API reference · Identity & onboarding

Open Banking Customer Approval

GET/openbanking/{tenantId}/authorisationThe approval screen for an open banking request
POST/openbanking/{tenantId}/authorisation/approveApprove an open banking request
POST/openbanking/{tenantId}/authorisation/declineDecline an open banking request

GET The approval screen for an open banking request

GET /openbanking/{tenantId}/authorisation

Called by the tenant's own app, signed in as the customer, after the authorize link opened it. The first customer to open a request claims it; anyone else gets not found. The request must be opened before its request_uri expires, and answered within the approval window after that. The screen carries the requesting service's name, what it is asking for in the customer's words, and the accounts the customer may choose from.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`tenantId`

Query parameters

Name	Default
`request_uri`	Optional

Example

Response: GenericResponseFapiApprovalScreenResponse

curl -X GET "https://api.bridgemoni.com/openbanking/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/authorisation?request_uri=value" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "requestUri": "string",
    "clientName": "string",
    "title": "string",
    "permissions": [
      "string"
    ],
    "eligibleAccounts": [
      {
        "accountReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
        "displayName": "string",
        "maskedIdentifier": "string"
      }
    ],
    "accountSelectionRequired": true,
    "consentExpiresDateTime": "2026-09-25T10:00:00Z",
    "answerByDateTime": "2026-09-25T10:00:00Z"
  },
  "description": "The screen"
}

Responses

Status	When
`200`	The screen
`404`	No such request waiting for this customer

POST Approve an open banking request

POST /openbanking/{tenantId}/authorisation/approve

Needs the customer's transaction PIN on the request (x-secret-value) as well as their session. Records the approval with the consent service and returns the redirect the app must open: the client's registered redirect URI carrying a signed JARM response with the authorization code.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live
`Content-Type`	application/json

Path parameters

Name
`tenantId`

Example

Request body: FapiApprovalRequest · Response: GenericResponseFapiApprovalOutcomeResponse

curl -X POST "https://api.bridgemoni.com/openbanking/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/authorisation/approve" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV" \
  -H "Content-Type: application/json" \
  -d '{
  "requestUri": "string",
  "selectedAccountReferences": [
    "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e"
  ]
}'

{
  "requestUri": "string",
  "selectedAccountReferences": [
    "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e"
  ]
}

{
  "data": {
    "redirectUri": "string"
  },
  "description": "Approved; open redirectUri"
}

Responses

Status	When
`200`	Approved; open redirectUri
`400`	The account selection is not acceptable
`403`	The transaction PIN was not presented
`404`	No such request waiting for this customer

POST Decline an open banking request

POST /openbanking/{tenantId}/authorisation/decline

Declining never needs a PIN. Returns the redirect carrying a signed JARM error response, access_denied, so the requesting service learns the answer.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live
`Content-Type`	application/json

Path parameters

Name
`tenantId`

Example

Request body: FapiDeclineRequest · Response: GenericResponseFapiApprovalOutcomeResponse

curl -X POST "https://api.bridgemoni.com/openbanking/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/authorisation/decline" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV" \
  -H "Content-Type: application/json" \
  -d '{
  "requestUri": "string"
}'

{
  "requestUri": "string"
}

{
  "data": {
    "redirectUri": "string"
  },
  "description": "Declined; open redirectUri"
}

Responses

Status	When
`200`	Declined; open redirectUri
`404`	No such request waiting for this customer

Generated from the OpenAPI document. Branch on the HTTP status: there is no machine-readable error code on the wire. Errors