1. Introduction

The API Hub Sandbox contains one or more ‘Model LFIs’, where each Model LFI has:

...

This API Hub Sandbox therefore acts as a testing environment for TPPs, so that they can a) test their applications prior to being licensed and/or without accessing any real customer accounts and b) demonstrate their conformance to the Open Finance Standards as set out in the Testing and Certification Framework.

The API Hub Sandbox also acts as a reference implementation for LFIs so that they can compare their own API integration with the API Hub, thereby speeding up such integration activity.

2. Pre-Requisites

Developers must firstly make themselves familiar with all aspects of the Standards.

In order to access the API Hub Sandbox, developers must be on-boarded onto the LFI or TPP must nominate and onboard a Primary Business (PBC) and Primary Technical (PTC) contacts to the Open Finance Trust Framework (OFTF) Sandbox and have the ability to create Applications under the OFTF Sandbox. Once onboarded, this allows developers the PTC to create the following artefacts within the OFTF Sandbox in order to simulate a TPP application:

1. Client IDApplication

2. Client Application Transport Key & Certificate

3. Application Signing Key Signing Key ID (KID)& Certificate

Detailed information about how to create the OFTF artefacts Application and Certificates is covered in the https://openfinanceuae.atlassian.net/wiki/spaces/TFDocsv4/pages/183468280/Trust+Framework+User Documentation.

...

+Documentation#5.-TPPs-Quick-Access-Guide

3. Accessing the API Hub Sandbox

The API Hub Sandbox is typically accessed by a TPP using their own client application.

The API Hub Sandbox is being continually updated to support more API sets and functionality. Please use the latest version here: https://openfinanceuae.atlassian.net/wiki/spaces/OF/pages/329678849/API+Hub+Sandbox+v1.2+2025.02.26?atlOrigin=eyJpIjoiNGJkOThmNDA3NjBiNDViYzhjYmQ0OWFmMzM4YzI5MGQiLCJwIjoiYyJ9 , which contains updates resulting from service desk tickets and Open Product functionality.

4. Using Postman

4.1 Introduction

The API Hub Sandbox does not in itself have a GUI. While developers can connect their own TPP applications directly to the API Hub Sandbox (because it behaves exactly the same as an LFI’s production endpoints in the API Hub), the starting point is to use Postman to connect and test out all of the APIs.

4.

...

2 Setting up Postman

1. Download and install https://www.postman.com/

2. Download the latest Postman Collection (see section 4 below)Download the latest Postman Environment File (see section 4 below)from the latest version of the API Hub Sandbox (see https://openfinanceuae.atlassian.net/wiki/spaces/OF/pages/195788812/API+Hub+Sandbox+User+Guide#3.-Accessing-the-API-Hub-Sandbox )

3. Register your TPP client in the API Hub Sandbox, see https://openfinanceuae.atlassian.net/wiki/spaces/OF/pages/329678849/API+Hub+Sandbox+v1.2+2025.02.26?atlOrigin=eyJpIjoiNGJkOThmNDA3NjBiNDViYzhjYmQ0OWFmMzM4YzI5MGQiLCJwIjoiYyJ9

4. Request a Postman Environment file:

   1. Once your TPP client is successfully registered (step 3 above), please refer to https://openfinanceuae.atlassian.net/wiki/spaces/OF/pages/195788812/API+Hub+Sandbox+User+Guide#4.4-Downloading-Environment--through--Postman to obtain the Postman Environment file.

5. Import the Postman Collection and Environment File into Postman
   

   Image RemovedImage Added

6. Configure the OFTF Transport Certificates in Postman

   1. Go to Settings > Certificates > Add Certificate

   2. Enter the Host URL as below (please note this example is for Al Tareq Model LFI 1, and over time we may create additional Model LFIs)

   3. Import the Transport Certificate (CRT file) from the OFTF Sandbox, see section 2 above

   4. Import your Transport Key (KEY file) the Private Key which will have stored locally

      

7. Set the following general Postman settings

   1. Go to Settings > General

   2. Set SSL certificate verification: OFF

   3. Set Automatically follow redirects: ON

      

      

8. Load Select the altareq-sandbox required environment file, which contains the server host definitions. Make sure you use the correct (latest) evironmentenvironment.

   

9. Edit the altareq-sandbox your environment to add the _clientId, kid_-local, and pem_-local as follows:

   1. _clientId - the Client ID of your application from the OFTF Sandbox

      

      Insert the Client ID value from the OFTF Sandbox into the Postman _clientid variable of the altareq-sandbox your environment

      

   2. kid_-local - the Key Id (KID) of the OFP UAE CLIENT SIGNING certificate created for your application from the OFTF Sandbox

      

      The KID is then inserted into the kid_-local field of the altaraq-sandbox environment

      

   3. pem_-local - the Private Key of your Signing Certificate.
      This is the OFTF Signing Certificate Private Key that you created when you created the Signing Certificate CSR.
      The Signing Ley needs to be represented as a single line to be included in the Postman environment.
      To acheive achieve this in MacOS and Linux, the tr (translate) command can be used as follows, which removes the newline characters.

