basePath: /corporate/
definitions:
  AccessAgreementListResponse:
    description: Agreements available response.
    properties:
      group_header:
        $ref: '#/definitions/ResponseHeader'
        description: Standard format response header
        x-availabilityStatus: Stable
      response:
        description: Payload
        items:
          $ref: '#/definitions/AgreementDetails'
        type: array
        x-availabilityStatus: Stable
    title: AccessAgreementListResponse
    type: object
  AccessAuthorization:
    description: Details of the user.
    properties:
      authorization_permission:
        description: Permission level for access authorization.
        enum:
        - ACT_ALONE
        - TWO_TOGETHER
        - RESTRICTED
        type: string
        x-availabilityStatus: Sandbox Only - Beta
      authorizer_id:
        description: Identifier of the user.
        type: string
        x-availabilityStatus: Sandbox Only - Beta
    title: AccessAuthorization
    type: object
  AccessTokenResponse:
    description: The access token (JWT)
    properties:
      group_header:
        $ref: '#/definitions/ResponseHeader'
        description: Standard format response header
        x-availabilityStatus: Stable
      response:
        $ref: '#/definitions/BearerToken'
        description: Payload
        x-availabilityStatus: Stable
    title: AccessTokenResponse
    type: object
  AddAuthorizerRequest:
    allOf:
    - $ref: '#/definitions/AddAuthorizerRequestTemplate'
    - description: Nominate an authorizer (Corporate Netbank Administrator) who will
        confirm the access authorization request
      properties:
        authentication_type:
          description: Value that identifies the type of authentication requested.
          enum:
          - DECOUPLED
          example: DECOUPLED
          type: string
          x-availabilityStatus: Stable
        authorizer_id:
          description: Corporate Netbank login id of nominated authorizer
          example: 3314162233
          type: string
          x-availabilityStatus: Stable
      required:
      - authorizer_id
      title: AddAuthorizerRequest
      type: object
    description: Nominate an authorizer (Corporate Netbank Administrator) who will
      confirm the access authorization request
    title: AddAuthorizerRequest
  AddAuthorizerRequestTemplate:
    description: Choose the preferred authentication type
    discriminator: authentication_type
    properties:
      authentication_type:
        description: Supported authentication types - DECOUPLED (Nordea ID only),
          REDIRECT (Nordea ID and Bank ID). Default value - DECOUPLED.
        enum:
        - DECOUPLED
        - REDIRECT
        readOnly: true
        type: string
        x-availabilityStatus: Stable
        x-discriminator:
        - propertyName: authentication_type
        - mapping:
            DECOUPLED: '#/definitions/AddAuthorizerRequest'
            REDIRECT: '#/definitions/AddRedirectAuthorizerRequest'
    required:
    - authentication_type
    title: AddAuthorizerRequestTemplate
    type: object
  AddRedirectAuthorizerRequest:
    allOf:
    - $ref: '#/definitions/AddAuthorizerRequestTemplate'
    - description: Choose the preferred authentication type.
      properties:
        authentication_method:
          description: 'Parameter with possible values: BANKID_SE (SE only: BankId
            Sweden), MTA (Nordea ID - Online)'
          enum:
          - BANKID_SE
          - MTA
          example: BANKID_SE
          type: string
          x-availabilityStatus: Beta
        authentication_type:
          description: Value that identifies the type of authentication requested.
          enum:
          - REDIRECT
          example: REDIRECT
          type: string
          x-availabilityStatus: Beta
        language:
          description: Language of message that will be displayed to client - ISO639-1
            and ISO639-2.
          enum:
          - fi
          - da
          - sv
          - en
          - 'no'
          example: en
          type: string
          x-availabilityStatus: Beta
        redirect_uri:
          description: Redirect URI you used when this application was registered
            with Nordea.
          example: https://example.com
          type: string
          x-availabilityStatus: Beta
        state:
          description: The OAuth2 state parameter
          example: anyString
          type: string
          x-availabilityStatus: Beta
      required:
      - authentication_type
      - redirect_uri
      - state
      title: AddRedirectAuthorizerRequest
      type: object
    description: Choose the preferred authentication type.
    title: AddRedirectAuthorizerRequest
  AgreementDetails:
    description: Agreements available.
    properties:
      agreement_number:
        description: Agreement Number.
        type: string
        x-availabilityStatus: Sandbox Only - Beta
      users:
        description: Users available within the agreement.
        items:
          $ref: '#/definitions/AccessAuthorization'
        type: array
        x-availabilityStatus: Sandbox Only - Beta
    title: AgreementDetails
    type: object
  AuthorizationStatus:
    description: Response for authorization status
    properties:
      _links:
        description: 'HATEOAS inspired links: ''rel'' and ''href'''
        items:
          $ref: '#/definitions/Link'
        type: array
        x-availabilityStatus: Stable
      code:
        description: code
        example: eyJjdHkiOiJKV1QiLCJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiZGlyIn0..duRyOpFN9OHfF4zq.9exR4Tp8eO-jorDtljriNEQO-mTknGC6DWbvBSmgO9whUaJcJckU2QXX754v7-BnRFrWjExxvf5taoSBmTPVgq6ymVXheE5qFHPyHGtpMV5iUjzV1H9Huhgun46GESZd4eTu4M7TNVduGu6XLdksETDWZYOag6jJD05WrZZoVDwCq87Abl0aCIE0vmY7xwpfSopNcqd1vPrGBq2lZybzzEyXOE4NefVtbmPvywch1H-zp16JhVLLIIsiQ9x8eJlrf1oK67DcAoBRpHKQqr-6c8YcSDQXFkoNdXUaqd6fUCVEvq-iBkjpj7MmrDTw12HCE8KVN1VWQLe7f3D-TQur37BRz5fOXL13IqgJdZdgYQ3hp-oy-B1oYgjB34ZOPsPm1ghdxDxjmeDFV51h1_SupJuogMwN6AZyzX7LeuNCq_8R_Ez8tznOnE8ILhw367kltDYJBTJvu1YU_CD_-HhcD3SyjU9bOKI93VSn3NLp2618r_uxTk8RgixD_PRw2HzKgfCWwImUbl8k-kITtKTfsjbgv3nOygcapq82NsBlQx2ZUpoVye7KXNtA2WSPKls7_4whg_Dwedb9IKr34F3CzomZnGFCRcqfArLJY1zY4nLZix57SctvdqAdcgAys0lbsY4oDe1m7S2rwp-PLWCkvZSDWATmYCG_6Ah2Oyy1DNNqa-NrFGgjDHhJJjaBeNCCLJ39WWlCl5EAUCjb08HNsRtGgeMboYzWDjbqRFi_r0-2fRE6LuAwNJaeSbz0MKRW03BNzkevdhp8HSIPq1UYyy_wtiwOxm4JTp_VNXkoM0-IoTXN6E4DZQ.M5SwrJzAeq2gDdSnkB0QNw
        type: string
        x-availabilityStatus: Stable
      status:
        description: Current status of authorization request
        example: PENDING
        type: string
        x-availabilityStatus: Stable
    required:
    - status
    title: AuthorizationStatus
    type: object
  AuthorizationStatusResponse:
    description: Response for authorization status
    properties:
      group_header:
        $ref: '#/definitions/ResponseHeader'
        description: Standard format response header
        x-availabilityStatus: Stable
      response:
        $ref: '#/definitions/AuthorizationStatus'
        description: Payload
        x-availabilityStatus: Stable
    title: AuthorizationStatusResponse
    type: object
  BearerToken:
    description: The Access token (JWT)
    properties:
      access_token:
        description: Access token
        example: eyJjdHkiOiJKV1QiLCJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiZGlyIn0..EM2YgJGre7OTIpmA.8GmpStB05uh4u_1wrEpyVCV_P5XwTcbL7zF_NsZJaMcZvo3B78gqhDR2lCCGLbTTImM4ILGHEQXO5Q7-obmdacIk9jcRr2eg5lTj_MBk9ch9yCMGh1NLEtXfOuHO1WzLoR6njQLDHdvvA2M3MEnVToqF6NdRI5f1hpWwC75TwUJWG50YTTYUBJskGPuRMLPfuTH-sncyVpI5Pj-XwXgcwOuXq8mz87DE1ZCCxPollReFZFsriQO3FeAqdgKigLaDH_WsoromxG2RAz6u4de-IYwXeWhsyq81SvOICE29kLMl9uxCvp6frYzOHoe7rfSaJiPhWGLn4_l29GimVNepQi1BadFqvHUyr7pUtO4Nx8e3piN7RV4DpMu1mf8_BYJaNUMyaeismu7RS9CmXm8wiEwgxK6f6vSOZxK6X8k7EHNKmZJZyR0q5ZRtFMzNa27tFah5_CybeJ86dJYIoaS1yG4rwBhokM06lVwAUAnpjXSRdoD7VUeNeg70DvTS2rtLa_w0_RLpva-iGkup-GIQyURK_jDZF2dVlRIanA8cwF6PZTA4cVslCd6EScJx9AHG87MmiWs6j0KOLZRyun3N3BEeRrjjcPk_lc3zcd8E2MZB4l-4o69cYvgAk1DpkxB__3IyuVkTEGwxlvT04anjsGLXEiunvQnDlAyEApr4xBeIGA2tAU8sstOQgGQffRj17iXWFgh4n5uHP77wrA4_d1tydAGCBhEVk6tsUVA81cavlwEfF53Yn1SK9bVofKv412tzU8fzNecni0IAsuWsCLGX.z3MMhpzmMp-GwdbTSl2rWQ
        type: string
        x-availabilityStatus: Stable
      expires_in:
        description: Token expiration time
        example: 3600
        format: int64
        type: integer
        x-availabilityStatus: Stable
      refresh_token:
        description: Refresh token
        example: eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiZGlyIn0..9IxfdEexBagh8deitsB4_pSVMs-y7OZ73k07MKTUufBOCUWpuBx3cRyPaGfMvwehEhefL2Ffi_FYhBb-StxF_m59aA2kqJimtSX0mr3Ogd5bLWNc2fXSEHPoKEJyzIVi-V-wjv6hBspUAk008Fq26tzvhjrBoswqUdqfmbksXED02fjMYYYP9Fcn7Jg3JO_AjEswxgqmWGsfhHIdNXrPPGpIfk7R0G0sehignbOjDraxCfYsYmp_6zxh5Ja2QDvsRlhAqdSRgX_I7kEpZFZbtJk-19mYMK7eOidTkLMPuhhg_7UcJSo5PjuFMhgvNJKx8UWiyRFlLAWCdo6CknQgJDGCGTiNCUoHywlZBYVmsPJlQITIOHgjvhQQa6Bk3xVs_r4gVfJiKqI4y96l6Tw9ydHJQrLw-4eJBdjisPpUZlrGgvP_WUYigVzco95kSQcT1WqBHhCMdGchPm0mEPD4BSpzHOvlIqmXaiGSwLC4YxQn_PfWWGGnbPvcfg8GJoX4iR6nv_Excn32mpUWlbl7lo-YD2c45oJVJVqFrADRqtQN-lR84cXmd75Gr7R7IJxgZnH8C6EfrBAiy_QEScsIOoDFESqAvUPCXj8FH9_cdWkeLsLSEkJwLOeLcTF73iXG7h_L_giz3t6zjNRa2WxErOxdYF0G453xQb4nFH1X9gc2jnSInmt1jiZGL3WSSXcCWjTSwQq3WhgVfjVTszMF_3F5NnSPHKuKpYf1Dc1kG_F0egzg2HIwTESZOr1jsmMjfyW42jotjc8JhbnjTU-dOgopCf5jWjzTeXFgdxgow7Am3NQa8R3wudqTQD7q5-ItMhW5mVt8TKk7IFjxd2r5tTJFiIsi8nyXOEujs4GuWtmL8gfqrulA7MgodN-FFXPGpa4KbLCGgO7dr5qY-eYLcg._OZAqZevjU4wIAe7D8aQfw
        type: string
        x-availabilityStatus: Stable
      token_type:
        description: Token type
        example: Bearer
        type: string
        x-availabilityStatus: Stable
    title: BearerToken
    type: object
  ErrorPayload:
    description: Error response body
    properties:
      failures:
        description: More details on the occurred error
        items:
          $ref: '#/definitions/Failure'
        type: array
        x-availabilityStatus: Stable
      request:
        $ref: '#/definitions/RequestEcho'
        description: Error details
        x-availabilityStatus: Stable
    title: ErrorPayload
    type: object
  ErrorResponse:
    description: Error response
    properties:
      error:
        $ref: '#/definitions/ErrorPayload'
        description: Payload
        x-availabilityStatus: Stable
      group_header:
        $ref: '#/definitions/ResponseHeader'
        description: Standard format response header
        x-availabilityStatus: Stable
    title: ErrorResponse
    type: object
  Failure:
    description: Validation error
