Versions Compared

Version Old Version 6 New Version Current
Changes made by

Chris Wood

Chris Wood

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

The TPP MUST now request the User to authorize the consent. Please refer to the Authentication and Authorizationpage to review the supported Authorization Flows.

The TPP MUST construct a Rich Authorization Request (https://www.rfc-editor.org/rfc/rfc9396) with the authorization_details populated with the User’s consent

The TPP MUST include in an insurance access consent with all the REQUIRED data permissions that the User intends to provide to the TPP.

...

The following are non-normative examples of API access and usage of the Insurance Information API.

3.1 The TPP Redirects the User to Authorize Insurance

...

Consent

3.1.1 Request: TPP Uses RAR (Rich Authorization Request) via a PAR (Pushed Authorization Request) Endpoint with the OFP to Obtain a Request URI

...

The authorization_details contain the User’s account access insurance consent details, and a UUID v4 which is a unique identifier for the account access insurance consent.

Code Block
{
    "typ": "JWT",
    "alg": "PS256",
    "kid": "e4ce77c498e77000a25aa7b40e4a83f9"
}
.
{
    "iss": "s6BhdRkqt3",
    "aud": "https://server.example.com",
    "response_type": "code",
    "redirect_uri": "https://openbanking.tpp1.ae/simple-redirect-url",
    "scope": "accountsinsurance",
    "state": "2616df22-899e-468b-b7af-927145b067cc",
    "authorization_details": [
        {
            "Type": "urn:openfinanceuae:insurance-consent:v1.0-draft3",
            "Consent": {
                "ConsentId": "6a6a826f-0930-4eb0-b365-a8eac3032828",
                "Permissions": [
                    "ReadInsurancePoliciesMotor"
                ],
                "ExpirationDateTime": "2024-03-28T15:27:13+030",
                "Purpose": [
                    "MotorInsuranceQuote"
                ]
            }
        }
    ]
}

...

The LFI confirms insurance consent properties in the OFP.

Code Block
POST /authconsents/aac6a6a826f-1a672e830930-d1e54eb0-42bc-b8e1-60a490ec52fd/ic/doConfirmb365-a8eac3032828
host: auth1.openfinanceplatform.ae
Content-Type: application/x-www-form-urlencoded
policyReference=f91d07d0-6d8f-4e0e-9fb4-0ac61f84d115
&policyReference=bed6cb83-956e-4795-86c3-0f4254ae1cab

3.4 The LFI Returns an Authorization Code to the TPP

Code Block
302 Found
Location: https://openbanking.tpp1.ae/simple-redirect-json
{
  "psuIdentifiers": [
    "userId": "33f81f80-6223-4ae1-927a-fec19169ecef"
  ],
  "insurancePoliciesIds": [
    "176794ea-ee8c-4621-b824-b8cfa95db0ff"
  ]
}

The LFI then confirms authorization of insurance consent in the OFP.

Code Block
POST /auth/aac-1a672e83-d1e5-42bc-b8e1-60a490ec52fd/doConfirm
host: auth1.openfinanceplatform.ae
Content-Type: application/x-www-form-urlencoded
InsurancePolicyInformation.PolicyReference=f91d07d0-6d8f-4e0e-9fb4-0ac61f84d115
&InsurancePolicyInformation.PolicyReference=bed6cb83-956e-4795-86c3-0f4254ae1cab

3.4 The LFI Returns an Authorization Code to the TPP

Code Block
302 Found
Location: https://openbanking.tpp1.ae/simple-redirect-url?
code=ce2aeabf-599c-4475-9171-1f6d8c1a49dc
&state=2616df22-899e-468b-b7af-927145b067cc

...

The TPP can now request insurance policy information using the access token.

3.7 Get a List of Insurance Policies

...

