OP Corporate Payment API (3.0.1)

curl -X GET https://api.corp-api-sandbox.test.aws.op-palvelut.net/corporate-payment/v1/sepa-instant-payment/{instructionId} \
-H 'authorization: string' \
-H 'X-Request-ID: string' \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' 

## OP Corporate Payment API - SEPA Payment V2 Status Query bash script example

#!/bin/bash

# To run this script you need openssl and jq installed.

# Steps for registering the required keys and certificates
# 1. Valid Corporate API contract created in OP API Admin
# 2. OAuth clientId and clientSecret provisioned
# 3. MTLS private key generated: openssl genrsa -out sandbox-mtls.key 4096
# 4. MTLS certificate signing request (CN and other attributes are ignored): openssl req -new -key sandbox-mtls.key -out sandbox-mtls.csr
# 5. Valid MTLS certificate downloaded from OP API Admin as file "sandbox-mtls.crt" by uploading the certificate signing request (CSR) from the previous step
# 6. Payment signing private key generated: openssl genrsa -out sandbox-signing.key 4096
# 7. Signing csr request: openssl req -new -key sandbox-signing.key -out sandbox-signing.csr
# 8. Signing KID (key identifier) received from the OP API Admin by submitting the sandbox-signing.csr.

# OAuth credentials
clientId="TODO put here oauth client id"
clientSecret="TODO and here client secret"

# MTLS credentials
mtlsKey="sandbox-mtls.key"
mtlsCertificate="sandbox-mtls.crt"

# Payment signing credentials
signingKey="sandbox-signing.key"
signingKid="TODO and here signing KID"

API_SERVER="https://api.corp-api-sandbox.test.aws.op-palvelut.net"

echo "Getting access token"
reply=$(curl -s ${API_SERVER}/corporate-oidc/v1/token \
    --key ${mtlsKey} \
    --cert ${mtlsCertificate} \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d "grant_type=client_credentials&client_id=${clientId}&client_secret=${clientSecret}")

token=$(echo $reply | jq -r .access_token)
echo "Access token is: $token"\

## Initiate payment processing with payload signature# Instruction id must be unique for each payment request
INSTRUCTIONID=$(date +%s)
DEBTORIBAN="TODO Your account IBAN from the API contract"
CREDITORIBAN="TODO Your account IBAN from the API contract"

# Sample payment request with dummy data
paymentRequest="{\"instructionId\":\"$INSTRUCTIONID\",\"endToEndId\":\"endToEndId\",\"creditor\":{\"name\":\"Creditor Name\",\"iban\":\"$CREDITORIBAN\",\"address\":{\"addressLine\":[\"a1\",\"a2\"],\"country\":\"FI\"}},\"debtor\":{\"name\":\"Debtor Name\",\"iban\":\"$DEBTORIBAN\",\"address\":{\"addressLine\":[\"a1\",\"a2\"],\"country\":\"FI\"}},\"instructedAmount\":{\"currency\":\"EUR\",\"amount\":\"0.16\"},\"reference\":\"00000000000000482738\"}"

## Signing the payload is mandatory for payment requests
# Issued at, in unix timestamp format
IAT=$(date +%s)

# Form the JWS header with mandatory fields
HEADER="{\"b64\":false,\"crit\":[\"b64\",\"urn:op.api.iat\"],\"alg\":\"RS256\",\"urn:op.api.iat\":${IAT},\"kid\":\"${signingKid}\"}"

# Base64 encode the header. JWT encoding is slightly different from default
# output of base64, so make the necessary changes to make the output URL-safe,
# and remove trailing padding (=).
HEADER_ENC=$(echo -n "${HEADER}" | base64 | tr -- '+/=' '-_ ' | tr -d '[:space:]')

# Sign the header and payload. The signature calculation in the detached body JWS is slightly different from the standard way, as the payload is not base64-encoded
# before signing, but included as-is in the signature plain text. The signing algorithm is RS256, also known as "RSA Digital Signature Algorithm with SHA-256".# The resulting signature is base64-encoded, and the same URL-safe transformations are applied.
SIGNATURE=$(echo -n "${HEADER_ENC}.${paymentRequest}" | openssl dgst -sha256 -sign ${signingKey} -binary | openssl base64 -e -A | tr -- '+/=' '-_ ' | tr -d '[:space:]')

# The signature header includes the base64-encoded JWS header, followed by two dots (..), and the base64-urlsafe-encoded signature. The actual message payload is not
# repeated in the signature
REQ_SIGNATURE="${HEADER_ENC}..${SIGNATURE}"

# The signature is included in the "X-Req-Signature" header.
echo "Sending payment request"
paymentResponse=$(curl -s ${API_SERVER}/corporate-payment/v2/payment \
    --key ${mtlsKey} \
    --cert ${mtlsCertificate} \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer $token" \
    -H "X-Req-Signature: ${REQ_SIGNATURE}" \
    -d "$paymentRequest")
echo $paymentResponse | jq -C .

echo "Sending payment status query request"
paymentStatusQueryResponse=$(curl -X GET ${API_SERVER}/corporate-payment/v2/payment/$INSTRUCTIONID \
    --key ${mtlsKey} \
    --cert ${mtlsCertificate} \
    -H 'Accept: application/json' \
    -H "Authorization: Bearer $token")
echo $paymentStatusQueryResponse | jq -C .

