{"swagger":"2.0","info":{"title":"Open Bank Project API","description":"An Open Source API for Banks. (c) TESOBE GmbH. 2011 - 2024. Licensed under the AGPL and commercial licences.","contact":{"name":"TESOBE GmbH. / Open Bank Project","url":"https://openbankproject.com","email":"contact@tesobe.com"},"version":"v4.0.0"},"host":"apisandbox.openbankproject.com","basePath":"/","schemes":["http","https"],"securityDefinitions":{"directLogin":{"type":"apiKey","description":"https://github.com/OpenBankProject/OBP-API/wiki/Direct-Login","in":"header","name":"Authorization"},"gatewayLogin":{"type":"apiKey","description":"https://github.com/OpenBankProject/OBP-API/wiki/Gateway-Login","in":"header","name":"Authorization"}},"security":[{"directLogin":[],"gatewayLogin":[]}],"paths":{"/obp/v4.0.0/banks/{BANK_ID}/entitlements":{"get":{"tags":["Role","Entitlement","User"],"summary":"Get Entitlements for One Bank","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"
Authentication is Mandatory
","operationId":"getEntitlementsForBank","parameters":[{"in":"path","name":"BANK_ID","description":"The bank id","required":true,"type":"string"}],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/EntitlementsJsonV400"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/banks/{BANK_ID}/users/{USER_ID}/entitlements":{"get":{"tags":["Role","Entitlement","User"],"summary":"Get Entitlements for User at Bank","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Get Entitlements specified by BANK_ID and USER_ID
Authentication is Mandatory
","operationId":"getEntitlementsByBankAndUser","parameters":[{"in":"body","name":"body","description":"EmptyClassJson object that needs to be added.","required":true,"schema":{"$ref":"#/definitions/EmptyClassJson"}},{"in":"path","name":"USER_ID","description":"The user id","required":true,"type":"string"},{"in":"path","name":"BANK_ID","description":"The bank id","required":true,"type":"string"}],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/EntitlementJSONs"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/entitlement-requests":{"get":{"tags":["Role","Entitlement","User"],"summary":"Get all Entitlement Requests","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Get all Entitlement Requests
Authentication is Mandatory
","operationId":"getAllEntitlementRequests","parameters":[],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/EntitlementRequestsJSON"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}},"post":{"tags":["Role","Entitlement","User"],"summary":"Create Entitlement Request for current User","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Create Entitlement Request.
Any logged in User can use this endpoint to request an Entitlement
Entitlements are used to grant System or Bank level roles to Users. (For Account level privileges, see Views)
For a System level Role (.e.g CanGetAnyUser), set bank_id to an empty string i.e. "bank_id":""
For a Bank level Role (e.g. CanCreateAccount), set bank_id to a valid value e.g. "bank_id":"my-bank-id"
Authentication is Mandatory
","operationId":"addEntitlementRequest","parameters":[{"in":"body","name":"body","description":"CreateEntitlementJSON object that needs to be added.","required":true,"schema":{"$ref":"#/definitions/CreateEntitlementJSON"}}],"responses":{"201":{"description":"Success","schema":{"$ref":"#/definitions/EntitlementRequestJSON"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/entitlement-requests/{ENTITLEMENT_REQUEST_ID}":{"delete":{"tags":["Role","Entitlement","User"],"summary":"Delete Entitlement Request","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Delete the Entitlement Request specified by ENTITLEMENT_REQUEST_ID for a user specified by USER_ID
Authentication is Mandatory
","operationId":"deleteEntitlementRequest","parameters":[{"in":"path","name":"ENTITLEMENT_REQUEST_ID","description":"the entitlement request id","required":true,"type":"string"}],"responses":{"204":{"description":"Success"},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/entitlements":{"get":{"tags":["Role","Entitlement"],"summary":"Get all Entitlements","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Login is required.
Possible filter on the role field:
eg: /entitlements?role=CanGetCustomer
Authentication is Mandatory
","operationId":"getAllEntitlements","parameters":[],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/EntitlementJSONs"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/my/entitlement-requests":{"get":{"tags":["Role","Entitlement","User"],"summary":"Get Entitlement Requests for the current User","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Get Entitlement Requests for the current User.
