API

Version

• PTSB Well-known endpoint:https://auth.permanenttsb.ie/.well-known/openid-configuration
• API endpoint: https://api.permanenttsb.ie/
• If you have been performing API calls on our Sandbox environment then to make API calls on our Production environment  you just need to swap out  https://developer.permanenttsb.ie/psd2api/ with https://api.permanenttsb.ie
• i.e.: https://developer.permanettsb.ie/psd2api/as/token.oauth2 now becomes https://api.permanenttsb.ie/as/token.oauth2
• To call the authorisation endpoint use auth in https://auth.permanenttsb.ie/authorize

The PTSB OBIE Financial ID is 0015800001ZEZ3yAAH

We have developed our Security Profile in line with the Open Banking Standards: detailed information including specifications is available on UK Open Bank Security Profile.

• PTSB are implementing OAuth2.0 “Hybrid flow” as specified by the Open Banking Standards
• Client Credentials Grant Access Token is valid for 60 minutes
• AISP - Authorisation Grant Access Token is valid for 90 days
• PISP - Authorisation Grant Access Token is valid for 60 seconds

PTSB requires TPP’s to sign their Payment Post requests with their QSealC certificate. The following outlines the steps for signing a payments payload.

Step 1: Identify the Private Key and Corresponding Signing Certificate to be used for Signing.

We require TPP’s to sign their messages with their QSealC certificate. The signing key must be valid at the time of creating the JWS. The TPP’s QSealC certificate which contains the TPP’s public key must be transmitted with the request in the “tpp-signature-certificate” header. 

Step 2: Form the JOSE Header. The JOSE header for the signature must contain the following claims:

a.  alg -

       i. This must be PS256.

b.  https://openbanking.org.ul/iat

       i. This must be in the past, a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time.

c.  https://openbanking.org.uk/iss

      i. This value must match the subject of the signing certificate.

Step 3: Compute the JWS. The signer must compute the signature as a detached JWS.

Step 4: Add the JWS as a HTTP Header. The signer must include an HTTP header called x-jws-signature with its value set to the signature computed in Step 3.

NOTE: All Dynamic Client Registration API response and PISP response messages sent to a TPP will be signed by PTSB’s QSealC certificate. The API response messages sent to the TPP will be accompanied by the “x-jws-signature” in the header. TPPs should use our well-known configuration endpoint and from here they will use the "jwks_uri":" to retrieve the PTSB QSealC Certificate for signature validation.

Alert: Please ensure that there are no trailing spaces or lines at the end of the JWT request body.

API

Version

Guide