      Code Block
      tr -d '\n' < 98863a9e-ae4f-4593-a894-714cbbc91ffb-opf_uae_client_signing.key > single-line-opf_uae_client_signing.key

The single line Client Key can then be copied and pasted from the file into the postman environment as the pem-local variable:

...

4.

...

3 Using the Postman

...

Collection

The latest Postman files can be downloaded here

• Postman Collection

  View file
  name Open Finance - CBUAE Sandbox v1.1 2024.09.20.postman_collection.json

• Environment File

  View file
  name altareq-sandbox.postman_environment-v1.0-240920.json

The above Postman Collection currently supports the following API endpoints:

Bank Data Sharing

• GET/account-access-consents

• GET/account-access-consents/{ConsentId}

• PATCH/account-access-consents/{ConsentId}

• GET/accounts

• GET/accounts/{AccountId}

• GET/accounts/{AccountId}/balances

• GET/accounts/{AccountId}/beneficiaries

• GET/accounts/{AccountId}/direct-debits

• GET/accounts/{AccountId}/product

• GET/accounts/{AccountId}/scheduled-payments

• GET/accounts/{AccountId}/standing-orders

• GET/accounts/{AccountId}/transactions

• GET/accounts/{AccountId}/parties

• GET/parties

Bank Service Initiation (Single Instant Payment)

• GET/payment-consents

• GET/payment-consents/{ConsentId}

• PATCH/payment-consents/{ConsentId}

• POST/payments

• GET/payments

• GET/payments/{PaymentId}

Bank Service Initiation (Single Future Dated Payment)

• GET/payment-consents

• GET/payment-consents/{ConsentId}

• PATCH/payment-consents/{ConsentId}

• POST/payments

• GET/payments

• GET/payments/{PaymentId}

Insurance Data

• GET/insurance-consents

• GET/insurance-consents/{ConsentId}

• PATCH/insurance-consents/{ConsentId}

5. Using the Postman Collection

Once your Postman Environment has been updated, you’re ready to run the Postman Collection against the API Hub Sandbox.

The Postman Collection contains a number of steps in order, which will walk you through each of the API flows in the API Standards.

The Authorization Flow currently supports a single test User (username: mits, password: mits)

...

Once your Postman Environment has been updated, you’re ready to run the Postman Collection against the API Hub Sandbox.

The Postman Collection contains a number of steps in order, which will walk you through each of the API flows in the API Standards.

The Authorization Flow supports two test users username: mits, password: mits and username: rora, password: rora

Eight new accounts of various types, including an additional active account with a negative balance using the rora user.

"AccountId": "100004000000000000000002"
"SchemeName": "AccountNumber"
"Identification": "10000109010102"
"AccountType": "Corporate"
"Name": "Luigi International"

"AccountId": "100004000000000000000003"
"SchemeName": "AccountNumber"
"Identification": "10000109010103"
"AccountType": "Retail"
"Name": "Mario International"

"AccountId": "100004000000000000000005"
"SchemeName": "IBAN"
"Identification": "10000109010105"
"AccountType": "Retail"
"Name": "Spectrum"            

"AccountId": "100004000000000000000001"
"SchemeName": "IBAN"
"Identification": "10000109010101"
"AccountType": "Retail"
"Name": "Mario Current"

"AccountId": "100004000000000000000004"
"SchemeName": "AccountNumber"
"Identification": "10000109010104"
"AccountType": "Corporate"
"Name": "Luigi PrePaid Card"

"AccountId": "100004000000000000000006"
"SchemeName": "AccountNumber"
"Identification": "10000109010106"
"AccountType": "Corporate"
"Name": "Peach Charge Card"

"AccountId": "100004000000000000000007"
"SchemeName": "IBAN"
"Identification": "10000109010107"
"AccountType": "Retail"
"Name": "Bowser Other"

"AccountId": "100004000000000000000008"
"SchemeName": "IBAN"
"Identification": "10000109010108"
"AccountType": "Corporate"
"Name": "Toadstool Current"

AccountId": "100004000000000000000009"
"SchemeName": "AccountNumber"
"Identification": "10000109010109"
"AccountType": "Retail"
"Name": "Yoshi Savings"

"AccountId": "100004000000000000000010"
"SchemeName": "IBAN"
"Identification": "10000109010110"
"AccountType": "Corporate"
"Name": "Koopa Credit Card"

"AccountId": "100004000000000000000011"
"SchemeName": "IBAN"
"Identification": "10000109010111"
"AccountType": "Retail"
"Name": "Daisy PrePaid Card"

...

4.4 Downloading Environment  through  Postman

1. Navigate to Postman Environment folder from the collection

...

2. Then go to Get/environment endpoint

   1. Add value of client_id which you will get from Admin Portal

...

3. Then click on the send button.

...

4. Then Navigate to the 3 dots at the Right hand side corner

   1. Click on Save response to file

...

5. By clicking on Save, Postman Environment will get downloaded successfully

...