Code Block
HTTP/1.1 200 OK
Content-Type: application/json
x-fapi-interaction-id: 942a7ee7-d29a-45aa-93b7-c5f292d86602
{
  "Data": {     "AccountData": [
      {
        "AccountIdPolicyType": "f91d07d0-6d8f-4e0e-9fb4-0ac61f84d115",
 "Motor",
        "AccountHolderNamePolicyDetails": "Hamad Ali",{
          "AccountHolderShortNameInsurancePolicyId": "176794ea-ee8c-4621-b824-b8cfa95db0ff",
          "StatusCustomerId": "Activedcaaef9c-63cb-4c57-9f2a-a4986c4a958e",
          "CurrencyPolicyReference": "AED9e77ccbd-f3c0-4a51-8c22-48c51531a4de",
          "AccountTypePolicyHolderName": "UAEOF.RetailHamad Ali",
          "AccountSubTypeCustomerCommunicationDetails": "CurrentAccount", {
            "NicknameCorrespondenceAddress": "CurrentAC",{
        "OpeningDate": "2021-01-28T15:27:13+0300",
      "AddressLine": [
       "AccountIdentifiers": [        "PO Box 12345"
{             "IdentificationType": "UAEOF.IBAN" ],
              "IdentificationPostalCode": "SA442000000123456789123412345",
              "NameCity": "HamadAl AliQouz",
          }    "StateEmirate": "Dubai",
     ],         "ServicerCountry": "UAE"
{           "IdentificationType": "UAEOF.BICFI" },
            "IdentificationPermanentAddress": "SASAMA"{
         }     "AddressLine": [
},       {         "AccountId": "g91d07d0-6d8f-4e0e-9fb4-0ac61f84e444",PO Box 12345"
        "AccountHolderName": "Hamad Ali",    ],
    "AccountHolderShortName": "",         "StatusPostalCode": "Active12345",
              "CurrencyCity": "USDAl Qouz",
        "AccountType      "StateEmirate": "UAEOF.RetailDubai",
              "AccountSubTypeCountry": "SavingsUAE",
          "Nickname": "SavingsAC",  },
            "OpeningDateResidentialAddress": "2021-01-28T15:27:13+0300", {
              "AccountIdentifiersAddressLine": [
            {    "PO Box 12345"
             "IdentificationType": "UAEOF.IBAN" ],
              "IdentificationPostalCode": "SA442000000123456789000112345",
              "NameCity": "HamadAl AliQouz",
          }    "StateEmirate": "Dubai",
     ],         "ServicerCountry": "UAE"
{           "IdentificationType": "UAEOF.BICFI" },
            "IdentificationCommunicationPreferences": "SASAMA" [
             } {
     }     ]   },   "LinksType": {"Home",
                "SelfPhoneNumber": "https://rs1.openfinanceplatform.ae/open-finance/account-information/v1.0-draft3/accounts"971000000000"
   },   "Meta": {}
}

3.8 Get an Insurance Policy

3.8.1 Request: Insurance Policy Resource

...

3.8.2 Response: Insurance Policy Resource

...

4. Further Examples

4.1 The TPP Queries the Account Access Consent Resource for the Status after a User has Authorized the Consent

4.1.1 Request: account-access-consents/{ConsentId} resource

Code Block
GET /open-finance/account-information/v1.0-draft3/account-access-consents/aac-1a672e83-d1e5-42bc-b8e1-60a490ec52fd HTTP/1.1
Host: rs1.openfinanceplatform.ae
Content-Type: application/json
x-fapi-interaction-id: 2e974f01-d111-4078-9a19-7a9b385e637c
Authorization: Bearer e6156449-6f27-4c42-aa5b-36602f73eac9