    properties:
      code:
        description: Failure code
        type: string
        x-availabilityStatus: Stable
      description:
        description: Failure description
        type: string
        x-availabilityStatus: Stable
      path:
        description: JSON path of the failing element if applicable
        type: string
        x-availabilityStatus: Stable
      type:
        description: Type of the validation error, e.g. NotNull
        type: string
        x-availabilityStatus: Stable
    title: Failure
    type: object
  InitialAuthorization:
    description: Response for authorization initialization
    properties:
      _links:
        description: 'HATEOAS inspired links: ''rel'' and ''href'''
        items:
          $ref: '#/definitions/Link'
        type: array
        x-availabilityStatus: Stable
      access_id:
        description: Resource identifier of newly created access authorization request
        example: 286beebf-d386-43ff-9607-84cc2c8dad4d
        type: string
        x-availabilityStatus: Stable
      client_token:
        description: JWT token supplied to authorize client in subsequent operations
          on this access authorization resource
        example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
        type: string
        x-availabilityStatus: Stable
      code:
        description: code
        example: eyJjdHkiOiJKV1QiLCJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiZGlyIn0..duRyOpFN9OHfF4zq.9exR4Tp8eO-jorDtljriNEQO-mTknGC6DWbvBSmgO9whUaJcJckU2QXX754v7-BnRFrWjExxvf5taoSBmTPVgq6ymVXheE5qFHPyHGtpMV5iUjzV1H9Huhgun46GESZd4eTu4M7TNVduGu6XLdksETDWZYOag6jJD05WrZZoVDwCq87Abl0aCIE0vmY7xwpfSopNcqd1vPrGBq2lZybzzEyXOE4NefVtbmPvywch1H-zp16JhVLLIIsiQ9x8eJlrf1oK67DcAoBRpHKQqr-6c8YcSDQXFkoNdXUaqd6fUCVEvq-iBkjpj7MmrDTw12HCE8KVN1VWQLe7f3D-TQur37BRz5fOXL13IqgJdZdgYQ3hp-oy-B1oYgjB34ZOPsPm1ghdxDxjmeDFV51h1_SupJuogMwN6AZyzX7LeuNCq_8R_Ez8tznOnE8ILhw367kltDYJBTJvu1YU_CD_-HhcD3SyjU9bOKI93VSn3NLp2618r_uxTk8RgixD_PRw2HzKgfCWwImUbl8k-kITtKTfsjbgv3nOygcapq82NsBlQx2ZUpoVye7KXNtA2WSPKls7_4whg_Dwedb9IKr34F3CzomZnGFCRcqfArLJY1zY4nLZix57SctvdqAdcgAys0lbsY4oDe1m7S2rwp-PLWCkvZSDWATmYCG_6Ah2Oyy1DNNqa-NrFGgjDHhJJjaBeNCCLJ39WWlCl5EAUCjb08HNsRtGgeMboYzWDjbqRFi_r0-2fRE6LuAwNJaeSbz0MKRW03BNzkevdhp8HSIPq1UYyy_wtiwOxm4JTp_VNXkoM0-IoTXN6E4DZQ.M5SwrJzAeq2gDdSnkB0QNw
        type: string
        x-availabilityStatus: Stable
      status:
        description: Current status of authorization request
        example: PENDING
        type: string
        x-availabilityStatus: Stable
    required:
    - access_id
    - client_token
    - status
    title: InitialAuthorization
    type: object
  InitialAuthorizationRequest:
    description: Initiate a new access authorization request
    properties:
      agreement_number:
        description: Identifies bank agreement targeted by authorisation request.
        example: 130474822200
        type: string
        x-availabilityStatus: Stable
      duration:
        description: Duration of desired access in minutes
        example: 3600
        format: int32
        type: integer
        x-availabilityStatus: Stable
      scope:
        description: "List of access scopes required \n\nPSD2 API scopes : ACCOUNTS_PSD2,\
          \ PAYMENTS_PSD2 \n\nPremium API scopes : ACCOUNTS_BROADBAND, PAYMENTS_BROADBAND\
          \ \n\nNote: When authentication_type = REDIRECT is provided in PUT /v2/authorize/{access_id},\
          \ then only PSD2 scopes are supported."
        example: ACCOUNTS_BROADBAND
        items:
          enum:
          - ACCOUNTS_BROADBAND
          - ACCOUNTS_PSD2
          - PAYMENTS_BROADBAND
          - PAYMENTS_PSD2
          type: string
        type: array
        x-availabilityStatus: Stable
    required:
    - duration
    - scope
    title: InitialAuthorizationRequest
    type: object
  InitialAuthorizationResponse:
    description: Response upon creation of new access authorization request
    properties:
      group_header:
        $ref: '#/definitions/ResponseHeader'
        description: Standard format response header
        x-availabilityStatus: Stable
      response:
        $ref: '#/definitions/InitialAuthorization'
        description: Payload
        x-availabilityStatus: Stable
    title: InitialAuthorizationResponse
    type: object
  Link:
    description: Context specific link (only GET supported)
    properties:
      href:
        description: Relative path to the linked resource
        type: string
        x-availabilityStatus: Stable
      rel:
        description: Describes the nature of the link, e.g. 'details' for a link to
          the detailed information of a listed resource.
        type: string
        x-availabilityStatus: Stable
    title: Link
    type: object
  RequestEcho:
    description: Original request information
    properties:
      url:
        description: Original request url
        type: string
        x-availabilityStatus: Stable
    title: RequestEcho
    type: object
  ResponseEntity:
    description: ${ResponseEntity.description}
    title: ResponseEntity
    type: object
  ResponseHeader:
    description: External response header
    properties:
      creation_date_time:
        description: Response creation time
        format: date-time
        type: string
        x-availabilityStatus: Stable
