Page Comparison

• Any AIS consents created after Barclays implementation date for UK accounts will no longer require re-authentication every 90 days
• Any consents that require re-authentication before September 2022 will remain valid for 90 days
• For any AIS consents created with an expiry date, the access expiry date will be aligned to the expiry date provided
• Where consent has been revoked, re-authentication cannot be managed by the third party and a new consent will be required
• For EU accounts re-authentication every 90 days will still be required
• As there is a divergence in the regulatory requirement for UK and EU accounts, where a client has both UK and EU accounts they will no longer be able to include them in one consent and will be required to set up separate consents
• For any existing consents that include both UK & EU accounts post the Barclays implementation date, you will be required to set up separate new consents for each jurisdiction
• There are no changes to Barclays current implementation of Access Tokens.  Third parties should continue to pass OAuth credentials in a Get Access Token call.  In response, the Barclays authorisation server issues an access token, reuse the access token until it expires. When it expires, you can get a new token. When requesting new access token, we recommend a 75 second minimum configuration as the connection timeout

•  

  Accounts

•  

  Transactions (90days)

•  

  Balances

•  

  Standing orders

•  

  Direct debits

•  

  Beneficiaries

•  

  Products

•  

  Offers

•  

  Parties

•  

  Scheduled Payments

•  

  Statements

•  

  Transactions (more than 90days)

•  

  Standing orders

•  

  Direct debits

•  

  Beneficiaries

•  

  Products

•  

  Offers

•  

  Parties

•  

  Scheduled Payments

•  

  Statements

•  None
•  CIBA
•  CIBA FAPI Profile

•  
  client_secret_post
•  
  client_secret_basic
•  
  client_secret_jwt
•  
  tls_client_auth
•  Private_key_jwt

Client secret authentication is not supported

TPPs must align their Open Banking implementations to the following security best practices recommended under FAPI 2

• The request object must contain an exp claim which we recommend to be set to (current time + 5 minutes)

• You must use PS256 algorithms to create the request Object signing

• You must use https://oauth.tiaa.barclays.com as the aud claim in the request Object

• You must use private_key_jwt instead of client secret authentication

• You must receive ID tokens with PS256 signing algorithms

• You must use “response type=code id_token

• We’ll populate the acr claim in the ID token by default

•  eIDAS QWAC
•  eIDAS QSealC
•  OB legacy (obtransport, obsigning)
•  OBWAC
•  OBSeal
•  Other (Please define) 

• eIDAS QWAC and eIDAS QSealC will only be accepted for NON-UK based TPP's. 

•  Yes
•  No

None

Relevant AIS / PIS / CoF journeys supported for following payment account types:

• Current Accounts (Personal and Business)
• Current Accounts (Corporate)
• Savings Accounts (Personal and Business)
• Personal Credit Cards (Barclaycard)
• Corporate Credit Cards
• Currency Accounts (Personal and Business)
• Currency Accounts (Corporate)

See https://developer.barclays.com/ for additional information relating to end point coverage

Note that Account Holder Name for PCA / BCA customers is available through PARTIES end point and through ACCOUNTS end point for Barclaycard UK, Barclaycard Commercial Payment and Barclays Corporate customers

IMPORTANT INFORMATION

In order to complete Open Banking journeys, you will need to establish the Identity Provider (IDP) authentication method for your implementation.

An IDP is a system to authenticate and gain permission from an end user - such as a customer, to access their resources e.g. their account data. For Open Banking, this is used to authenticate the customer providing the consent to the Third Party.

Examples of an IDP in Open Banking includes Barclays app (Personal and Business Banking customers) and iPortal (Barclays Corporate clients), but we have a number of methods depending on the customer type and digital channel that they use. This needs to be considered in your development.

The latest OpenID configuration (OIDC) URLs available are shown below

TPPs are reminded that latest URLS MUST be used and where a legacy URL is still being used then TPP MUST migrate to URLs below

• Personal Banking - https://oauth.tiaa.barclays.com/BarclaysPersonal/.well-known/openid-configuration
• Business Banking* - https://oauth.tiaa.barclays.com/BarclaysBusiness/.well-known/openid-configuration
• Barclays Wealth - https://oauth.tiaa.barclays.com/BarclaysWealth/.well-known/openid-configuration
• Barclaycard UK - https://oauth.tiaa.barclays.com/BarclaycardUK/.well-known/openid-configuration
• Barclaycard Commercial Payments - https://oauth.tiaa.barclays.com/BCP/.well-known/openid-configuration
• Barclays Corporate* - https://oauth.tiaa.barclays.com/BarclaysCorporate/.well-known/openid-configuration

Note - some Business Banking clients will require the Corporate Banking IDP as they use Corporate Banking services to fulfil their business requirements and some Corporate clients will require the Business Banking IDP as they use Business Banking services to fulfil their business requirements

• Use of the Barclays logo is not permitted for marketing purposes
• The Barclays logo can be used for the purposes of identifying and distinguishing, within AIS and/or PIS, Barclays as the source of our Read-only Data and Read/Write Data
• The Barclays logo can also appear in webpages or other materials for the purpose of displaying that the service can connect to Barclays, however this should only be done in conjunction with logos of other major banks.
• There should be no specific identification of Barclays in isolation and no suggestion that Barclays in any way endorses or is partnered with your solution.

https://sandbox.api.barclays:443/open-banking/v3.1/sandbox/aisp

https://sandbox.api.barclays:443/open-banking/v3.1/sandbox/cbpii

https://sandbox.api.barclays:443/open-banking/v3.1/sandbox/pisp