N

1) Open access or regulated access?
Three of our Open Banking APIs are available to everyone, without registration. Our open access APIs are:
• Products and services list
• ATM list
• Branch list.
You need to register in order to work with regulated APIs, and we explain how you do this in Step 3. Once you are registered and depending on your permissions you’ll be able to access:
• Account and Transactions
• Payment Initiation
• Confirmation of Funds
Find a list of our API products and descriptions on Our APIs.

2) Are you registered with the Open Banking directory?
To access our regulated Open Banking APIs, you need to be registered with the Open Banking directory.
Once registered, you’ll be able to use our regulated Open Banking APIs and those provided by any Open Banking compliant bank. However, there are two types of registration: Sandbox and Production.

3) Sandbox or Production?
If you’re new to Open Banking or if you’re using a version of an API for the first time, you’ll need to start with Sandbox access. That gives you read/write access to Sandbox versions of our regulated APIs, using realistic sample data. Registering with the Open Banking directory for Sandbox access is free.
To use our live APIs, you’ll need to be registered in the Open Banking directory for production access. That requires approval from the FCA or an equivalent regulator.

4) Register an app
Once you’re in the Open Banking directory, you can create your first app.
This happens on the Open Banking directory website, where you need to create a Software Statement Assertion (SSA). This is a certificate signed by the Open Banking directory that grants a particular application access to regulated Open Banking APIs.
You then register the SSA to your apps list on the Santander UK Sandbox developer portal.
When the SSA has successfully registered, your client ID and client secret will be displayed on the screen. Please take note of the client secret as this won’t be available on the next screens.

5) Subscribe to APIs
Once your app is registered with Santander UK, you can subscribe to the APIs you want to work with.
You will receive an email confirmation when the subscription is complete.

6) One final check before you can start developing!
The final step is to check on the App page that your application is in “Production” and if that’s a yes, good news that’s you ready to make your first API call and start developing!
However, if your application is in “Development”, you will need to select the “Upgrade to Production” button on your application and wait until the status changes to “Production”.

https://openbanking.santander.co.uk/sanuk/external/open-banking/openid-connect-provider/v1/.well-known/openid-configuration

https://openbanking-sandbox.santander.co.uk/sanuk/external-sandbox/open-banking/openid-connect-provider/v1/.well-known/openid-configuration

Account Information Service

Your first step will be to choose the API(s) you want to test.
Below are some key points you will need to know before getting started:
• Santander’s Sandbox well-known URL - https://openbanking-sandbox.santander.co.uk/sanuk/external-sandbox/open-banking/openid-connect-provider/v1/.well-known/openid-configuration
• Santander’s Sandbox doesn’t include a full consent journey
• For each of our Sandbox APIs there is a list of test scenarios that are available via an excel spreadsheet. These can be found as an attachment on the API overview page (e.g. for Account and Transactions V3.1 you can find them here).

A. Get Token using Client Credential Grant
This is the TLS-MA handshake between yourself and Santander. This step generates the access token known as the "client credential grant" which is valid for ONLY 10 minutes.
Before you start you’ll need to have valid network and signing certificates issued by Open Banking. OB Directory will provide and host the necessary certificates containing the corresponding public keys so that the signature may be verified.

B. Retrieve Account Request
For the next step, you will need the Account Request ID(s) for the scenario you would like to test.
Once you have input the Account ID to the URL, you can make the call. As a response, you will receive a summary of all the permissions given relating to the specific account request ID.

C. Create Request Object
You must then generate the request token (jwt or JSON web token) that will be used as part of the next ‘Authorise Request’ call.
Please refer to OBIE security specification for details on how to generate the Request Object. This request token contains the Resource ID, encrypted based on the security policy defined by Santander and the Open Banking Implementation Entity (OBIE).

D. Invoke Authorise Request
Once the request token is generated, you can invoke the authorisation request. This request will redirect your test application (via a HTTP 302) to Santander’s Login UI.
The password Santander uses is 12345, however, any alphanumeric   combination will work. On clicking submit, you will be redirected back to your test application (based on the redirect URL registered with OB directory). The redirect URL will contain the authorisation code which you need in the next step to generate the access token.

E. Get Token Using Access Code Grant
Copy the code value in the redirection URL from the previous step and use that to generate the Access Token using the authorization code grant. This will give you a green light to commence with the testing!
After the 10 minutes, you will need to call for a refresh token. This gives you longer access by generating a new access token.

F. Get Endpoint Response
To be able to get the endpoint responses, go back to the excel spreadsheet and check what Account IDs are associated with the Account Request ID for which a request token has been generated.
Then copy the Account ID(s) for the test scenario you want to simulate and use those to invoke the POST/GET endpoints.
The excel file can be used as reference as it illustrates the anticipated response associated with the particular Account ID used.

Payment Initiation Service

Your first step will be to choose the API(s) you want to test.
Below are some key points you will need to know before getting started:
• Santander’s Sandbox well-known URL - https://openbanking-sandbox.santander.co.uk/sanuk/external-sandbox/open-banking/openid-connect-provider/v1/.well-known/openid-configuration
• Santander’s Sandbox doesn’t include a full consent journey
• For each of our Sandbox APIs there is a list of test scenarios that are available via an excel spreadsheet. These can be found as an attachment on the API overview page (e.g. for Payment Initiation V3.1 you can find them here).

A. Get Token using Client Credential Grant
This is the TLS-MA handshake between yourself and Santander. This step generates the access token known as the "client credential grant" which is valid for ONLY 10 minutes.
Before you start you’ll need to have valid network and signing certificates issued by Open Banking. OB Directory will provide and host the necessary certificates containing the corresponding public keys so that the signature may be verified.

