Page Information

    Page: Will Event API calls between the API Hub and the LFI be secured with JWT?
    Page: What are the customer endpoints in the Ozone Connect Specifications used for?
    Page: How will data be secured during transit over the internet between the API Hub and LFI?
    Page: Can the API Hub support IP Whitelisting?
    Page: How is data stored at rest in the API Hub?
    Page: What version of Transport Layer Security (TLS) does the API Hub implement?
    Page: Is the Health Check API mandatory?
    Page: Is an identifier for a customer sent as part of the Pushed Authorization Request?
    Page: Is access to the API Hub restricted to users in the UAE?
    Page: Where are the Discovery Endpoints hosted?
    Page: Can the Ozone Connect Testing Tool be used without certificates?
    Page: Can an LFI be notified when a given consent changes?
    Page: Where can I find more information about JWT Auth for API Hub Integration APIs?
    Page: What is the process of certification for TPP?
    Page: What is the process of certification for LFI?
    Page: What are the SLAs for an a API response and how does it split between the API Hub and the LFI?
    Page: What is the difference between request and consent body in the Consent Manager (CM) specification?
    Page: What are the delivery timelines for the LFIs?
    Page: Can the Consent Manager be used to manage consents that are outside of Open Finance Ecosystem?
    Page: What is the format/standard for the Bulk/Batch payment report file?
    Page: If a Customer has already authenticated, should they be forced to authenticate again to authorise consent?
    Page: What is the format / standard for the payment report file?
    Page: When a payment instruction has yet to complete, what HTTP status code should be returned from Ozone Connect?
    Page: When a TPP redirects a User to an LFI, how will the URL be constructed?
    Page: Who undertakes the Online Certificate Status Protocol (OCSP) checks for revocation?
    Page: Does data returned in an API response need to be sorted in a specific order?
    Page: What options are available for application layer security?
    Page: How are Organization Administrators Defined when the LFI is registered on the OFTF
    Page: What happens if the Organization Administrator leaves the company? How a New Admin can be Nominated.
    Page: How can I add a Technical User to the Platform?
    Page: Who should sign the Terms & Conditions Document?
    Page: How Many Legal Representatives should be configured when issuing the Open Finance Terms & Conditions Document?
    Page: Why do I receive an error when uploading the CSR during certificate generation?
    Page: Why is the Trust Framework not accepting my TOTP during account registration?
    Page: Why am I receiving notifications about admins or users being added to the platform?
    Page: Why am I receiving a 401 error when calling the Trust Framework APIs?
    Page: What is the redirect_uri that is required when creating an application?
    Page: How do you add contacts to your organization in the participant Trust Framework?
    Page: What information should I provide when registering a contact?
    Page: What is a technical user in the participant Trust Framework?
    Page: How do you validate your information during the registration process?
    Page: How can a user reset their OTP in case you lose or change your mobile device during the registration process?
    Page: What should be done if a user cannot access the Trust Framework even after registering itself?
    Page: What steps should be taken if a user receives an error message stating they need to be an active user in the Trust Framework?
    Page: What steps should be followed if a user cannot create an account due to an error?
    Page: How can an LFI discover Third Party Providers (TPPs) within the Trust Framework?
    Page: How can an LFI define which TPPs it should accept?
    Page: Who is capable of accessing information about Administrators and Technical Users?
    Page: When Registering a new Application, what is the use of mtls_endpoint_aliases in the Trust Framework?
    Page: When Registering a new Application, what is the token_endpoint_auth_method in the CBUAE ecosystem?
    Page: When Registering a new Application, what are authorization_detail_types in the Trust Framework?
    Page: When Accessing the Trust Framework U.I. and APis i'm receiving a 403 - Forbidden Error
    Page: When Accessing the Trust Framework U.I. i'm receiving a Session Expired/Not Found Error
    Page: Failure to Load TF U.I. when using a VPN
    Page: Why can't I find an API Family on the Trust Framework's dropdown list when attempting to register?
    Page: What is the difference between PaymentId and PaymentTransactionId attributes.
    Page: What is the purpose of "status" and "consentBody.Data.Status" on the Consent body?
    Page: What is an example of a data cluster that does NOT require a customer to select an account before authorisation?
    Page: Will reports from the admin portal be available via APIs?
    Page: What are the field size limits for Ozone Connect headers or body parameters?
    Page: Should the LFI's Open Finance channel provide a similar feature set than the existing digital channels?
    Page: When will domains be confirmed?
    Page: Is there a list of validations undertaken by the API Hub?
    Page: How long is an authorization code valid for?
    Page: Can a Future Dated Payment be cancelled by revoking the consent?
    Page: Who is responsible for performing a balance check?
    Page: What verified claims data do we provide in the get /customer operation?
    Page: Can the accounts associated with a data sharing consent be changed at the LFI?
    Page: Does the API Hub throttle requests?
    Page: Does an LFI need to validate an Authorization Request before invoking the getAuth operation?
    Page: Could you clarify the testing process and documentation, including details on postman scripts, success criteria, quality gates, and promotion phases?
    Page: What is the requirement for notifications ahead of VRP and future payments?
