantId}/revoke

Client authenticated with private_key_jwt. Revoking a refresh token revokes every token in its family. Answers 200 whether or not the token existed or belonged to the caller, so the endpoint cannot be used to test which tokens are live.

Headers

Path parameters

Example

curl -X POST "https://api.bridgemoni.com/openbanking/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/revoke" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

Responses

POST Issue tokens (RFC 6749), FAPI 1.0 Advanced profile

POST /openbanking/{tenantId}/token

application/x-www-form-urlencoded, each parameter once, client authenticated with private_key_jwt. grant_type client_credentials issues an access token for the requested scopes, never openid. authorization_code redeems a single-use code with the exact redirect_uri and the PKCE code_verifier, and returns an access token, a refresh token if the client registered that grant, and an id_token carrying openbanking_intent_id. A code presented twice revokes every token it produced. refresh_token rotates: the presented token stops working, and presenting it again revokes its whole family. No token outlives its intent. Tokens are opaque.

Headers

Path parameters

Example

Response: FapiTokenResponse

curl -X POST "https://api.bridgemoni.com/openbanking/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/token" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "scope": "string",
  "access_token": "string",
  "token_type": "string",
  "expires_in": 0,
  "refresh_token": "string",
  "id_token": "string"
}

Responses