OP Corporate Account Data API (1.4)

Authentication in OP Corporate Account Data API is based on practices from OpenID Connect (OIDC) 1.0 and OAuth 2.0.

It is extremely important that the Client ID, Client Secret and MTLS certificate private key are not exposed at any point. Together they represent the identity of the client and thereby the corporation. In the possession of an attacker they could be used to make fraudulent API calls potentially causing considerable damage.

To test the API in sandbox environment, please send an email at corp-payment-APIs@op.fi.

You can get production access for this API on OP API Admin.

To use these APIs against production you should replace host in the API examples below with https://corporate-api.apiauth.services.op.fi/

V1.4 (09/2022)

Added

• Added more clarification and special cases for the usage of request parameters maxPast and maxFuture for endpoint Transactions V2

V1.3 (10/2021)

Added

• All endpoints now support Service Provider initiated calls

Changed

• Fixed the examples on Transactions and Transactions V2 and added more clarification.

V1.2 (08/2021)

Added

• New response parameter transactionTypeCode added to endpoint Transactions V2
• New response parameter transactionTypeDescription added to endpoint Transactions V2

V1.1 (06/2021)

Added

• New endpoint Transactions V2 added. The new endpoint supports transaction queries with timestamps.

Deprecated

• Deprecated endpoint Transactions

V1.0 (12/2019)

Initial version

Deprecated

The items listed here are still in production, but will be removed at a future release. Therefore it is best to avoid using these items during active development of a client. A notification will be given prior to removal in accordance with the general terms of use.

• Response model TransactionsResponse (use TransactionsResponseV2 instead)
• Endpoint Transactions (use Transactions V2 instead)

#!/bin/bash

# To run this you need openssl and jq installed.

# Steps for registering the required keys and certificates
# 1. Valid Corporate API contract created through OP API Admin
# 2. OAuth clientId and clientSecret provisioned
# 3. MTLS private key generated: openssl genrsa -out sandbox-mtls.key 4096
# 4. MTLS certificate signing request (CN and other attributes are ignored): openssl req -new -key sandbox-mtls.key -out sandbox-mtls.csr
# 5. Valid MTLS certificate aquired from OP API Admin using the csr from step 4. and in "sandbox-mtls.crt" file

# OAuth credentials
clientId="TODO put here oauth client id"
clientSecret="TODO and here client secret"

# MTLS credentials
mtlsKey="sandbox-mtls.key"
mtlsCertificate="sandbox-mtls.crt"

API_SERVER="https://sandbox-api.apiauth.aws.op-palvelut.net"

echo "Getting access token"

reply=$(curl -s ${API_SERVER}/corporate-oidc/v1/token \
    --key ${mtlsKey} \
    --cert ${mtlsCertificate} \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d "grant_type=client_credentials&client_id=${clientId}&client_secret=${clientSecret}")

token=$(echo $reply | jq -r .access_token)
echo "Access token is: $token"

echo "Fetching account listing"
accounts=$(curl -s ${API_SERVER}/corporate-account-data/v1/accounts \
--key ${mtlsKey} \
--cert ${mtlsCertificate} \
-H "Authorization: Bearer $token")

echo $accounts | jq -C .

ACCOUNTID=$(echo $accounts | jq -r .[0].surrogateId)

echo "Fetching accountInfo for account $ACCOUNTID"

accountinfo=$(curl -s
${API_SERVER}/corporate-account-data/v1/accounts/$ACCOUNTID \
--key ${mtlsKey} \
--cert ${mtlsCertificate} \
-H "Authorization: Bearer $token")

echo $accountinfo | jq -C .

echo "Fetching transactions for account $ACCOUNTID"
transactions=$(curl -s
${API_SERVER}/corporate-account-data/v1/accounts/$ACCOUNTID/transactions \
--key ${mtlsKey} \
--cert ${mtlsCertificate} \
-H "Authorization: Bearer $token")

echo "Ttransactions for account $ACCOUNTID:"
echo $transactions | jq -C .