4.1.2 Response: account-access-consents/{ConsentId} resource

Code Block
HTTP/1.1 200 OK
Content-Type:application/json
x-fapi-interaction-id: 2e974f01-d111-4078-9a19-7a9b385e637c
{
  "Data       }
            ],
            "Email": "hamad.ali@email.ae"
          },
          "IndividualCustomerDetails": {
            "Gender": "Male",
            "DateofBirth": "2003-09-12",
            "MaritalStatus": "Married",
            "Nationality": "UAE",
            "NumberofChildren": 1
          },
          "VehicleInformation": {
            "CarMake": "Toyota",
            "CarModel": "Land Cruiser",
            "CarModelYear": "2023",
            "CarPurchaseDateTime": "2023-01-31T00:00:00.000Z",
            "EstimatedValueAmount": {
              "Currency": "AED",
              "Amount": 180000
            },
            "RegistrationDateTime": "2023-01-31T00:00:00.000Z",
            "CountryofOrigin": "ARE",
            "VehicleColor": "White",
            "PlateNumber": "12345",
            "PlateCode": "1",
            "VehicleMileage": 50000,
            "VehicleWeight": 2000,
            "VehicleHistory": "Imported"
          },
          "InsurancePolicyInformation": {
            "IssueDateTime": "2024-05-01T00:00:00.000Z",
            "ExpiryDateTime": "2025-04-31T23:59:59.999Z",
            "PolicyType": "Comprehensive",
            "CoverageAmount": {
              "Currency": "AED",
              "Amount": 180000
            },
            "CoverageStartDateTime": "2024-05-01T00:00:00.000Z",
            "PolicyPremium": {
              "Currency": "AED",
              "Amount": 4600
            },
            "PolicyHolderEmirates": true,
            "PreviousPolicy": {
              "PolicyReference": "8a43bab5-43d8-4525-b92d-840eff449ba5",
              "Insurer": "AXA",
              "PolicyStartDateTime": "2023-05-01T00:00:00.000Z",
              "PolicyExpiryDateTime": "2024-04-31T23:59:59.999Z"
            }
          },
          "AddOns": {
            "DriversPersonalAccident": true,
            "PassengersPersonalAccident": true
          },
          "AdditionalInformation": {
            "FirstTimeRegistration": "true",
            "VehicleMortgageAmount": {
              "Currency": "AED",
              "Amount": 180000
            }
          }
        }
      }
    ],
    "Links": {
      "Self": "https://rs1.openfinanceplatform.ae/open-finance/insurance/v1.0-draft3/insurance-policies"
    },
    "Meta": {
      "TotalPages": "1"
    }
  }

3.8 Get an Insurance Policy

3.8.1 Request: Insurance Policy Resource

Code Block
GET /open-finance/insurance/v1.0-draft3/insurance-policies/176794ea-ee8c-4621-b824-b8cfa95db0ff HTTP/1.1
Host: rs1.openfinanceplatform.ae
Accept: application/json
x-fapi-interaction-id: 942a7ee7-d29a-45aa-93b7-c5f292d86602
Authorization: Bearer caa1b60d-61ff-4cd8-a4e1-2d18c8696de0

3.8.2 Response: Insurance Policy Resource

Code Block
HTTP/1.1 200 OK
Content-Type: application/json
x-fapi-interaction-id: 942a7ee7-d29a-45aa-93b7-c5f292d86602
{
    "Data": {
      "PolicyType": "Motor",
      "PolicyDetails": {
        "InsurancePolicyId": "176794ea-ee8c-4621-b824-b8cfa95db0ff",
        "CustomerId": "dcaaef9c-63cb-4c57-9f2a-a4986c4a958e",
        "PolicyHolderName": "Hamad Ali",
        "CustomerCommunicationDetails": {
          "CorrespondenceAddress": {
            "AddressLine": [
              "PO Box 12345"
            ],
            "PostalCode": "12345",
            "City": "Al Qouz",
            "StateEmirate": "Dubai",
            "Country": "UAE"
          },
          "PermanentAddress": {
    "ConsentId": "aac-69255d98-ab0e-4758-92a7-cacbf3073efa",        "AddressLine": [
        "CreationDateTime": "2024-06-27T15:27:13+0300",     "ConsentStatus": "Authorized",PO Box 12345"
    "ConsentFlags": {       "PartlyAuthorized": "2024-06-27T16:27:13+0300"],
       },     "ConsentStatusUpdateDateTimePostalCode": "2024-06-27T16:27:13+030012345",
    "Permissions":  [      "City": "ReadAccountsBasicAl Qouz",
      "ReadAccountsDetail",      "StateEmirate": "ReadBalancesDubai",
      "ReadBeneficiariesBasic",      "Country": "ReadBeneficiariesDetail",UAE"
          "ReadTransactionsBasic"},
          "ReadTransactionsDetailResidentialAddress",: {
     "ReadTransactionsCredits",       "ReadTransactionsDebitsAddressLine",: [
     "ReadScheduledPaymentsBasic",       "ReadScheduledPaymentsDetail",  "PO Box 12345"
  "ReadDirectDebits",       "ReadStandingOrdersBasic",   ],
   "ReadStandingOrdersDetail"     ],     "AuthorizationExpirationTimeWindowPostalCode": "720:00:0012345",
      "ExpirationDateTime": "2024-06-28T15:27:13+0300",     "TransactionFromDateTimeCity": "2024-06-25T12:19:24+0300Al Qouz",
    "TransactionToDateTime": "2024-06-27T12:19:24+0300",        "AccountTypeStateEmirate": ["Dubai",
       "UAEOF.Retail"     ],
"Country": "UAE"
   "AccountSubType": [      },
"CurrentAccount"     ],     "ConsentPurposeCommunicationPreferences": [
       "Account Aggregation",    {
  "E-Statement"      ]   },   "SubscriptionType": {"Home",
      "Webhook": {       "UrlPhoneNumber": "https://api.tpp1.com/webhook/callbackUrl",971000000000"
      "IsActive": false     }   },
  "Links": {
      "Self": "https://rs1.openfinanceplatform.ae/open-finance/account-information/v1.0-draft3/account-access-consents/aac-69255d98-ab0e-4758-92a7-cacbf3073efa"   }],
   "Meta": {}
}