Authentication is Mandatory
","operationId":"getEntitlementRequestsForCurrentUser","parameters":[],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/EntitlementRequestsJSON"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/my/entitlements":{"get":{"tags":["Role","Entitlement","User"],"summary":"Get Entitlements for the current User","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Get Entitlements for the current User.
Authentication is Mandatory
","operationId":"getEntitlementsForCurrentUser","parameters":[],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/EntitlementJSONs"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/roles":{"get":{"tags":["Role"],"summary":"Get Roles","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Returns all available roles
Authentication is Mandatory
","operationId":"getRoles","parameters":[{"in":"body","name":"body","description":"EmptyClassJson object that needs to be added.","required":true,"schema":{"$ref":"#/definitions/EmptyClassJson"}}],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/AvailableRolesJSON"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/user-entitlements":{"post":{"tags":["Role","Entitlement","User","DAuth"],"summary":"Create (DAuth) User with Roles","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"This endpoint is used as part of the DAuth solution to grant Entitlements for Roles to a smart contract on the blockchain.
Put the smart contract address in username
For provider use "dauth"
This endpoint will create the User with username and provider if the User does not already exist.
Then it will create Entitlements i.e. grant Roles to the User.
Entitlements are used to grant System or Bank level roles to Users. (For Account level privileges, see Views)
i.e. Entitlements are used to create / consume system or bank level resources where as views / account access are used to consume / create customer level resources.
For a System level Role (.e.g CanGetAnyUser), set bank_id to an empty string i.e. "bank_id":""
For a Bank level Role (e.g. CanCreateAccount), set bank_id to a valid value e.g. "bank_id":"my-bank-id"
Note: The Roles actually granted will depend on the Roles that the calling user has.
If you try to grant Entitlements to a user that already exist (duplicate entitilements) you will get an error.
For information about DAuth see below:
DAuth is an experimental authentication mechanism that aims to pin an ethereum or other blockchain Smart Contract to an OBP "User".
In the future, it might be possible to be more specific and pin specific actors (wallets) that are acting within the smart contract, but so far, one smart contract acts on behalf of one User.
Thus, if a smart contract "X" calls the OBP API using the DAuth header, OBP will get or create a user called X and the call will proceed in the context of that User "X".
DAuth is invoked by the REST client (caller) including a specific header (see step 3 below) in any OBP REST call.
When OBP receives the DAuth token, it creates or gets a User with a username based on the smart_contract_address and the provider based on the network_name. The combination of username and provider is unique in OBP.
If you are calling OBP-API via an API3 Airnode, the Airnode will take care of constructing the required header.
When OBP detects a DAuth header / token it first checks if the Consumer is allowed to make such a call. OBP will validate the Consumer ip address and signature etc.
Note: The DAuth flow does not require an explicit POST like Direct Login to create the token.
Permissions may be assigned to an OBP User at any time, via the UserAuthContext, Views, Entitlements to Roles or Consents.
Note: DAuth is NOT enabled on this instance!
Note: The DAuth client is responsible for creating a token which will be trusted by OBP absolutely!
To use DAuth:
Set up properties in your props file
# -- DAuth --------------------------------------# Define secret used to validate JWT token# jwt.public_key_rsa=path-to-the-pem-file# Enable/Disable DAuth communication at all# In case isn't defined default value is false# allow_dauth=false# Define comma separated list of allowed IP addresses# dauth.host=127.0.0.1# -------------------------------------- DAuth--
Please keep in mind that property jwt.public_key_rsa is used to validate JWT token to check it is not changed or corrupted during transport.
