Web Redirection Encryption

Overview

This API is used by the Financial Information User (FIU) to generate an encrypted web redirection URL for the Account Aggregator (AA). The generated URL enables users to provide consent for data sharing through the AA’s application interface. The URL can be embedded in an iframe within your application or opened directly in a web browser, allowing users to complete their consent approval or rejection on the AA platform.

Authentication

This API requires the following authentication headers to be included with every request:

Header	Type	Required	Description
`client_id`	string	Yes	An API key issued to your organisation for authentication purposes
`client_secret`	string	Yes	A secret API key issued to your server-side application for secure authentication
`organisationId`	string	Yes	A unique identifier assigned to your organisation by the platform
`appIdentifier`	string	Yes	A unique identifier assigned to your client application for tracking API usage
`Content-Type`	string	Yes	Must be set to `application/json` to specify the request body format

Request Body

The unique consent handle identifier received in response to a consent request. This can be either a single consent handle string for one consent, or an array of consent handle strings for multiple consents.Format: Must be a valid UUIDv4 format (e.g., 3a3f2d96-fc3b-42e5-804f-e65d10a4be98)Note: When passing multiple consent handles, they must all belong to the same user’s Virtual User Account (VUA).

string

The URL where the user should be redirected after completing their consent journey on the Account Aggregator platform. Use this parameter when you need to override the default redirect URL configured for your FIU organisation.Example: https://www.yourapp.com/consent-callback

string

The Permanent Account Number (PAN) of the user. This is required for certain Financial Information Providers (FIPs) that mandate PAN for account discovery purposes.Format: Must match the pattern ^[A-Z]{5}[0-9]{4}[A-Z]{1}$ (e.g., ABCDE1234F)Note: Only provide this when integrating with FIPs that require PAN for account linking.

string

The Date of Birth of the user, supplied as an additional weak identifier for account discovery at Financial Information Providers that mandate it (per Sahamati’s additional-identifiers requirement).Format: Accepts either DDMMYYYY or YYYY-MM-DD (e.g., 1990-05-21). The platform normalises it to YYYY-MM-DD before carrying it to the Account Aggregator in the encrypted redirection parameter set, so no conversion is required on your side.Note: Only provide this when integrating with FIPs that require the Date of Birth for account discovery. A value matching neither format is rejected with a validation error.

Response

string

Indicates the overall status of the API request. Possible values include success or failure.

string

The current version of the API being used for this request.

string

A human-readable message describing the result of the API call, providing success confirmation or failure details.

object

Show data properties

string

required

The encrypted web redirection URL containing all necessary parameters for the AA consent flow. This URL includes encrypted parameters in the ecreq field, along with the AA URL, request date (reqdate), and FI identifier fields. You can embed this URL in an iframe or open it in a browser for the user to complete their consent.

string

The timestamp indicating when the transaction was processed, in ISO 8601 format.

Example Request

{
  "consentHandle": "3a3f2d96-fc3b-42e5-804f-e65d10a4be98",
  "redirectUrl": "https://www.yourapp.com/consent-callback",
  "pan": "ABCDE1234F",
  "dob": "1990-05-21"
}

Example Response

{
  "ver": "1.15.0",
  "status": "success",
  "data": {
    "webRedirectionURL": "https://aa-platform.com/consent?ecreq=encrypted_data_here&reqdate=040320211217240&fi=encoded_entity_id"
  },
  "message": "Success",
  "timestamp": "2025-04-07T12:21:16.000Z"
}

Error Responses

When an error occurs, the API returns a JSON object with the following structure:

{
  "ver": "1.15.0",
  "timestamp": "2025-04-07T12:21:16.000Z",
  "errorCode": "FP0021",
  "errorMsg": "Required parameters missing : Both consentID and consentHandle are empty",
  "status": "failure",
  "txnid": "f32503c5-0af0-4831-a443-7adc500ccd22"
}

Error Code Catalogue

Error Code	Status	Description	Common Causes
`FP0021`	missingConsentInfo	Required parameters are missing from the request	The `consentHandle` field is empty, null, or not provided in the request body
`InvalidRequest`	InvalidRequest	The consent handle format is invalid	The `consentHandle` is not a valid UUIDv4 format, or contains all zeros
`FP0024`	InvalidRequest	Multiple consent handles belong to different users	When passing an array of consent handles, they must all be associated with the same user’s VUA
`FP0024`	invalid_consent_handle	The provided consent handle does not exist	The consent handle is not found in the system or does not have a valid customer VUA
`FP0029`	InvalidAA	The Account Aggregator handle is invalid	The AA handle derived from the user’s VUA does not exist in the account aggregators registry
`InvalidRequest`	InvalidRequest	The redirect URL format is incorrect	The `redirectUrl` field must be a valid string when provided
`InvalidRequest`	InvalidRequest	The PAN format does not match requirements	The `pan` field does not follow the required pattern `^[A-Z]{5}[0-9]{4}[A-Z]{1}$`
`InvalidRequest`	InvalidRequest	The Date of Birth format does not match requirements	The `dob` field is neither a valid `DDMMYYYY` nor `YYYY-MM-DD` date