4.2 The TPP Requests the List of Insurance Policies Using an Expired Access Token

4.2.1 Request: accounts resource

Code Block
GET /open-finance/insurance/v1.0-draft3/insurance-policies HTTP/1.1
Host: rs1.openfinanceplatform.ae
Content-Type: application/json
x-fapi-interaction-id: 9a371b79-4e79-4d7d-a77d-380c528ab8c0
Authorization: Bearer caa1b60d-61ff-4cd8-a4e1-2d18c8696de0

4.2.2 Response: 403 Forbidden

Code Block
HTTP/1.1 401 Unauthorized
Content-Type: application/json
x-fapi-interaction-id: 9a371b79-4e79-4d7d-a77d-380c528ab8c0
{
  "Errors": [
    {       "Email": "hamad.ali@email.ae"
        },
        "IndividualCustomerDetails": {
          "CodeGender": "UAEOF.AccessToken.UnauthorizedMale",
          "MessageDateofBirth": "max_age_exceeded: Token has expired",2003-09-12",
          "PathMaritalStatus": "AuthorizationMarried",
          "UrlNationality": "https://developer.openfinanceplatform.ae/api-errors/401"UAE",
       }   ]
}

4.3 Webhooks

4.3.1 The TPP Creates an Insurance Consent Request with a Webhook Subscription

4.3.1.1 Request: Account Access Consent and Webhook Subscription

Code Block
{"NumberofChildren": 1
       "typ": "JWT" },
        "algVehicleInformation": "PS256",{
          "kidCarMake": "e4ce77c498e77000a25aa7b40e4a83f9Toyota",
}    . {     "issCarModel": "s6BhdRkqt3Land Cruiser",
    "iat": 1669393154,     "expCarModelYear": 1669393496"2023",
    "nbf": 1669393154,     "audCarPurchaseDateTime": "https://server.example.com2023-01-31T00:00:00.000Z",
    "response_type": "code",     "redirect_uriEstimatedValueAmount": "https://openbanking.tpp1.ae/simple-redirect-url",{
      "scope": "accounts",     "stateCurrency": "2616df22-899e-468b-b7af-927145b067ccAED",
        "authorization_details    "Amount": [180000
        {  },
          "TypeRegistrationDateTime": "urn:openfinanceuae:insurance-consent:v1.0-draft32023-01-31T00:00:00.000Z",
          "CountryofOrigin": "ARE",
          "ConsentVehicleColor": {"White",
          "PlateNumber": "12345",
          "ConsentIdPlateCode": "6a6a826f-0930-4eb0-b365-a8eac30328281",
          "VehicleMileage": 50000,
          "PermissionsVehicleWeight": [2000,
          "VehicleHistory": "Imported"
        "ReadInsurancePoliciesMotor"},
        "InsurancePolicyInformation": {
      ],    "IssueDateTime": "2024-05-01T00:00:00.000Z",
           "ExpirationDateTimeExpiryDateTime": "20242025-0304-28T1531T23:27:13+03059:59.999Z",
          "PolicyType": "Comprehensive",
    "Purpose": [      "CoverageAmount": {
            "Currency": "MotorInsuranceQuoteAED",
                ]"Amount": 180000
             },
            "SubscriptionCoverageStartDateTime": {"2024-05-01T00:00:00.000Z",
          "PolicyPremium": {
    "Webhook": {       "Currency": "AED",
            "UrlAmount": "https://api.tpp1.com/webhook/callbackUrl", 4600
          },
          "IsActivePolicyHolderEmirates": falsetrue,
          "PreviousPolicy": {
    }        "PolicyReference": "8a43bab5-43d8-4525-b92d-840eff449ba5",
    }         }"Insurer": "AXA",
    ] }