The following videos are available:
* DAuth in local environment
HEADER:ALGORITHM & TOKEN TYPE
{ "alg": "RS256", "typ": "JWT"}
PAYLOAD:DATA
{ "smart_contract_address": "0xe123425E7734CE288F8367e1Bb143E90bb3F051224", "network_name": "AIRNODE.TESTNET.ETHEREUM", "msg_sender": "0xe12340927f1725E7734CE288F8367e1Bb143E90fhku767", "consumer_key": "0x1234a4ec31e89cea54d1f125db7536e874ab4a96b4d4f6438668b6bb10a6adb", "timestamp": "2021-11-04T14:13:40Z", "request_id": "0Xe876987694328763492876348928736497869273649"}
VERIFY SIGNATURE
RSASHA256( base64UrlEncode(header) + "." + base64UrlEncode(payload),) your-RSA-key-pair
Here is an example token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzbWFydF9jb250cmFjdF9hZGRyZXNzIjoiMHhlMTIzNDI1RTc3MzRDRTI4OEY4MzY3ZTFCYjE0M0U5MGJiM0YwNTEyMjQiLCJuZXR3b3JrX25hbWUiOiJFVEhFUkVVTSIsIm1zZ19zZW5kZXIiOiIweGUxMjM0MDkyN2YxNzI1RTc3MzRDRTI4OEY4MzY3ZTFCYjE0M0U5MGZoa3U3NjciLCJjb25zdW1lcl9rZXkiOiIweDEyMzRhNGVjMzFlODljZWE1NGQxZjEyNWRiNzUzNmU4NzRhYjRhOTZiNGQ0ZjY0Mzg2NjhiNmJiMTBhNmFkYiIsInRpbWVzdGFtcCI6IjIwMjEtMTEtMDRUMTQ6MTM6NDBaIiwicmVxdWVzdF9pZCI6IjBYZTg3Njk4NzY5NDMyODc2MzQ5Mjg3NjM0ODkyODczNjQ5Nzg2OTI3MzY0OSJ9.XSiQxjEVyCouf7zT8MubEKsbOBZuReGVhnt9uck6z6k
Using your favorite http client:
GET https://apisandbox.openbankproject.com/obp/v3.0.0/users/current
Body
Leave Empty!
Headers:
DAuth: your-jwt-from-step-above
Here is it all together:
GET https://apisandbox.openbankproject.com/obp/v3.0.0/users/current HTTP/1.1
Host: localhost:8080
User-Agent: curl/7.47.0
Accept: /
DAuth: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzbWFydF9jb250cmFjdF9hZGRyZXNzIjoiMHhlMTIzNDI1RTc3MzRDRTI4OEY4MzY3ZTFCYjE0M0U5MGJiM0YwNTEyMjQiLCJuZXR3b3JrX25hbWUiOiJFVEhFUkVVTSIsIm1zZ19zZW5kZXIiOiIweGUxMjM0MDkyN2YxNzI1RTc3MzRDRTI4OEY4MzY3ZTFCYjE0M0U5MGZoa3U3NjciLCJjb25zdW1lcl9rZXkiOiIweDEyMzRhNGVjMzFlODljZWE1NGQxZjEyNWRiNzUzNmU4NzRhYjRhOTZiNGQ0ZjY0Mzg2NjhiNmJiMTBhNmFkYiIsInRpbWVzdGFtcCI6IjIwMjEtMTEtMDRUMTQ6MTM6NDBaIiwicmVxdWVzdF9pZCI6IjBYZTg3Njk4NzY5NDMyODc2MzQ5Mjg3NjM0ODkyODczNjQ5Nzg2OTI3MzY0OSJ9.XSiQxjEVyCouf7zT8MubEKsbOBZuReGVhnt9uck6z6k
CURL example
curl -v -H 'DAuth: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzbWFydF9jb250cmFjdF9hZGRyZXNzIjoiMHhlMTIzNDI1RTc3MzRDRTI4OEY4MzY3ZTFCYjE0M0U5MGJiM0YwNTEyMjQiLCJuZXR3b3JrX25hbWUiOiJFVEhFUkVVTSIsIm1zZ19zZW5kZXIiOiIweGUxMjM0MDkyN2YxNzI1RTc3MzRDRTI4OEY4MzY3ZTFCYjE0M0U5MGZoa3U3NjciLCJjb25zdW1lcl9rZXkiOiIweDEyMzRhNGVjMzFlODljZWE1NGQxZjEyNWRiNzUzNmU4NzRhYjRhOTZiNGQ0ZjY0Mzg2NjhiNmJiMTBhNmFkYiIsInRpbWVzdGFtcCI6IjIwMjEtMTEtMDRUMTQ6MTM6NDBaIiwicmVxdWVzdF9pZCI6IjBYZTg3Njk4NzY5NDMyODc2MzQ5Mjg3NjM0ODkyODczNjQ5Nzg2OTI3MzY0OSJ9.XSiQxjEVyCouf7zT8MubEKsbOBZuReGVhnt9uck6z6k' https://apisandbox.openbankproject.com/obp/v3.0.0/users/current
You should receive a response like:
{ "user_id": "4c4d3175-1e5c-4cfd-9b08-dcdc209d8221", "email": "", "provider_id": "0xe123425E7734CE288F8367e1Bb143E90bb3F051224", "provider": "ETHEREUM", "username": "0xe123425E7734CE288F8367e1Bb143E90bb3F051224", "entitlements": { "list": [] }}
The file, dauth.scala handles the DAuth,
We:
-> Check if Props allow_dauth is true -> Check if DAuth header exists -> Check if getRemoteIpAddress is OK -> Look for "token" -> parse the JWT token and getOrCreate the user -> get the data of the user
