- General information
- PSU-ID credentials
- PSU accounts
- PSU transactions and standing orders
- Challenge
- How to trigger decoupled SCA
General information
XS2A Sandbox has predefined test data that can be used for test purposes:
- PSU-IDs
- PSU passwords
- accounts
- balances
- transactions
You are not allowed to create your own test data besides consents and payments.
Important: in XS2A, Sandbox-created payments don't have an impact on balances and transactions. It means that an authorised payment will not be listed as a transaction on the accounts that were used as debtor and creditor accounts in the payment.
PSU-ID credentials
PSU-ID | Password | Supported SCA |
aspsp1 | aspsp1 |
Embedded, decoupled Decoupled is completed successfully by default. |
aspsp2 | aspsp2 |
Embedded, decoupled Decoupled is completed successfully by default. |
aspsp3 | aspsp3 |
Embedded, decoupled Decoupled is completed successfully by default. |
aspsp4 | aspsp4 |
Embedded, decoupled Decoupled is completed successfully by default. |
aspsp5 | aspsp5 |
Embedded, decoupled Decoupled is completed successfully by default. |
aspsp6 | aspsp6 |
Error case. The following error will be returned during the SCA process: { |
PSU accounts
PSU-ID | resourceId | accountName | product | iban | bban | pan | maskedPan | bic | currency | paymentId |
aspsp1 | 11111-999999999 | Müller | SCT | DE54500105173424724776 | 4500105173424724776 | AEYPM5403H | PM5403H**** | DEUTDE8EXXX | EUR | 02aa8c9d-182c-483f-ba00-8495f38d23b4 |
aspsp2 | 77777-999999999 | Müller | SCT | DE89370400440532013000 | 9370400440532013000 | FFGHPM5403H | HPM5403H**** | DEUTDE8EXXX | USD | |
aspsp2 | 22222-999999999 | Müller | SCT | DE75512108001245126199 | 5512108001245126199 | QWEPM6427U | PM6427U**** | DEUTDE8EXXX | USD | |
aspsp2 | 33333-999999999 | Schmidt | SCT | LU280019400644750000 | 80019400644750000 | EWQPS8534R | PS8534R**** | DEUTDE8EXXX | EUR | |
aspsp3 | 44444-999999999 | Schmidt | SCT | DE91100000000123456789 | 1100000000123456789 | ASDPS9547Z | PS9547Z**** | DEUTDE8EXXX | USD | |
aspsp4 | 55555-999999999 | Company AG | SCT | DE27100777770209299700 | 7100777770209299700 | DSACC1876N | CC1876N**** | DEUTDE8EXXX | EUR | |
aspsp4 | 66666-999999999 | Company AG | SCT | DE11520513735120710131 | 1520513735120710131 | CC6427T**** | PS9547Z**** | DEUTDE8EXXX | USD | |
aspsp4 | 42fb4cc3-91cb-45ba-9159-b87acf6d8add | Alexander Mueller | SCT | DE52500105173911841934 | 2500105173911841934 | EUR | ||||
aspsp5 | 88888-999999999 | Greenpeace | GIRO | DE24500105172916349286 | 4500105172916349286 | EUR | ||||
aspsp5 | 99999-999999999 | Telekom | GIRO | DE68500105174416628385 | 8500105174416628385 | EUR | ||||
aspsp5 | 12345-999999999 | Jochen Mueller | GIRO | DE06500105171657611553 | 6500105171657611553 | EUR | ||||
aspsp5 | 23236-999999999 | Amazon | GIRO | DE49500105175378548627 | 9500105175378548627 | EUR | ||||
aspsp6 | 37289-999999999 | Holidaycheck.com | GIRO | DE21500105176194357737 | 1500105176194357737 | EUR | ||||
aspsp6 | 868beafc-ef87-4fdb-ac0a-dd6c52b77ee6 | Alexander Mueller | GIRO | DE15086016167627403587 | 5086016167627403587 | EUR |
PSU transactions and standing orders
Transactions and standing orders are available for all test PSUs, except aspsp1.
Challenge
authenticationType | authenticationMethodID | value | format | comment | example |
CHIP_OTP | chip | current time |
ddmm where dd is [currentDate or currentDate+1] and mm is [currentMinute or currentMinute+1 or currentMinute-1] |
dd - current day in a month mm - current minutes |
{ "scaAuthenticationData": "0230" } |
SMS_OTP | sms | current time |
HHmm where HH is [currentHour or currentHour+2 or currentHour-2h] and mm is [currentMinute or currentMinute+1 or currentMinute-1] |
HH - 24 hour format mm - current minutes |
{ "scaAuthenticationData": "1230" } |
Example 1 - authenticationType = SMS_OTP
current time = 17:08
- challenge data = "1507" is valid
- challenge data = "1608" is valid
- challenge data = "1909" is valid
Example 2 - authenticationType = CHIP_OTP
current date and time = 21.01.2019 17:08
- challenge data = 2107 is valid
- challenge data = 2208 is valid
- challenge data = 2009 is NOT valid
How to trigger decoupled SCA
To trigger Decoupled SCA please use authenticationMethodId where "authenticationType" = "PUSH_OTP” in the response in the Step 3 “Provide PSU password”.
Other authenticationTypes trigger Embedded SCA.
Example response in Step 3
Example |
Example request in Step 4 “Provide 2nd factor”
Example |
This request will trigger decoupled SCA logic in the XS2A-server and the bank-mock on the Sandbox.
On default, each decoupled SCA is completed successfully.
To verify the status of the SCA in decoupled case, TPP has to execute additional call to get payment or consent status, or respective authorization status.