4.3.2 The TPP updates a Webhook Subscription preference with the OFP

4.3.2.1 Request: Activate Webhook events

Code Block
PATCH /open-finance/account-information/v1.0-draft3/account-access-consents/aac-69255d98-ab0e-4758-92a7-cacbf3073efa HTTP/1.1
Host: rs1.lab.api.openbanking.ae
Content-Type: application/json
x-fapi-interaction-id: 3424a379-8274-4686-99bd-f420d08acead
Authorization: Bearer ad297304-1057-4c68-9e76-a96f300a27f1
{
  "Subscription": {
    "Webhook": {       "PolicyStartDateTime": "2023-05-01T00:00:00.000Z",
            "PolicyExpiryDateTime": "2024-04-31T23:59:59.999Z"
          }
       "IsActive": true },
    }   }
}

4.3.2.2 Response: Webhook events activated

Code Block
HTTP/1.1 204 No Content
x-fapi-interaction-id: 3424a379-8274-4686-99bd-f420d08acead

4.3.3 The TPP unsubscribes their Webhook Subscription with the OFP

4.3.3.1 Request: De-Activate Webhook events

Code Block
PATCH /open-finance/account-information/v1.0-draft3/account-access-consents/aac-69255d98-ab0e-4758-92a7-cacbf3073efa HTTP/1.1
Host: rs1.lab.api.openbanking.ae
Content-Type: application/json
x-fapi-interaction-id: 3424a379-8274-4686-99bd-f420d08acead
Authorization: Bearer ad297304-1057-4c68-9e76-a96f300a27f1
{
  "Subscription": {
    "Webhook": { "AddOns": {
          "DriversPersonalAccident": true,
          "PassengersPersonalAccident": true
        },
        "AdditionalInformation": {
          "FirstTimeRegistration": "true",
          "IsActiveVehicleMortgageAmount": false{
        }   }
}

4.3.3.2 Response: Webhook events de-activated

Code Block
HTTP/1.1 204 No Content
x-fapi-interaction-id: 3424a379-8274-4686-99bd-f420d08acead

4.3.4 The TPP receives data from the OFP (specific to the consent and permissions) via its Webhook

4.3.4.1 The OFP generates a Self Signed JWT Authorization Token for Client Authentication with the TPP.

This JWT Authorization Token MUST be set in the Authorization Header.

Code Block
{
  "alg": "PS256",
  "typ": "JOSE",
  "cty": "json",
  "kid":  "e1be6bf3-76e6-4e53-92b9-c46423757ab1"
}
.
{
 "iss": "https://openbanking.masrif-ahmar.ae",
 "sub": "e75c26bf-1682-401a-a227-ec125f6636ab",
 "aud": "https://api.tpp.com/webhook/callbackUrl",
 "exp": 1661378066,
 "iat": 1661378036,
 "nbf": 1661378036,
 "jti": "274aa39d-d77a-46a9-b832-b2ced47919dd"
}
.
<<signature>>

4.3.4.2 Request: OFP publishes signed/encrypted data to the registered Webhook Url provided by the TPP

The example below shows a signed and encrypted payload with the JWT Authorization Token set in the Authorization Header.

Code Block
POST /webhook/callbackUrl HTTP/1.1
Host: api.tpp.com
 "Currency": "AED",
            "Amount": 180000
          }
        }
      }
    },
    "Links": {
      "Self": "https://rs1.openfinanceplatform.ae/open-finance/insurance/v1.0-draft3/insurance-policies/176794ea-ee8c-4621-b824-b8cfa95db0ff"
    }
  }

4. Further Examples

4.1 The TPP Queries the Insurance Resource for the Status after a User has Authorized the Consent

4.1.1 Request: insurance-consents/{ConsentId} resource

Code Block
GET /open-finance/insurance/v1.0-draft3/insurance-consents/aac-1a672e83-d1e5-42bc-b8e1-60a490ec52fd HTTP/1.1
Host: rs1.openfinanceplatform.ae
Content-Type: application/json
x-fapi-interaction-id: 2e974f01-d111-4078-9a19-7a9b385e637c
Authorization: Bearer e6156449-6f27-4c42-aa5b-36602f73eac9