Parameter names and values are case sensitive.
Each parameter MUST NOT appear more than once per request.
Authentication is Mandatory
","operationId":"createUserWithRoles","parameters":[{"in":"body","name":"body","description":"PostCreateUserWithRolesJsonV400 object that needs to be added.","required":true,"schema":{"$ref":"#/definitions/PostCreateUserWithRolesJsonV400"}}],"responses":{"201":{"description":"Success","schema":{"$ref":"#/definitions/EntitlementsJsonV400"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/users/{USER_ID}/entitlement-requests":{"get":{"tags":["Role","Entitlement","User"],"summary":"Get Entitlement Requests for a User","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Get Entitlement Requests for a User.
Authentication is Mandatory
","operationId":"getEntitlementRequests","parameters":[{"in":"path","name":"USER_ID","description":"The user id","required":true,"type":"string"}],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/EntitlementRequestsJSON"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/users/{USER_ID}/entitlement/{ENTITLEMENT_ID}":{"delete":{"tags":["Role","User","Entitlement"],"summary":"Delete Entitlement","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Delete Entitlement specified by ENTITLEMENT_ID for an user specified by USER_ID
Authentication is required and the user needs to be a Super Admin.
Super Admins are listed in the Props file.
Authentication is Mandatory
","operationId":"deleteEntitlement","parameters":[{"in":"body","name":"body","description":"EmptyClassJson object that needs to be added.","required":true,"schema":{"$ref":"#/definitions/EmptyClassJson"}},{"in":"path","name":"ENTITLEMENT_ID","description":"The entitblement id","required":true,"type":"string"},{"in":"path","name":"USER_ID","description":"The user id","required":true,"type":"string"}],"responses":{"204":{"description":"Success","schema":{"$ref":"#/definitions/EmptyClassJson"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}},"/obp/v4.0.0/users/{USER_ID}/entitlements":{"get":{"tags":["Role","Entitlement","User"],"summary":"Get Entitlements for User","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Authentication is Mandatory
","operationId":"getEntitlements","parameters":[{"in":"path","name":"USER_ID","description":"The user id","required":true,"type":"string"}],"responses":{"200":{"description":"Success","schema":{"$ref":"#/definitions/EntitlementsJsonV400"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}},"post":{"tags":["Role","Entitlement","User"],"summary":"Add Entitlement for a User","security":[{"directLogin":[],"gatewayLogin":[]}],"description":"Create Entitlement. Grant Role to User.
Entitlements are used to grant System or Bank level roles to Users. (For Account level privileges, see Views)
For a System level Role (.e.g CanGetAnyUser), set bank_id to an empty string i.e. "bank_id":""
For a Bank level Role (e.g. CanCreateAccount), set bank_id to a valid value e.g. "bank_id":"my-bank-id"
Authentication is required and the user needs to be a Super Admin. Super Admins are listed in the Props file.