Usage Notes

Security Consideration: The encrypted URL contains sensitive parameters. Ensure you transmit this URL over HTTPS only and do not log or cache it in plain text format.
Single vs Multiple Consents: You can pass either a single consent handle string or an array of consent handle strings. When using multiple consent handles, ensure all of them belong to the same user to avoid errors.
Iframe Integration: When embedding the URL in an iframe, ensure your application has the appropriate X-Frame-Options and Content Security Policy settings to allow iframe embedding from the AA domain.
Browser Compatibility: If opening the URL in a new browser window or tab, inform users that they may need to allow pop-ups for your application domain.
Redirect URL Override: The redirectUrl parameter is optional and should only be used when you need to override the default redirect URL configured for your organisation. If not provided, the system will use the default redirect URL set during your FIU onboarding.
PAN Requirements: Only include the pan parameter when integrating with Financial Information Providers that require PAN for account discovery. Providing PAN when not needed may cause unnecessary data exposure.
Date of Birth Requirements: Only include the dob parameter when integrating with Financial Information Providers that require the Date of Birth as an additional identifier for account discovery. Provide it as DDMMYYYY or YYYY-MM-DD; the platform normalises it to YYYY-MM-DD before carrying it to the Account Aggregator, so no conversion is required on your side.
Consent Handle Validation: Always ensure the consent handle is in valid UUIDv4 format before making the API call to avoid validation errors.

Rate Limiting

This API is subject to rate limiting with the following limits:

Limit: 1000 requests per time window
Remaining: Returned in the X-RateLimit-Remaining header
Reset: The time when the rate limit resets, returned in the X-RateLimit-Reset header

Monitor these headers in the API response to ensure you stay within the allowed rate limits.

Authorizations

client_id

string

header

required

Your unique client identifier provided by MoneyOne during FIU onboarding

client_secret

string

header

required

Your confidential client secret provided by MoneyOne

organisationId

string

header

required

Your organization's unique identifier in the FinPro system

appIdentifier

string

header

required

Application-specific identifier for tracking API calls

Body

application/json

Request body for generating an encrypted web redirection URL for Account Aggregator consent flow.

redirectUrl

string<uri>

Example:

"https://www.yourapp.com/consent-callback"

pan

string

The Permanent Account Number (PAN) of the user. This is required for certain Financial Information Providers (FIPs) that mandate PAN for account discovery purposes.

Pattern: ^[A-Z]{5}[0-9]{4}[A-Z]{1}$

Example:

"ABCDE1234F"

dob

string

The Date of Birth of the user, supplied as an additional weak identifier for account discovery at Financial Information Providers that mandate it (per Sahamati's additional-identifiers requirement). Accepts either DDMMYYYY or YYYY-MM-DD format; the platform normalises it to YYYY-MM-DD before carrying it to the Account Aggregator in the encrypted redirection parameter set. Optional.

Pattern: ^((0[1-9]|[12][0-9]|3[01])(0[1-9]|1[0-2])[0-9]{4}|[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01]))$

Example:

"1990-05-21"

Response

Encrypted URL generated successfully

Response containing the encrypted web redirection URL for Account Aggregator consent flow.

status

enum<string>

Indicates the overall status of the API request.

Available options:

success,

failure

ver

string

The current version of the API being used for this request.

message

string

A human-readable message describing the result of the API call, providing success confirmation or failure details.

data

object

Container for the encrypted URL data.

Show child attributes

timestamp

string<date-time>

The timestamp indicating when the transaction was processed, in ISO 8601 format.

Consent Management

Data Management

Bulk Operations

Web Redirection

User Management

Analytics

Miscellaneous

Overview

Authentication

Request Body

Response

Example Request

Example Response

Error Responses

Error Code Catalogue

Usage Notes

Rate Limiting

Authorizations

Body

Response

​Overview

​Authentication

​Request Body

​Response

​Example Request

​Example Response

​Error Responses

​Error Code Catalogue

​Usage Notes

​Rate Limiting

Authorizations

Body

Response

Overview

Authentication

Request Body

Response

Example Request

Example Response

Error Responses

Error Code Catalogue

Usage Notes

Rate Limiting