4.1.2 Response: insurance-consents/{ConsentId} resource

Code Block
HTTP/1.1 200 OK
Content-Type:application/json
x-fapi-interaction-id: 77b0e8302e974f01-b095d111-4c6c4078-94e89a19-20f83eaa799f
Content-Type: application/jwt
Date: Wed, 24 Aug 2022 07:28:00 AST
Authorization: Bearer eyJhbGciO9.eyJzdWImlhdCI6MTUxNjIzOTAyMn0.iOeN9eg

<<jwe>>

Here, <<jwe>> is a signed and encrypted payload. The inner JWS has the structure below:

Code Block
{
  "alg": "PS2567a9b385e637c
{
  "Data": {
    "ConsentId": "6a6a826f-0930-4eb0-b365-a8eac3032828",
    "CreationDateTime": "2024-06-27T15:27:13+0300",
    "Status": "Authorized",
    "kidStatusUpdateDateTime": "e1be6bf32024-76e6-4e53-92b9-c46423757ab1"
}
.
{06-27T16:27:13+0300",
    "Permissions": [
        "issReadInsurancePoliciesMotor":
"string",   "exp": 1664950125],
    "nbfExpirationDateTime": 1664950125"2024-03-28T15:27:13+030",
    "audPurpose": [
        "6uC8HSQ8C59SDSw43Cdm9YWxxjJmDVMotorInsuranceQuote"
    ],
  "iat": 1661378036},
  "messageSubscription": {
    "DataWebhook": {
      "AccountIdUrl": "f91d07d0-6d8f-4e0e-9fb4-0ac61f84d115https://api.tpp1.com/webhook/callbackUrl",
      "AccountIsActive": [
     false
  {  }
  },
  "Links": {
    "CurrencySelf": "AED"https://rs1.openfinanceplatform.ae/open-finance/insurance/v1.0-draft3/insurance-consents/6a6a826f-0930-4eb0-b365-a8eac3032828"
  },
  "Meta": {}
}

4.2 The TPP Requests the List of Insurance Policies Using an Expired Access Token

4.2.1 Request: insurance-policies collection

Code Block
GET /open-finance/insurance/v1.0-draft3/insurance-policies HTTP/1.1
Host: rs1.openfinanceplatform.ae
Content-Type:  "Status": "Active",          
          "AccountIdentifiers": [
            {
              "Name": "Account 1",
         application/json
x-fapi-interaction-id: 9a371b79-4e79-4d7d-a77d-380c528ab8c0
Authorization: Bearer caa1b60d-61ff-4cd8-a4e1-2d18c8696de0

4.2.2 Response: 401 Unauthorized

Code Block
HTTP/1.1 401 Unauthorized
Content-Type: application/json
x-fapi-interaction-id: 9a371b79-4e79-4d7d-a77d-380c528ab8c0

4.3 Webhooks

4.3.1 The TPP Creates an Insurance Consent Request with a Webhook Subscription

4.3.1.1 Request: Insurance Consent and Webhook Subscription

Code Block
{
    "typ": "JWT",
    "IdentificationTypealg": "UAEOF.IBANPS256",
              "Identification"kid": "00003130000001"
            e4ce77c498e77000a25aa7b40e4a83f9"
}
.
{
    "iss": "s6BhdRkqt3",
  ]  "iat": 1669393154,
     }"exp": 1669393496,
    "nbf": 1669393154,
]     }"aud": "https://server.example.com",
    "Linksresponse_type": {
"code",
     "Selfredirect_uri": "https://rs1openbanking.openfinanceplatformtpp1.ae/opensimple-finance/account-information/v1.0-draft3/accounts/f91d07d0-6d8f-4e0e-9fb4-0ac61f84d115"
    }redirect-url",
    "EventMetascope": {"insurance",
      "EventDateTimestate": "20222616df22-899e-08-24T07:28:00.556Z468b-b7af-927145b067cc",
 
    "EventResourceauthorization_details": "accounts",[
        {
    "EventType": "UAEOF.Resource.Created",       "ConsentIdType": "aac-1a672e83-d1e5-42bc-b8e1-60a490ec52fd"urn:openfinanceuae:insurance-consent:v1.0-draft3",
    }     } } .
<<signature>>

4.3.4.3 Response: TPP validates the Self Signed JWT Authorization Token from LFI, stores data, and acknowledges a successful response to the OFP

Code Block
HTTP/1.1 202 Accepted
x-fapi-interaction-id: 77b0e830-b095-4c6c-94e8-20f83eaa799f