      http_code:
        description: HTTP code for response
        example: 200
        format: int32
        type: integer
        x-availabilityStatus: Stable
      message_identification:
        description: Original request id for correlation purposes
        type: string
        x-availabilityStatus: Stable
    title: ResponseHeader
    type: object
  TokenRevocationRequest:
    description: ${TokenRevocationRequest.description}
    properties:
      token:
        description: ${TokenRevocationRequest.token.description}
        type: string
        x-availabilityStatus: Stable
    title: TokenRevocationRequest
    type: object
host: api.nordeaopenbanking.com
info:
  contact:
    email: support@nordeaopenbanking.com
    name: Open Banking team
    url: https://nordeaopenbanking.com
  description: Corporate Access Authorization API
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  title: Corporate Access Authorization API
  version: '2.2'
  x-ibm-name: corporate-auth-v2
  x-version: '2.2'
paths:
  /v2/authorize:
    post:
      consumes:
      - application/json
      deprecated: false
      operationId: authorization-v2-caa
      parameters:
      - description: 'The Digest Header header as defined in [RFC3230] contains a
          Hash of the message body. The only hash algorithms that may be used to calculate
          the Digest within the context of this specification are SHA-256 and SHA-512
          as defined in [RFC5843]. For POST with ''application/x-www-form-urlencoded''
          content type Digest should be calculated for normalized string created from
          request parameters like this: ''param1&#61;value1&#38;param2&#61;value2''.
          It is important that parameters should be placed in alphabetic order'
        in: header
        name: Digest
        required: true
        type: string
      - description: "A signature of request by the TPP on application level. The\
          \ process of signing a request is described in 'Signing HTTP Messages' RFC\
          \ draft version 10 (<a href=\"https://tools.ietf.org/html/draft-cavage-http-signatures-10\"\
          \ target=\"_blank\">https://tools.ietf.org/html/draft-cavage-http-signatures-10</a>).\
          \ The request signature needs to be sent in the 'Signature' HTTP header\
          \ as described in the RFC. Additional requirements from Nordea \n - The\
          \ only allowed algorithm is RSA-SHA256 \n- The key size for the used RSA\
          \ key pair has to be at least 2048 bit \n- The keyId is the clientId of\
          \ your application originating from the Nordea Developer Portal \n- We require\
          \ the following headers to be used in the signature \n* Request without\
          \ body: (request-target) X-Nordea-Originating-Host X-Nordea-Originating-Date\
          \ \n* Request with body: (request-target) X-Nordea-Originating-Host X-Nordea-Originating-Date\
          \ Content-type Digest \n* The request-target is a combination of the HTTP\
          \ action verb and the request URI path"
        in: header
        name: Signature
        required: true
        type: string
      - description: Id of the Client
        in: header
        name: X-IBM-Client-Id
        required: true
        type: string
        x-availabilityStatus: Stable
      - description: Secret password generated for the Client
        in: header
        name: X-IBM-Client-Secret
        required: true
        type: string
      - description: 'HTTP header element for date and time represented as RFC 7231
          Full Dates (GMT). Example date: **Wed, 24 Apr 2019 14:00:37 GMT**. It is
          similar to standard HTTP ''Date'' expect that it allows to set it under
          JavaScript in browser while standard ''Date'' is forbidden'
        in: header
        name: X-Nordea-Originating-Date
        required: true
        type: string
      - description: HTTP header element for specification of the domain name of the
          server. It is similar to standard HTTP 'Host' header but it won't be overridden
          by proxies. It also allows to set it under JavaScript in browser while standard
          'Host' is forbidden
        in: header
        name: X-Nordea-Originating-Host
        required: true
        type: string
      - description: End user (i.e. PSU) agent information, to be provided if TPP
          is in session with the PSU
        in: header
        name: X-Nordea-Originating-User-Agent
        required: false
        type: string
      - description: End user (i.e. PSU) IP address, to be provided if TPP is in session
          with the PSU
        in: header
        name: X-Nordea-Originating-User-Ip
        required: false
        type: string
      - description: Request for authorization initialization
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/InitialAuthorizationRequest'
        x-availabilityStatus: Stable
      produces:
      - application/json
      responses:
        '201':
          description: Response with a JWT token with CLIENT_ROLE as the role
          schema:
            $ref: '#/definitions/InitialAuthorizationResponse'
        '400':
          description: Bad Request
          schema:
            $ref: '#/definitions/ErrorResponse'
        '401':
          description: 'Unauthorized with failure code:

            * error.apikey.missing = Missing API key. This operation requires API
            key, but it was missing.

            * error.token = Unspecified error with supplied token.

            * error.token.invalid = Missing access token or token did not authorized
            requested operation. This operation requires valid access token, but it
            was missing.

            * error.token.expired = Access token has expired.'
          schema:
            $ref: '#/definitions/ErrorResponse'
        '403':
          description: 'Forbidden with failure code:

            * error.resource.denied = Requested resource is not authorized by access
            token.'
          schema:
            $ref: '#/definitions/ErrorResponse'
        '404':
          description: Resource not found
          schema:
            $ref: '#/definitions/ErrorResponse'
      summary: Start an authorization flow and create authorization resource
      tags:
      - authorize-v2
      x-availabilityStatus: Stable
  /v2/authorize/token:
    post:
      consumes:
      - application/x-www-form-urlencoded
      deprecated: false
      description: This is used for exchanging the auth code or refresh token for
        an access token.
      operationId: getAccessTokenUsingPOST
      parameters:
      - description: 'The Digest Header header as defined in [RFC3230] contains a
          Hash of the message body. The only hash algorithms that may be used to calculate
          the Digest within the context of this specification are SHA-256 and SHA-512
          as defined in [RFC5843]. For POST with ''application/x-www-form-urlencoded''
          content type Digest should be calculated for normalized string created from
          request parameters like this: ''param1&#61;value1&#38;param2&#61;value2''.
          It is important that parameters should be placed in alphabetic order'
        in: header
        name: Digest
        required: true
        type: string
      - description: "A signature of request by the TPP on application level. The\
          \ process of signing a request is described in 'Signing HTTP Messages' RFC\
          \ draft version 10 (<a href=\"https://tools.ietf.org/html/draft-cavage-http-signatures-10\"\
          \ target=\"_blank\">https://tools.ietf.org/html/draft-cavage-http-signatures-10</a>).\
          \ The request signature needs to be sent in the 'Signature' HTTP header\
          \ as described in the RFC. Additional requirements from Nordea \n - The\
          \ only allowed algorithm is RSA-SHA256 \n- The key size for the used RSA\
          \ key pair has to be at least 2048 bit \n- The keyId is the clientId of\
          \ your application originating from the Nordea Developer Portal \n- We require\
          \ the following headers to be used in the signature \n* Request without\
          \ body: (request-target) X-Nordea-Originating-Host X-Nordea-Originating-Date\
          \ \n* Request with body: (request-target) X-Nordea-Originating-Host X-Nordea-Originating-Date\
          \ Content-type Digest \n* The request-target is a combination of the HTTP\
          \ action verb and the request URI path"
        in: header
        name: Signature
        required: true
        type: string
      - description: Id of the Client
        in: header
        name: X-IBM-Client-Id
        required: true
        type: string
        x-availabilityStatus: Stable
      - description: Secret password generated for the Client
        in: header
        name: X-IBM-Client-Secret
        required: true
        type: string
      - description: 'HTTP header element for date and time represented as RFC 7231
          Full Dates (GMT). Example date: **Wed, 24 Apr 2019 14:00:37 GMT**. It is
          similar to standard HTTP ''Date'' expect that it allows to set it under
          JavaScript in browser while standard ''Date'' is forbidden'
        in: header
        name: X-Nordea-Originating-Date
        required: true
        type: string
      - description: HTTP header element for specification of the domain name of the
          server. It is similar to standard HTTP 'Host' header but it won't be overridden
          by proxies. It also allows to set it under JavaScript in browser while standard
          'Host' is forbidden
        in: header
        name: X-Nordea-Originating-Host
        required: true
        type: string
      - description: End user (i.e. PSU) agent information, to be provided if TPP
          is in session with the PSU
        in: header
        name: X-Nordea-Originating-User-Agent
        required: false
        type: string
      - description: End user (i.e. PSU) IP address, to be provided if TPP is in session
          with the PSU
        in: header
        name: X-Nordea-Originating-User-Ip
        required: false
        type: string
      - description: Authorization code
        in: formData
        name: code
        required: false
        type: string
        x-availabilityStatus: Stable
      - description: Grant type
        enum:
        - authorization_code
        - refresh_token
        in: formData
        name: grant_type
        required: false
        type: string
        x-availabilityStatus: Stable
        x-example: authorization_code
      - description: Refresh token
        in: formData
        name: refresh_token
        required: false
        type: string
        x-availabilityStatus: Stable
      produces:
      - application/json
      responses:
        '201':
          description: Response with a JWT token for AIS and PIS requests
          schema:
            $ref: '#/definitions/AccessTokenResponse'
        '400':
          description: Bad Request
          schema:
            $ref: '#/definitions/ErrorResponse'
        '401':
          description: Authentication failure
          schema:
            $ref: '#/definitions/ErrorResponse'
        '403':
          description: Authorization failure
          schema:
            $ref: '#/definitions/ErrorResponse'
        '404':
          description: Resource not found
          schema:
            $ref: '#/definitions/ErrorResponse'
      summary: Token exchange
      tags:
      - authorize-v2
      x-availabilityStatus: Stable
  /v2/authorize/token/revoke:
    post:
      consumes:
      - application/json
      deprecated: false
      description: See https://tools.ietf.org/html/rfc7009#section-2.1
      operationId: revokeUsingPOST
      parameters:
      - description: 'The Digest Header header as defined in [RFC3230] contains a
          Hash of the message body. The only hash algorithms that may be used to calculate
          the Digest within the context of this specification are SHA-256 and SHA-512
          as defined in [RFC5843]. For POST with ''application/x-www-form-urlencoded''
          content type Digest should be calculated for normalized string created from
          request parameters like this: ''param1&#61;value1&#38;param2&#61;value2''.
          It is important that parameters should be placed in alphabetic order'
        in: header
        name: Digest
        required: true
        type: string
      - description: "A signature of request by the TPP on application level. The\
          \ process of signing a request is described in 'Signing HTTP Messages' RFC\
          \ draft version 10 (<a href=\"https://tools.ietf.org/html/draft-cavage-http-signatures-10\"\
          \ target=\"_blank\">https://tools.ietf.org/html/draft-cavage-http-signatures-10</a>).\
          \ The request signature needs to be sent in the 'Signature' HTTP header\
          \ as described in the RFC. Additional requirements from Nordea \n - The\
          \ only allowed algorithm is RSA-SHA256 \n- The key size for the used RSA\
          \ key pair has to be at least 2048 bit \n- The keyId is the clientId of\
          \ your application originating from the Nordea Developer Portal \n- We require\
          \ the following headers to be used in the signature \n* Request without\
          \ body: (request-target) X-Nordea-Originating-Host X-Nordea-Originating-Date\
          \ \n* Request with body: (request-target) X-Nordea-Originating-Host X-Nordea-Originating-Date\
          \ Content-type Digest \n* The request-target is a combination of the HTTP\
          \ action verb and the request URI path"
        in: header
        name: Signature
        required: true
        type: string
      - description: Id of the Client
        in: header
        name: X-IBM-Client-Id
        required: true
        type: string
      - description: Secret password generated for the Client
        in: header
        name: X-IBM-Client-Secret
        required: true
        type: string
      - description: 'HTTP header element for date and time represented as RFC 7231
          Full Dates (GMT). Example date: **Wed, 24 Apr 2019 14:00:37 GMT**. It is
          similar to standard HTTP ''Date'' expect that it allows to set it under
          JavaScript in browser while standard ''Date'' is forbidden'
        in: header
        name: X-Nordea-Originating-Date
        required: true
        type: string
      - description: HTTP header element for specification of the domain name of the
          server. It is similar to standard HTTP 'Host' header but it won't be overridden
          by proxies. It also allows to set it under JavaScript in browser while standard
          'Host' is forbidden
        in: header
        name: X-Nordea-Originating-Host
        required: true
        type: string
      - description: End user (i.e. PSU) agent information, to be provided if TPP
          is in session with the PSU
        in: header
        name: X-Nordea-Originating-User-Agent
        required: false
        type: string
      - description: End user (i.e. PSU) IP address, to be provided if TPP is in session
          with the PSU
        in: header
        name: X-Nordea-Originating-User-Ip
        required: false
        type: string
      - description: 'The token that the client wants to get revoked. Note: In case
          of refresh token, access token will be automatically revoked as well'
        in: body
        name: token
        required: true
        schema:
          $ref: '#/definitions/TokenRevocationRequest'
        x-availabilityStatus: Stable
      produces:
      - application/json
      responses:
        '200':
          description: Token successfully revoked or invalid token. See https://tools.ietf.org/html/rfc7009#section-2.2
          schema:
            type: string
        '400':
          description: Bad Request
          schema:
            $ref: '#/definitions/ErrorResponse'
        '401':
          description: 'Unauthorized with failure code:

            * error.apikey.missing = Missing API key. This operation requires API
            key, but it was missing.

            * error.token = Unspecified error with supplied token.

            * error.token.invalid = Missing access token or token did not authorized
            requested operation. This operation requires valid access token, but it
            was missing.

            * error.token.expired = Access token has expired.'
          schema:
            $ref: '#/definitions/ErrorResponse'
        '403':
          description: 'Forbidden with failure code:

            * error.resource.denied = Requested resource is not authorized by access
            token.'
          schema:
            $ref: '#/definitions/ErrorResponse'
        '404':
          description: Resource not found
          schema:
            $ref: '#/definitions/ErrorResponse'
      summary: 'Revokes (blacklists) the token of given type. '
      tags:
      - authorize-v2
      x-availabilityStatus: Stable
  /v2/authorize/users:
    get:
      deprecated: false
      operationId: getAgreementUsersUsingGET
      parameters:
      - description: "A signature of request by the TPP on application level. The\
          \ process of signing a request is described in 'Signing HTTP Messages' RFC\
          \ draft version 10 (<a href=\"https://tools.ietf.org/html/draft-cavage-http-signatures-10\"\
          \ target=\"_blank\">https://tools.ietf.org/html/draft-cavage-http-signatures-10</a>).\
          \ The request signature needs to be sent in the 'Signature' HTTP header\
          \ as described in the RFC. Additional requirements from Nordea \n - The\
          \ only allowed algorithm is RSA-SHA256 \n- The key size for the used RSA\
          \ key pair has to be at least 2048 bit \n- The keyId is the clientId of\
          \ your application originating from the Nordea Developer Portal \n- We require\
          \ the following headers to be used in the signature \n* Request without\
          \ body: (request-target) X-Nordea-Originating-Host X-Nordea-Originating-Date\
          \ \n* Request with body: (request-target) X-Nordea-Originating-Host X-Nordea-Originating-Date\
          \ Content-type Digest \n* The request-target is a combination of the HTTP\
          \ action verb and the request URI path"
        in: header
        name: Signature
        required: true
        type: string
      - description: Id of the Client
        in: header
        name: X-IBM-Client-Id
        required: true
        type: string
      - description: Secret password generated for the Client
        in: header
        name: X-IBM-Client-Secret
        required: true
        type: string
      - description: 'HTTP header element for date and time represented as RFC 7231
          Full Dates (GMT). Example date: **Wed, 24 Apr 2019 14:00:37 GMT**. It is
          similar to standard HTTP ''Date'' expect that it allows to set it under
          JavaScript in browser while standard ''Date'' is forbidden'
        in: header
        name: X-Nordea-Originating-Date
        required: true
        type: string
      - description: HTTP header element for specification of the domain name of the
          server. It is similar to standard HTTP 'Host' header but it won't be overridden
          by proxies. It also allows to set it under JavaScript in browser while standard
          'Host' is forbidden
        in: header
        name: X-Nordea-Originating-Host
        required: true
        type: string
      - description: End user (i.e. PSU) agent information, to be provided if TPP
          is in session with the PSU
        in: header
        name: X-Nordea-Originating-User-Agent
        required: false
        type: string
      - description: End user (i.e. PSU) IP address, to be provided if TPP is in session
          with the PSU
        in: header
        name: X-Nordea-Originating-User-Ip
        required: false
        type: string
      produces:
      - application/json
      responses:
        '200':
          description: Agreement details.
          schema:
            $ref: '#/definitions/AccessAgreementListResponse'
        '400':
          description: Bad Request
          schema:
            $ref: '#/definitions/ErrorResponse'
        '401':
          description: 'Unauthorized with failure code:

            * error.apikey.missing = Missing API key. This operation requires API
            key, but it was missing.

            * error.token = Unspecified error with supplied token.

            * error.token.invalid = Missing access token or token did not authorized
            requested operation. This operation requires valid access token, but it
            was missing.

            * error.token.expired = Access token has expired.'
          schema:
            $ref: '#/definitions/ErrorResponse'
        '403':
          description: 'Forbidden with failure code:

            * error.resource.denied = Requested resource is not authorized by access
            token.'
          schema:
            $ref: '#/definitions/ErrorResponse'
        '404':
          description: Resource not found
          schema:
            $ref: '#/definitions/ErrorResponse'
      summary: List access authorization permissions held by each user.
      tags:
      - authorize-v2
      x-availabilityStatus: Sandbox Only - Beta
  /v2/authorize/{access_id}:
    get:
      deprecated: false
      operationId: getStatusUsingGET
      parameters:
      - description: Bearer token identifying client
        in: header
        name: Authorization
        required: true
        type: string
      - description: "A signature of request by the TPP on application level. The\
          \ process of signing a request is described in 'Signing HTTP Messages' RFC\
          \ draft version 10 (<a href=\"https://tools.ietf.org/html/draft-cavage-http-signatures-10\"\
          \ target=\"_blank\">https://tools.ietf.org/html/draft-cavage-http-signatures-10</a>).\
          \ The request signature needs to be sent in the 'Signature' HTTP header\
          \ as described in the RFC. Additional requirements from Nordea \n - The\
          \ only allowed algorithm is RSA-SHA256 \n- The key size for the used RSA\
          \ key pair has to be at least 2048 bit \n- The keyId is the clientId of\
          \ your application originating from the Nordea Developer Portal \n- We require\
          \ the following headers to be used in the signature \n* Request without\
          \ body: (request-target) X-Nordea-Originating-Host X-Nordea-Originating-Date\
          \ \n* Request with body: (request-target) X-Nordea-Originating-Host X-Nordea-Originating-Date\
          \ Content-type Digest \n* The request-target is a combination of the HTTP\
          \ action verb and the request URI path"
        in: header
        name: Signature
        required: true
        type: string
      - description: Id of the Client
        in: header
        name: X-IBM-Client-Id
        required: true
        type: string
      - description: Secret password generated for the Client
        in: header
        name: X-IBM-Client-Secret
        required: true
        type: string
      - description: 'HTTP header element for date and time represented as RFC 7231
          Full Dates (GMT). Example date: **Wed, 24 Apr 2019 14:00:37 GMT**. It is
          similar to standard HTTP ''Date'' expect that it allows to set it under
          JavaScript in browser while standard ''Date'' is forbidden'
        in: header
        name: X-Nordea-Originating-Date
        required: true
        type: string
      - description: HTTP header element for specification of the domain name of the
          server. It is similar to standard HTTP 'Host' header but it won't be overridden
          by proxies. It also allows to set it under JavaScript in browser while standard
          'Host' is forbidden
        in: header
        name: X-Nordea-Originating-Host
        required: true
        type: string
      - description: End user (i.e. PSU) agent information, to be provided if TPP
          is in session with the PSU
        in: header
        name: X-Nordea-Originating-User-Agent
        required: false
        type: string
      - description: End user (i.e. PSU) IP address, to be provided if TPP is in session
          with the PSU
        in: header
        name: X-Nordea-Originating-User-Ip
        required: false
        type: string
      - description: Access ID requested for authorization status
        in: path
        name: access_id
        required: true
        type: string
        x-availabilityStatus: Stable
      produces:
      - application/json
      responses:
        '200':
          description: Success - response includes status of specified authorization
            request
          schema:
            $ref: '#/definitions/AuthorizationStatusResponse'
        '400':
          description: Bad Request
          schema:
            $ref: '#/definitions/ErrorResponse'
        '401':
          description: 'Unauthorized with failure code:

            * error.apikey.missing = Missing API key. This operation requires API
            key, but it was missing.

            * error.token = Unspecified error with supplied token.

            * error.token.invalid = Missing access token or token did not authorized
            requested operation. This operation requires valid access token, but it
            was missing.