B. Create Request Object
You must then generate the request token (jwt or JSON web token) that will be used as part of the next ‘Authorise Request’ call.
Please refer to OBIE security specification for details on how to generate the Request Object. This request token contains the Resource ID, encrypted based on the security policy defined by Santander and the Open Banking Implementation Entity (OBIE).

C. Invoke Authorise Request
Once the request token is generated, you can invoke the authorisation request. This request will redirect your test application (via a HTTP 302) to Santander’s Login UI.
The password Santander uses is 12345, however, any alphanumeric   combination will work. On clicking submit, you will be redirected back to your test application (based on the redirect URL registered with OB directory). The redirect URL will contain the authorisation code which you need in the next step to generate the access token.

D. Get Token Using Access Code Grant
Copy the code value in the redirection URL from the previous step and use that to generate the Access Token using the authorization code grant. This will give you a green light to commence with the testing!
After the 10 minutes, you will need to call for a refresh token. This gives you longer access by generating a new access token.

E. POST/GET Endpoint Response
To be able to POST/GET the endpoint responses, go back to the excel spreadsheet, copy the Resource ID corresponding to the test scenario you want to simulate and use that to invoke the POST/GET endpoints.
The excel file can be used as reference as it illustrates the anticipated response associated with the particular Resource ID used.

3.1.2

https://openbanking-ma.santander.co.uk/sanuk/external/open-banking/v3.1/aisp

No variances to specification

Endpoint 1

POST /account-access-consents

-

Y

Mandatory

API Endpoint available

Endpoint 2

GET /account-access-consents/{ConsentId}

-

Y

Optional

API Endpoint available

Endpoint 3

DELETE /account-access-consents/{ConsentId}

-

Y

Mandatory

API Endpoint available

Endpoint 4

GET /accounts

-

Y

Mandatory

API Endpoint available

Endpoint 5

GET /accounts/{AccountId}

-

Y

Mandatory

API Endpoint available

Endpoint 6

GET /accounts/{AccountId}/balances

-

Y

Mandatory

API Endpoint available

Endpoint 7

GET /accounts/{AccountId}/beneficiaries

-

Y

Mandatory

API Endpoint available

Endpoint 8

GET /accounts/{AccountId}/direct-debits

-

Y

Mandatory

API Endpoint available

Endpoint 9

GET /accounts/{AccountId}/product

-

Y

Mandatory

API Endpoint available

Endpoint 10

GET /accounts/{AccountId}/standing-orders

-

Y

Mandatory

API Endpoint available

Endpoint 11

GET /accounts/{AccountId}/transactions

-

Y

Mandatory

API Endpoint available

Endpoint 12

GET /balances

-

N

Optional

API Endpoint not available

Endpoint 13

GET /beneficiaries

-

Y

Optional

API Endpoint available

Endpoint 14

GET /direct-debits

-

Y

Optional

API Endpoint available

Endpoint 15

GET /products

-

N

Optional

API Endpoint available

Endpoint 16

GET /standing-orders

-

Y

Optional

API Endpoint available

Endpoint 17

GET /transactions

-

N

Optional

API Endpoint not available

Endpoint 18

 GET /accounts/{AccountId}/offers

 -

Y

Conditional

Endpoint 19

GET /offers

-

N

Optional

Endpoint 20

GET /accounts/{AccountId}/party

-

Y

Conditional

Endpoint 21

GET /party

-

Y

Conditional

Endpoint 22

GET /accounts/{AccountId}/scheduled-payments

-

N

Conditional

Endpoint 23

GET/scheduled-payments

-

N

Optional

Endpoint 24

GET /accounts/{AccountId}/statements

-

Y

Conditional

Endpoint 25

GET /accounts/{AccountId}/statements/{StatementId}

-

N

Conditional

Endpoint 26

GET /accounts/{AccountId}/statements/{StatementId}/file

-

N

Optional

Endpoint 27

GET /accounts/{AccountId}/statements/{StatementId}/transactions

-

N

Conditional

Endpoint 28

GET /statements

-

N

Optional

Acc-1

Account - Mandatory

OBReadAccount4

Y

OBReadAccount4

Acc-2

Account - Mandatory

Data

Y

OBReadAccount4/Data

Acc-3

Account - Optional

Account

Y

OBReadAccount4/Data/Account

Unambiguous identification of the account to which credit and debit entries are made.

Acc-4

Account - Mandatory

AccountId

Y

OBReadAccount4/Data/Account/AccountId

A unique and immutable identifier used to identify the account resource. This identifier has no meaning to the account owner.

Acc-5

Account - Optional

Status

N

OBReadAccount4/Data/Account/Status

Specifies the status of account resource in code form.

Acc-6

Account - Optional

StatusUpdateDateTime

N

OBReadAccount4/Data/Account/StatusUpdateDateTime

Date and time at which the resource status was updated.

Acc-7

Account - Mandatory

Currency

Y

OBReadAccount4/Data/Account/Currency

Identification of the currency in which the account is held.

Acc-8

Account - Mandatory

AccountType

Y

OBReadAccount4/Data/Account/AccountType

Specifies the type of account (personal or business).

Acc-9

Account - Mandatory

AccountSubType

Y

OBReadAccount4/Data/Account/AccountSubType

Specifies the sub type of account (product family group).

Acc-10

Account - Optional

Description

N

OBReadAccount4/Data/Account/Description

Specifies the description of the account type.

Acc-11

Account - Optional

Nickname

Y

OBReadAccount4/Data/Account/Nickname

The nickname of the account, assigned by the account owner in order to provide an additional means of identification of the account.