4.3.5 Webhook Payload for a single resource collection associated with a single event type

The following non-normative example illustrates a OFP webhook payload for a collection of account ID transactions of the same event type: UAEOF.Resource.Created

Code Block
{
  "alg": "PS256",
  "kid": "e1be6bf3-76e6-4e53-92b9-c46423757ab1"
}
.
{
  "iss": "string",
  "exp": 1664950125,
  "nbf": 1664950125,
  "aud": [
    "6uC8HSQ8C59SDSw43Cdm9YWxxjJmDV"
  ],
  "iat": 1661378036,
  "message": {
    "Data "Consent": {
                "ConsentId": "6a6a826f-0930-4eb0-b365-a8eac3032828",
                "Permissions": [
                    "ReadInsurancePoliciesMotor"
                ],
                "ExpirationDateTime": "2024-03-28T15:27:13+030",
                "Purpose": [
                    "MotorInsuranceQuote"
                ]
            },
            "Subscription": {
      "AccountId": "f91d07d0-6d8f-4e0e-9fb4-0ac61f84d115",          "TransactionWebhook": {
[         {           "TransactionIdUrl": "668f2fc8-7aa8-411b-bb9f-7571a90e7512https://api.tpp1.com/webhook/callbackUrl",
          "TransactionReference": "1852efce-bedc-4fda-ba51-0f76c9137f91",          "IsActive": false
                "CreditDebitIndicator": "Debit",}
           "Status": "Booked", }
        }
 "TransactionMutability": "",  ]
}

4.3.2 The TPP updates a Webhook Subscription preference with the OFP

4.3.2.1 Request: Activate Webhook events

Code Block
PATCH /open-finance/insurance/v1.0-draft3/insurance-consents/aac-69255d98-ab0e-4758-92a7-cacbf3073efa HTTP/1.1
Host: rs1.lab.api.openbanking.ae
Content-Type:    "BookingDateTime": "2022-08-24T07:27:00.556Z",
          "ValueDateTime": "2022-08-24T07:27:00.556Z",
     application/json
x-fapi-interaction-id: 3424a379-8274-4686-99bd-f420d08acead
Authorization: Bearer ad297304-1057-4c68-9e76-a96f300a27f1
{
  "Subscription": {
    "TransactionInformationWebhook": "Foo{
Group ",     "IsActive": true
    "Amount":}
{  }
}

4.3.2.2 Response: Webhook events activated

Code Block
HTTP/1.1 204 No Content
      "Amount": "41.10",
            "Currency": "AED"
          },
          "BankTransactionCodex-fapi-interaction-id: 3424a379-8274-4686-99bd-f420d08acead

4.3.3 The TPP unsubscribes their Webhook Subscription with the OFP

4.3.3.1 Request: De-Activate Webhook events

Code Block
PATCH /open-finance/insurance/v1.0-draft3/insurance-consents/aac-69255d98-ab0e-4758-92a7-cacbf3073efa HTTP/1.1
Host: rs1.lab.api.openbanking.ae
Content-Type: application/json
x-fapi-interaction-id: 3424a379-8274-4686-99bd-f420d08acead
Authorization: Bearer ad297304-1057-4c68-9e76-a96f300a27f1
{
  "Subscription": {
    "Webhook": {
      "CodeIsActive": "CustomerCardTransactions",false
    }
       "SubCode": "CashWithdrawal"
          },
          "ProprietaryBankTransactionCode": {
            "Code": ""
          }
        },
        {
          "TransactionId": "05b6bfde-ce5a-48e1-a448-66d75518f1e8",
          "TransactionReference": "b5a6a869-730f-449d-badf-14ebf3980147",
          "CreditDebitIndicator": "Debit",
          "Status": "Booked",
          "TransactionMutability": "",
          "BookingDateTime": "2022-08-24T07:28:00.556Z",
          "ValueDateTime": "2022-08-24T07:28:00.556Z",
          "TransactionInformation": "Bar Holding",
          "Amount": {
            "Amount": "32.40",
            "Currency": "AED"
          },
          "BankTransactionCode": {
            "Code": "CustomerCardTransactions",
     }
}

4.3.3.2 Response: Webhook events de-activated

Code Block
HTTP/1.1 204 No Content
x-fapi-interaction-id: 3424a379-8274-4686-99bd-f420d08acead

4.3.4 The TPP receives data from the OFP (specific to the consent and permissions) via its Webhook

4.3.4.1 The OFP generates a Self Signed JWT Authorization Token for Client Authentication with the TPP.

This JWT Authorization Token MUST be set in the Authorization Header.