## OP Corporate Payment API - SEPA Payment V3 Status Query bash script example

#!/bin/bash

# To run this script you need openssl and jq installed.

# Steps for registering the required keys and certificates
# 1. Valid Corporate API contract created in OP API Admin
# 2. OAuth clientId and clientSecret provisioned
# 3. MTLS private key generated: openssl genrsa -out sandbox-mtls.key 4096
# 4. MTLS certificate signing request (CN and other attributes are ignored): openssl req -new -key sandbox-mtls.key -out sandbox-mtls.csr
# 5. Valid MTLS certificate downloaded from OP API Admin as file "sandbox-mtls.crt" by uploading the certificate signing request (CSR) from the previous step
# 6. Payment signing private key generated: openssl genrsa -out sandbox-signing.key 4096
# 7. Signing csr request: openssl req -new -key sandbox-signing.key -out sandbox-signing.csr
# 8. Signing KID (key identifier) received from the OP API Admin by submitting the sandbox-signing.csr.

# OAuth credentials
clientId="TODO put here oauth client id"
clientSecret="TODO and here client secret"

# MTLS credentials
mtlsKey="sandbox-mtls.key"
mtlsCertificate="sandbox-mtls.crt"

# Payment signing credentials
signingKey="sandbox-signing.key"
signingKid="TODO and here signing KID"

API_SERVER="https://api.corp-api-sandbox.test.aws.op-palvelut.net"

echo "Getting access token"
reply=$(curl -s ${API_SERVER}/corporate-oidc/v1/token \
    --key ${mtlsKey} \
    --cert ${mtlsCertificate} \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d "grant_type=client_credentials&client_id=${clientId}&client_secret=${clientSecret}")

token=$(echo $reply | jq -r .access_token)
echo "Access token is: $token"\

## Initiate payment processing with payload signature# Instruction id must be unique for each payment request
INSTRUCTIONID=$(date +%s)
DEBTORIBAN="TODO Your account IBAN from the API contract"
CREDITORIBAN="TODO Your account IBAN from the API contract"

# Sample payment request with dummy data
paymentRequest="{\"instructionId\":\"$INSTRUCTIONID\",\"endToEndId\":\"endToEndId\",\"vopProcessingRules\":\"MATCH\",\"allowVopErrors\":false,\"creditor\":{\"name\":\"Creditor Name\",\"iban\":\"$CREDITORIBAN\",\"address\":{\"addressLine\":[\"a1\",\"a2\"],\"country\":\"FI\"}},\"debtor\":{\"name\":\"Debtor Name\",\"iban\":\"$DEBTORIBAN\",\"address\":{\"addressLine\":[\"a1\",\"a2\"],\"country\":\"FI\"}},\"instructedAmount\":{\"currency\":\"EUR\",\"amount\":\"0.16\"},\"reference\":\"00000000000000482738\"}"

## Signing the payload is mandatory for payment requests
# Issued at, in unix timestamp format
IAT=$(date +%s)

# Form the JWS header with mandatory fields
HEADER="{\"b64\":false,\"crit\":[\"b64\",\"urn:op.api.iat\"],\"alg\":\"RS256\",\"urn:op.api.iat\":${IAT},\"kid\":\"${signingKid}\"}"

# Base64 encode the header. JWT encoding is slightly different from default
# output of base64, so make the necessary changes to make the output URL-safe,
# and remove trailing padding (=).
HEADER_ENC=$(echo -n "${HEADER}" | base64 | tr -- '+/=' '-_ ' | tr -d '[:space:]')

# Sign the header and payload. The signature calculation in the detached body JWS is slightly different from the standard way, as the payload is not base64-encoded
# before signing, but included as-is in the signature plain text. The signing algorithm is RS256, also known as "RSA Digital Signature Algorithm with SHA-256".# The resulting signature is base64-encoded, and the same URL-safe transformations are applied.
SIGNATURE=$(echo -n "${HEADER_ENC}.${paymentRequest}" | openssl dgst -sha256 -sign ${signingKey} -binary | openssl base64 -e -A | tr -- '+/=' '-_ ' | tr -d '[:space:]')

# The signature header includes the base64-encoded JWS header, followed by two dots (..), and the base64-urlsafe-encoded signature. The actual message payload is not
# repeated in the signature
REQ_SIGNATURE="${HEADER_ENC}..${SIGNATURE}"

# The signature is included in the "X-Req-Signature" header.
echo "Sending payment request"
paymentResponse=$(curl -s ${API_SERVER}/corporate-payment/v3/payment \
    --key ${mtlsKey} \
    --cert ${mtlsCertificate} \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer $token" \
    -H "X-Req-Signature: ${REQ_SIGNATURE}" \
    -d "$paymentRequest")
echo $paymentResponse | jq -C .

echo "Sending payment status query request"
paymentStatusQueryResponse=$(curl -X GET ${API_SERVER}/corporate-payment/v3/payment/$INSTRUCTIONID \
    --key ${mtlsKey} \
    --cert ${mtlsCertificate} \
    -H 'Accept: application/json' \
    -H "Authorization: Bearer $token")
echo $paymentStatusQueryResponse | jq -C .

curl -X GET https://api.corp-api-sandbox.test.aws.op-palvelut.net/corporate-payment/v2/cross-border-payment/{instructionId} \
-H 'authorization: string' \
-H 'X-Request-ID: string' \
-H 'Accept: application/json' \
-H 'Content-Type: application/json'