canonical: https://jentic.com/apis/openbanking.org.uk/account-info-openapi

# Openbanking Account and Transaction API Specification

The UK Open Banking Account and Transaction API (AISP) is the standard interface that account-information service providers use to read PSU bank data from regulated UK banks. It defines 29 endpoints covering account access consents, account lists, balances, transactions, beneficiaries, direct debits, standing orders, statements, products, and parties. The flow uses two OAuth 2.0 schemes: TPP client credentials for consent setup and PSU authorization-code SCA for resource access. Every ASPSP that complies with the standard exposes the same operations under their own /open-banking/v4.0/aisp base path.

## For AI agents

Read UK bank account, balance, transaction, and direct-debit data through the regulated Open Banking AISP standard's 29 endpoints, using consent-scoped OAuth 2.0.

## Scope

Does not initiate payments, confirm available funds, or open new accounts - use for read-only PSU account information access (AISP) only.

## Capabilities

- Create an account-access-consent that the PSU then authorises before any data is read
- List the accounts a PSU has authorised the TPP to access
- Retrieve the latest balance for a single account
- Pull paginated transactions for an account, filtered by date range
- List standing orders, direct debits, and scheduled payments on an account
- Read an account's beneficiaries and statements without storing PSU credentials
- Revoke a granted consent by deleting the corresponding account-access-consent

## Use cases

### Personal Finance Aggregation

Power a personal finance app that aggregates balances and transactions from every UK bank account a user has authorised. After the PSU authorises an account-access-consent, the app calls /accounts to enumerate consented accounts, then /accounts/{AccountId}/transactions and /accounts/{AccountId}/balances to refresh the dashboard. The standard guarantees the same shape across every regulated UK ASPSP, so adding a new bank requires no per-bank schema work.

Example prompt: After consent authorisation, call GET /accounts then loop GET /accounts/{AccountId}/transactions for each account between fromBookingDateTime and toBookingDateTime.

### Affordability and Underwriting Checks

Run affordability checks for credit, lending, or rental decisions by reading 90 days of transactions and recurring payments straight from the borrower's bank. The API exposes /accounts/{AccountId}/standing-orders and /accounts/{AccountId}/direct-debits so an agent can compute committed outflows alongside incoming salary credits, replacing manual statement uploads.

Example prompt: Pull 90 days of transactions via GET /accounts/{AccountId}/transactions, then GET /accounts/{AccountId}/direct-debits and standing-orders, and compute net affordability for the consented account.

### Accounting Bank Feed

Feed UK bank transactions directly into accounting software so SMEs see their ledger update in near-real-time. The TPP creates a long-lived account-access-consent, then schedules calls to /accounts/{AccountId}/transactions to pull deltas. Statements available at /accounts/{AccountId}/statements provide month-end reconciliation evidence.

Example prompt: Schedule a daily GET /accounts/{AccountId}/transactions filtered to the previous day's bookingDateTime range and post each transaction into the accounting ledger.

### Consent Lifecycle Management

Expose a 'connected banks' settings screen where users see active consents and can revoke them on demand. The agent calls GET /account-access-consents/{ConsentId} to read consent state and DELETE /account-access-consents/{ConsentId} to revoke. This is required by the Open Banking standard to give PSUs control over their data.

Example prompt: List active consents from the local store, validate each with GET /account-access-consents/{ConsentId}, and call DELETE /account-access-consents/{ConsentId} for those the user revokes.

### AI Agent Bank Data Tool via Jentic

Give an AI agent a regulated bank-data tool through Jentic. The agent searches Jentic by intent, loads the schema for the specific AISP operation, and executes with the consented PSU access token held in your Jentic One instance. Because consents are scoped to specific accounts and resource types, the agent's blast radius is bounded by what the user authorised.