Code Block
{
  "alg": "PS256",
  "typ": "JOSE",
  "cty": "json",
  "kid":  "e1be6bf3-76e6-4e53-92b9-c46423757ab1"
}
.
{
 "iss": "https://openbanking.masrif-ahmar.ae",
 "sub": "e75c26bf-1682-401a-a227-ec125f6636ab",
 "aud": "https://api.tpp.com/webhook/callbackUrl",
 "exp": 1661378066,
 "iat": 1661378036,
 "nbf": 1661378036,
 "jti": "274aa39d-d77a-46a9-b832-b2ced47919dd"
}
.
<<signature>>

4.3.4.2 Request: OFP publishes signed/encrypted data to the registered Webhook Url provided by the TPP

The example below shows a signed and encrypted payload with the JWT Authorization Token set in the Authorization Header.

Code Block
POST /webhook/callbackUrl HTTP/1.1
Host: api.tpp.com
x-fapi-interaction-id: 77b0e830-b095-4c6c-94e8-20f83eaa799f
Content-Type: application/jwt
Date: Wed, 24 Aug 2022 07:28:00 AST
Authorization: Bearer eyJhbGciO9.eyJzdWImlhdCI6MTUxNjIzOTAyMn0.iOeN9eg

<<jwe>>

Here, <<jwe>> is a signed and encrypted payload. The JWS encapsulated by the JWE has the structure below:

Code Block
{
  "alg": "PS256",
  "kid": "e1be6bf3-76e6-4e53-92b9-c46423757ab1"
}
.
{
  "iss": "string",
  "exp": 1664950125,
  "nbf": 1664950125,
  "aud": [
    "6uC8HSQ8C59SDSw43Cdm9YWxxjJmDV"
  ],
  "iat": 1661378036,
  "message": {
    "Data": {
      "SubCodePolicyType": "CashWithdrawalMotor",
          },"PolicyDetails": {
          "ProprietaryBankTransactionCodeInsurancePolicyId": {"176794ea-ee8c-4621-b824-b8cfa95db0ff",
            "CodeCustomerId": ""
  dcaaef9c-63cb-4c57-9f2a-a4986c4a958e",
       }  ...
      }
   
  ]     },
    "Links": {
      "Self": "https://rs1.openfinanceplatform.ae/open-finance/account-informationinsurance/v1.0-draft3/accountsinsurance-policies/f91d07d0176794ea-6d8fee8c-4e0e4621-9fb4b824-0ac61f84d115/transactionsb8cfa95db0ff"
    },
    "EventMeta": {
      "EventDateTime": "2022-08-24T0824T07:28:00.556Z",
      "EventResource": "transactionsinsurance-policies",
      "EventType": "UAEOF.Resource.CreatedUpdated",
      "ConsentId": "aac6a6a826f-1a672e830930-d1e54eb0-42bcb365-b8e1-60a490ec52fda8eac3032828"
    }
 
}
}
.
<<signature>>

5. OpenAPI Specification

See the Bank Data API - Swagger page

6. Notes

  • IBAN

    • Where Data.Account.AccountIdentifiers[].IdentificationType is UAEOF.IBAN, the Identification field SHOULD contain the full IBAN

  • Passport, Driving Permit, IDCard, Residence Permit

    • Where Data.Party.VerifiedClaims.[].Verification.Evidence[DocumentDetails.Type] is set to any one of these enumerated values, then the DocumentNumber field SHOULD contain the actual number of the document type specified.

  • ProprietaryBankTransactionCodes

    • This code is mandatory when the BenefeciaryCode with code specifying the Domain, Family, and SubFamily as per External Codes ISO20022 is absent. This code is a proprietary code from the LFI and does not have a defined code list.

7. Security

...

  }
}
.
<<signature>>

4.3.4.3 Response: TPP validates the Self Signed JWT Authorization Token from LFI, stores data, and acknowledges a successful response to the OFP

Code Block
HTTP/1.1 202 Accepted
x-fapi-interaction-id: 77b0e830-b095-4c6c-94e8-20f83eaa799f

5. OpenAPI Specification

See the Insurance API - OpenAPI Documentation page.

6. Security

A insurance scope is used for accessing the account information insurance endpoints.