    Page: Clarify payment journey diagram for incoming and outgoing Payments with required response timelines
    Page: Is it possible to have two connections -one for WholeSale and other for Retail customers at the Ozone layer as the fulfillment journeys are different for the customers? Will there be any impact on the contribution fee payment if, there are 2 connection?
    Page: Share list of account which are in scope as per regulation. Confirm if overdraft accounts / dormant accounts / unclaimed accounts are in scope.
    Page: Share Nebras Article of Association, Liability Framework and T&Cs.
    Page: Confirm if jailbroken devices (RASP) info is included in the Risk block and the action required from TPPs if customer triggers a consent request.
    Page: Under get beneficiary API, what does activated and not activated enums mean?
    Page: Confirm the log captured at OFP can be shared with LFI.
    Page: What is the pricing model and how the yearly fees will change over time.
    Page: Are there any logs of unauthorized attempts by TPP to get access to consent/data?
    Page: Do we have any controls or tools to prevent DDoS-type attacks that can be triggered by TPP apps?
    Page: Do we also need frontline / RCC screens to access customer consents and revoke them in case of a fraud notification from a customer?
    Page: Can LFI download the LFI reports through of API Hub Admin portal?
    Page: Using a unique, surrogate identifier instead of a domestic account number or IBAN in APIs
    Page: What are the Primary Business Contact Role and Responsibilities?
    Page: Is it required to sign T&C to onboard to Open Finance platform?
    Page: Is it necessary to publish two authorization servers if LFI wish to trigger different user authentication journeys for Retail and Wholesale?
    Page: Does the API Hub share any headers to identify a customer is Retail or Wholesale.
    Page: Is it mandatory to call GET/auth and GET/consent api before SCA begins?
    Page: What is the difference between request and consentBody for the consent manager payload?
    Page: Will Ozone be a registered entity on the OFTF?
    Page: What client authentication profiles does CBUAE support?
    Page: Should service initiation operations in Ozone Connect implement idempotency keys?
    Page: How are Virtual IBANs (VIBANs) supported by the Open Finance Framework?
    Page: Is data ever stored in or transmitted to/from the API Hub in an un-encrypted format?
    Page: What is the trust framework privacy policy?
    Page: How many servers should an LFI create within the Trust Framework?
    Page: Can an LFI test its TPP applications in a pre-production environment?
    Page: What are the requirements for an LFI to gain access to OFTF production after being granted access to the OFTF sandbox?
    Page: What roles Primary and Secondary Technical Contacts (PTC / STC) have at the Trust Framework
    Page: When Registering an Account at the OFTF my Country Code is not displayed on the Drop Down List
    Page: Will there be any networking requirements to access the API Hub?
    Page: Can a TPP call the get /accounts operation when granted permission through a payment initiation consent?
    Page: How does a TPP send the IBAN for the debtor and creditor account to the LFI?
    Page: Are unauthorized connection attempts logged by the API Hub and provided in LFI Reports?
    Page: Are we allowed to request the Identity and Accounts permissions irrespective of the merchant use case so that we can perform required transaction monitoring?
    Page: What are the allowed methods of obtaining geolocation data to comply with TPP obligations?
    Page: Do we need to do any automated KYB process for our customers? Or will the KYB process that we will have outlined as part of our application process be sufficient?
    Page: What is the definition of Customer Present? Is a user on session considered to be present?
    Page: Servicer field definition in Ozone Connect API
    Page: What are the value limits for supported payment types?
    Page: Is PII payload data encryption in place when customer data is shared by the LFI back to the OFP and then to the TPP?
    Page: How are users identified within the PBC, SBC, and PTC roles, and how do access levels change based on their role?
    Page: Why am I unable to add details under the Domain tab?
    Page: How should PII be encrypted using JSON Web Encryption (JWE)?
    Page: How is the customer IP Address transmitted?
    Page: How is the Debtor Account sent to the LFI by the TPP?
    Page: Can TPPs retrieve any details other than payment ID and status about a transaction after it’s been processed?
    Page: How does the TPP get information about the accounts the user gave consent to?
    Page: How long is a Pushed Authorization Request valid for before it expires?
    Page: Where is all the Debtor related information for Delegated Authentication?
    Page: How does an LFI identify an International Payment Consent?
    Page: How to link Consents?
    Page: How Does A Receiving LFI Identify Open Finance Payments?
    Page: Can LFIs used Risk Information for retrospective profiling of payment initiation requests?
    Page: How should LFIs check for duplicate payments?
    Page: How do LFIs identify Shariah-compliant TPPs?
    Page: What can a PBC, PTC and STC do in the ecosystem?
    Page: TPP and User Events to Agree to Initiate Payments
    Page: Why do I encounter errors when generating a CSR for certificate creation?
    Page: What are the requirements for management and communication of fraud notifications?
    Page: How can I verify if my certificates are currently active on the Trust Framework
    Page: How can a TPP create an App certificate?
    Page: Customer T&Cs changes - LFIs
    Page: How can a participant retrieve a list of active LFIs on Sandbox and Production?

View Page History