The Payments Service allows a regulated Third-Party Provider (TPP) to initiate supported payment products, retrieve payment details and status, start customer authorisation, request eligible cancellation, create and retrieve signing baskets, and request confirmation of funds.
Use the same SMBC institution endpoint throughout the consent, payment, authorisation, signing-basket and funds-confirmation journey. Resource identifiers are opaque and must not be decoded, altered, constructed from customer-facing information or transferred between institution endpoints.
Authentication
API connectivity uses mutual TLS (mTLS) with the TPP's accepted Qualified Website Authentication Certificate (QWAC).
No HTTP Basic credentials, Authorization header, API key, OAuth2 access token, client credentials, Dynamic Client Registration, application registration or Developer Portal account is used. OpenAPI 3.0.3 does not provide a native mTLS security-scheme type, so the transport requirement is documented in text rather than represented by a misleading HTTP authentication scheme.
Application-layer signing is required for payment creation, payment authorisation, signing-basket creation, and payment cancellation. Read operations do not require Digest, Signature or TPP-Signature-Certificate.
Consent-derived payment access
A valid, authorised Consent ID is required for protected payment operations. The consent permits access to the relevant payment service but does not approve an individual payment. By default, without a prior access-configuration step, payment access through the TPP reflects the PSU's existing SMBC permissions. A corporate customer may optionally configure restrictions for a specific TPP identity outside the XS2A API. These restrictions can reduce, but cannot extend, the access otherwise available to the PSU. Payment authorisation and signing-basket authorisation require separate SCA journeys.
Payment creation does not mean that customer authorisation, SMBC processing or settlement is complete. Use the returned links, authorisation operations and payment-status reports to determine the next action.