Example prompt: Use Jentic search 'read uk bank account transactions', load the GET /accounts/{AccountId}/transactions schema, and execute with a consented AccountId and date range.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /account-access-consents | Create a new account-access-consent |
| GET | /account-access-consents/{ConsentId} | Retrieve the state of a consent |
| DELETE | /account-access-consents/{ConsentId} | Revoke a consent |
| GET | /accounts | List authorised accounts for the PSU |
| GET | /accounts/{AccountId} | Retrieve a single account |
| GET | /accounts/{AccountId}/balances | Get the latest balance for an account |
| GET | /accounts/{AccountId}/direct-debits | List direct debits on an account |
| GET | /accounts/{AccountId}/standing-orders | List standing orders on an account |

## Key resources

- **AccountAccessConsents** — Create, retrieve, and revoke the consent objects that scope what the TPP can read.
- **Accounts** — List authorised accounts and read account-level metadata.
- **Balances** — Retrieve current balances per account or across all consented accounts.
- **Transactions** — Pull paginated booked and pending transactions per account, filterable by date.
- **DirectDebits and StandingOrders** — List recurring outflows so analytics tools can compute committed expenditure.
- **Statements** — Retrieve formal statements for an account for a given period.

## Why Jentic

- **Setup:** Wiring the Account and Transaction API by hand means running both the TPP client-credentials and PSU authorization-code OAuth2 flows, managing account-access consents, and handling the AISP base path yourself. Through Jentic you install once, import the Account and Transaction API from the API Directory, store the client credentials once, and your agent calls it.
- **Permission scoping:** The Account and Transaction API puts the consent and account id in the URL path (/account-access-consents/{ConsentId}, /accounts/{AccountId}), so a rule can pin your agent to one consent or account for read access. You choose the operations it may call, so revoking a consent is not included unless you add it.
- **Credential handling:** Your Open Banking client credentials are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list a customer's authorised accounts' or 'read an account balance', and Jentic returns the matching Account and Transaction operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Plaid API** — Aggregator API for bank data across the US, UK, EU, and Canada with a single integration.
- **TrueLayer API** — European Open Banking aggregator providing AISP and PISP behind one API.
- **Open Banking Confirmation of Funds** — CBPII standard for checking whether sufficient funds exist before a card payment.
- **Open Banking Event Notifications** — Standard for ASPSPs to notify TPPs of consent or resource events.

## FAQ

### What authentication does the Open Banking AISP API use?

Two OAuth 2.0 schemes are required by the standard. TPPOAuth2Security uses client_credentials and is used by the TPP to create and manage the account-access-consent. PSUOAuth2Security uses authorization_code with strong customer authentication so the PSU can authorise the TPP to read their data. Through Jentic both tokens are held in the encrypted vault and never enter agent context.

### Can I retrieve transactions for a specific account through this API?

Yes. Once the PSU has authorised an account-access-consent that includes the ReadTransactionsBasic and ReadTransactionsDetail permissions, call GET /accounts/{AccountId}/transactions with optional fromBookingDateTime and toBookingDateTime query parameters to page the booked and pending transactions for that account.

### What are the rate limits for the Open Banking AISP API?

Rate limits are set by each ASPSP rather than the standard itself. The Open Banking specification mandates that ASPSPs publish their limits and that TPPs must back off on HTTP 429. Many large UK banks publish limits in the region of 4 requests per second per consent for transaction calls - always honour the bank's own published numbers.

### How do I revoke a consent through Jentic?

Use the Jentic search query 'revoke an open banking account access consent', select DELETE /account-access-consents/{ConsentId}, load the schema, and execute with the ConsentId. Jentic attaches the TPP client_credentials token from the vault so the call is authorised.

### Can I read standing orders and direct debits with this API?

Yes. With ReadStandingOrdersDetail and ReadDirectDebits in the consent permissions, GET /accounts/{AccountId}/standing-orders and GET /accounts/{AccountId}/direct-debits return the recurring outflows on the account, including amount, frequency, and next-payment date.

### Which UK banks expose this API?

Every regulated UK ASPSP (the CMA9 plus all other authorised banks and building societies) implements this version of the Account and Transaction API at their own /open-banking/v4.0/aisp base path. The same OpenAPI spec describes them all; only the host and authorisation server change per bank.

### Can I limit what my agent is allowed to do with the Open Banking AISP API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials your agent may use. This API puts the consent and account id in the URL path (/account-access-consents/{ConsentId}, /accounts/{AccountId}), so a rule can pin your agent to a single consent or account for read-only calls such as GET /accounts/{AccountId}/balances and GET /accounts/{AccountId}/transactions. You also choose which operations it may call, so a destructive action like DELETE /account-access-consents/{ConsentId} stays off-limits unless you explicitly allow it.