Authentication is Mandatory
","operationId":"addEntitlement","parameters":[{"in":"body","name":"body","description":"CreateEntitlementJSON object that needs to be added.","required":true,"schema":{"$ref":"#/definitions/CreateEntitlementJSON"}},{"in":"path","name":"USER_ID","description":"The user id","required":true,"type":"string"}],"responses":{"201":{"description":"Success","schema":{"$ref":"#/definitions/EntitlementJSON"}},"400":{"description":"Error","schema":{"$ref":"#/definitions/ErrorUserNotLoggedIn"}}}}}},"definitions":{"ErrorUserNotLoggedIn":{"properties":{"message":{"type":"string","example":"OBP-20001: User not logged in. Authentication is required!"}}},"PostCreateUserWithRolesJsonV400":{"required":["username","provider","roles"],"properties":{"username":{"type":"string","example":"felixsmith"},"provider":{"type":"string","example":"dauth.ETHEREUM"},"roles":{"type":"array","items":{"$ref":"#/definitions/CreateEntitlementJSON"}}}},"AvailableRolesJSON":{"required":["roles"],"properties":{"roles":{"type":"array","items":{"$ref":"#/definitions/AvailableRoleJSON"}}}},"EntitlementRequestsJSON":{"required":["entitlement_requests"],"properties":{"entitlement_requests":{"type":"array","items":{"$ref":"#/definitions/EntitlementRequestJSON"}}}},"CreateEntitlementJSON":{"required":["bank_id","role_name"],"properties":{"bank_id":{"type":"string","example":"gh.29.uk"},"role_name":{"type":"string","example":"CanCreateBranch"}}},"EntitlementJsonV400":{"required":["entitlement_id","role_name","bank_id","user_id"],"properties":{"entitlement_id":{"type":"string","example":""},"role_name":{"type":"string","example":""},"bank_id":{"type":"string","example":"gh.29.uk"},"user_id":{"type":"string","example":"9ca9a7e4-6d02-40e3-a129-0b2bf89de9b1"}}},"UserJsonV200":{"required":["provider","email","username","provider_id","user_id","entitlements"],"properties":{"provider":{"type":"string","example":"http://127.0.0.1:8080"},"email":{"type":"string","example":"felixsmith@example.com"},"username":{"type":"string","example":"felixsmith"},"provider_id":{"type":"string","example":"Chris"},"user_id":{"type":"string","example":"9ca9a7e4-6d02-40e3-a129-0b2bf89de9b1"},"entitlements":{"$ref":"#/definitions/EntitlementJSONs"}}},"AvailableRoleJSON":{"required":["role","requires_bank_id"],"properties":{"role":{"type":"string","example":"CanCreateBranch"},"requires_bank_id":{"type":"boolean","example":"true"}}},"EntitlementsJsonV400":{"required":["list"],"properties":{"list":{"type":"array","items":{"$ref":"#/definitions/EntitlementJsonV400"}}}},"EntitlementJSONs":{"required":["list"],"properties":{"list":{"type":"array","items":{"$ref":"#/definitions/EntitlementJSON"}}}},"EntitlementRequestJSON":{"required":["entitlement_request_id","role_name","bank_id","user","created"],"properties":{"entitlement_request_id":{"type":"string","example":"6fb17583-1e49-4435-bb74-a14fe0996723"},"role_name":{"type":"string","example":"CanQueryOtherUser"},"bank_id":{"type":"string","example":"gh.29.uk"},"user":{"$ref":"#/definitions/UserJsonV200"},"created":{"type":"string","format":"date","example":"1100-01-01T00:00:00Z"}}},"EntitlementJSON":{"required":["entitlement_id","role_name","bank_id"],"properties":{"entitlement_id":{"type":"string","example":"6fb17583-1e49-4435-bb74-a14fe0996723"},"role_name":{"type":"string","example":"CanQueryOtherUser"},"bank_id":{"type":"string","example":"gh.29.uk"}}},"EmptyClassJson":{"required":["jsonString"],"properties":{"jsonString":{"type":"string","example":"{}"}}}}}