Open banking API testing

What open banking API testing covers

A defect in a bank connection repeats for every customer of that bank: a lender reads a stale balance, a ledger sync books a pending payment twice, or a background job keeps pulling data after the customer withdrew consent. Clause references below were checked on 2026-09-16.

Consent and reauthorisation flows

In the Berlin Group NextGenPSD2 OpenAPI definition version 1.3.16 (27 November 2025), a consent is received, rejected, valid, revokedByPsu, expired, terminatedByTpp, or partiallyAuthorised, and HTTP 401 message codes include CONSENT_EXPIRED and CONSENT_INVALID. Tests move each consent through every status and map each one to one product state and one customer message. A product that shows "connected" on an expired consent keeps billing refreshes that return no data.

Reauthorisation rules differ by market, so the suite runs on an injected clock:

• EU. Article 10a of Delegated Regulation (EU) 2022/2360, applicable from 25 July 2023, requires strong customer authentication when the customer accesses balances or last-90-day transactions through an account information provider for the first time, or when more than 180 days have elapsed since that access last used strong customer authentication. Tests run background pulls on day 180 and day 181. Authentication rules are on the PSD2 SCA page.
• UK. Article 36(6) of the UK SCA-RTS, in force from 26 March 2022 under FCA PS21/19, lets an account information provider access data without an active customer request only if the customer confirmed continued consent with that provider within the previous 90 days. Tests check that the day-91 job stops and that reconfirmation restarts access.
• US. The one-year authorisation limit in 12 CFR 1033.421(b) sits in a rule whose compliance dates a court stayed on 29 October 2025. Tests against it are marked as stayed, and the Section 1033 status page holds the current position.
• EU, agreed text. Article 43(2) of the PSR final compromise text (Council document 8221/26) gives the customer a bank dashboard to withdraw consent and re-establish it within 48 hours. Article 43(2b) requires the account information or payment initiation provider to stop accessing and using the data and delete it without undue delay, but not before 48 hours from withdrawal, unless the customer explicitly chooses retention. The PSR is not published in the Official Journal on 16 September 2026; see PSD3 and PSR status.

GDPR Article 5(1)(c) limits personal data to what is necessary for the purpose, so tests check that fields outside the consented data categories are dropped before storage.

Token refresh and access limits

Token tests cover refresh token rotation, a refresh token that expires before the consent, and two workers refreshing one consent at once, where the losing worker holds a revoked token. Article 36(5)(b) of Delegated Regulation (EU) 2018/389 (the RTS) allows access without an active customer request no more than four times in 24 hours, unless the provider and the bank agree a higher frequency with the customer's consent. In NextGenPSD2, frequencyPerDay is at most 4 unless agreed bilaterally, and excess calls return HTTP 429 with ACCESS_EXCEEDED. A retry loop on a failed refresh can spend that allowance before the nightly pull. The consent and token refresh guide shows the requests.

Bank connector coverage

Coverage is recorded per bank, API version, and journey: link, account list, first pull, scheduled refresh, bank downtime, and unexpected fields. A link counts as a success only when it returns at least one account with a balance, because a blended success rate hides a bank that returns empty account lists while connection fees continue. Tests start in each bank's RTS Article 30(5) testing facility, and sandbox and production results are reported separately.

Data normalisation

Tests compare normalised output with the raw bank response for every field a lending or accounting product consumes:

• Sign. The UK Open Banking Read/Write API v4.0.1 transaction model carries an unsigned Amount and a separate CreditDebitIndicator, while NextGenPSD2 signs negative amounts with a minus. A mapper that ignores the indicator turns card spending into income in an affordability check.
• Duplicates. The UK transaction model defines TransactionId as unique and immutable but optional, so deduplication tests cover responses without it, pending entries that book later, and a transaction repeated across pages.

API conformance

Conformance tests check requests and responses against the chosen specification version: required fields, status and error codes, idempotency, and the security profile. The OpenID Foundation conformance suite tests FAPI 1.0 Advanced Final and FAPI 2.0 Security Profile implementations, and its UK Open Banking tests are a superset of the FAPI 1.0 Advanced Final tests. The Open Banking Limited Functional Conformance Tool is a tool that a bank may use as evidence to its competent authority that its PSD2 interfaces are based on an open and widely accepted standard. Interface rules per standard are on the open banking standards page.