The Accounts Service allows a regulated Third-Party Provider (TPP) to retrieve account details, balances and booked transaction reports for accounts available under an authorised SMBC XS2A consent.
Use a valid, authorised Consent ID, the same TPP identity and the same SMBC institution endpoint through which the consent was created. The Account Information Service is read-only and does not create, modify or close accounts.
Authentication
API connectivity uses mutual TLS (mTLS) with the TPP's accepted Qualified Website Authentication Certificate (QWAC).
The service does not require a Developer Portal account, application registration, Dynamic Client Registration, client credentials, an API key or an OAuth2 access token. No HTTP Basic credentials or Authorization header is used.
Bank-offered consent model
SMBC uses a bank-offered consent model. The TPP does not nominate individual accounts or permissions. By default, without any prior access-configuration step, the accounts and services available through the TPP match the Payment Service User's existing SMBC permissions. A corporate customer may optionally configure restrictions for a specific TPP identity outside the XS2A API before the consent is used. These restrictions can reduce, but cannot extend, the access otherwise available to the PSU.
Institution-specific resources
Use the institution-specific endpoint for the SMBC institution where the customer's account is held. No separate SMBC branch code is required.
A Consent ID remains associated with the TPP identity, PSU and SMBC institution endpoint under which it was created. It cannot be transferred or reused through another institution endpoint.
Use the opaque resourceId returned by GET /accounts as account-id for account-specific operations. Do not decode it, construct it from an institution, IBAN or BBAN, derive business meaning from it or display it as a customer account number.
Response formats
Account lists, account details and balances are returned as JSON. Transaction reports are returned as camt.053.001.08 XML and require Accept: application/xml.