            * error.token.expired = Access token has expired.'
          schema:
            $ref: '#/definitions/ErrorResponse'
        '403':
          description: Credential failure
          schema:
            $ref: '#/definitions/ErrorResponse'
        '404':
          description: Resource not found
          schema:
            $ref: '#/definitions/ErrorResponse'
      summary: Get status of the authorization process
      tags:
      - authorize-v2
      x-availabilityStatus: Stable
    put:
      consumes:
      - application/json
      deprecated: false
      operationId: addAuthorizerUsingPUT
      parameters:
      - description: Bearer token identifying client
        in: header
        name: Authorization
        required: true
        type: string
      - description: 'The Digest Header header as defined in [RFC3230] contains a
          Hash of the message body. The only hash algorithms that may be used to calculate
          the Digest within the context of this specification are SHA-256 and SHA-512
          as defined in [RFC5843]. For POST with ''application/x-www-form-urlencoded''
          content type Digest should be calculated for normalized string created from
          request parameters like this: ''param1&#61;value1&#38;param2&#61;value2''.
          It is important that parameters should be placed in alphabetic order'
        in: header
        name: Digest
        required: true
        type: string
      - description: "A signature of request by the TPP on application level. The\
          \ process of signing a request is described in 'Signing HTTP Messages' RFC\
          \ draft version 10 (<a href=\"https://tools.ietf.org/html/draft-cavage-http-signatures-10\"\
          \ target=\"_blank\">https://tools.ietf.org/html/draft-cavage-http-signatures-10</a>).\
          \ The request signature needs to be sent in the 'Signature' HTTP header\
          \ as described in the RFC. Additional requirements from Nordea \n - The\
          \ only allowed algorithm is RSA-SHA256 \n- The key size for the used RSA\
          \ key pair has to be at least 2048 bit \n- The keyId is the clientId of\
          \ your application originating from the Nordea Developer Portal \n- We require\
          \ the following headers to be used in the signature \n* Request without\
          \ body: (request-target) X-Nordea-Originating-Host X-Nordea-Originating-Date\
          \ \n* Request with body: (request-target) X-Nordea-Originating-Host X-Nordea-Originating-Date\
          \ Content-type Digest \n* The request-target is a combination of the HTTP\
          \ action verb and the request URI path"
        in: header
        name: Signature
        required: true
        type: string
      - description: Id of the Client
        in: header
        name: X-IBM-Client-Id
        required: true
        type: string
      - description: Secret password generated for the Client
        in: header
        name: X-IBM-Client-Secret
        required: true
        type: string
      - description: 'HTTP header element for date and time represented as RFC 7231
          Full Dates (GMT). Example date: **Wed, 24 Apr 2019 14:00:37 GMT**. It is
          similar to standard HTTP ''Date'' expect that it allows to set it under
          JavaScript in browser while standard ''Date'' is forbidden'
        in: header
        name: X-Nordea-Originating-Date
        required: true
        type: string
      - description: HTTP header element for specification of the domain name of the
          server. It is similar to standard HTTP 'Host' header but it won't be overridden
          by proxies. It also allows to set it under JavaScript in browser while standard
          'Host' is forbidden
        in: header
        name: X-Nordea-Originating-Host
        required: true
        type: string
      - description: End user (i.e. PSU) agent information, to be provided if TPP
          is in session with the PSU
        in: header
        name: X-Nordea-Originating-User-Agent
        required: false
        type: string
      - description: End user (i.e. PSU) IP address, to be provided if TPP is in session
          with the PSU
        in: header
        name: X-Nordea-Originating-User-Ip
        required: false
        type: string
      - description: Access ID requested for authorization confirmation
        in: path
        name: access_id
        required: true
        type: string
        x-availabilityStatus: Stable
      - description: Request for authorization confirmation
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/AddAuthorizerRequestTemplate'
        x-availabilityStatus: Stable
      produces:
      - application/json
      responses:
        '200':
          description: Response with a request confirmation
          schema:
            $ref: '#/definitions/AuthorizationStatusResponse'
        '400':
          description: Bad Request
          schema:
            $ref: '#/definitions/ErrorResponse'
        '401':
          description: Authentication failure
          schema:
            $ref: '#/definitions/ErrorResponse'
        '403':
          description: Authorization failure
          schema:
            $ref: '#/definitions/ErrorResponse'
        '404':
          description: Resource not found
          schema:
            $ref: '#/definitions/ErrorResponse'
      summary: Confirm an authorization request
      tags:
      - authorize-v2
      x-availabilityStatus: Stable
      x-discriminator:
      - propertyName: authentication_type
      - mapping:
          DECOUPLED: '#/definitions/AddAuthorizerRequest'
          REDIRECT: '#/definitions/AddRedirectAuthorizerRequest'
      x-isPolymorphic: 'true'
securityDefinitions:
  DecoupledAuth:
    authorizationUrl: /v2/authorize
    flow: accessCode
    scopes:
      ACCOUNTS_BROADBAND: Scope used for Instant Reporting
      ACCOUNTS_PSD2: Scope for accessing accounts within PSD2
      PAYMENTS_BROADBAND: Scope used to make and access payments for MyOpenBanking
        customers
      PAYMENTS_PSD2: Scope used to make and access payments within PSD2
    tokenUrl: /v2/authorize/token
    type: oauth2
    x-addAuthorizerDescription: Send authorization request to relevant agreement administrator
    x-addAuthorizerUrl: /v2/authorize
    x-authSubType: decoupled-auth
    x-codeStatusDescription: Returns code when authorization second step is finished
    x-codeStatusUrl: /v2/authorize
swagger: '2.0'
tags:
- description: OAuth 2.0 authentication with support for scopes
  name: authorize-v2
