What does this API do?
The Account Aggregator Consent API (service: aaconsent) submits a consent request to the Account Aggregator (AA) ecosystem on behalf of a lender. The Account Aggregator acts as an intermediary between lenders (Financial Information Users / FIUs) and Financial Information Providers (FIPs — banks, securities, insurance, pension, and other finance service providers). This API manages the lifecycle of consent artefacts through the Consent Flow, enabling lenders to securely request access to a customer's financial data from multiple sources.
The request payload follows the ReBIT FIU 2.0.0 specification and is Base64-encoded before submission. On success, the API returns a ConsentHandle that can be used to track the consent status downstream.
Supported service providers (via the provider header): Perfios (121), Finvu (122), Saafe (123), NADL (124), CAMSFinserv (125), Onemoney (126), Protean (106).
Note: API version 1.3 (with ReBIT FIU 2.0.0 support) is available for Perfios, FinVu, Protean, Onemoney, and NADL. All other providers use v1.2.
Who can use it?
Lenders (banks and financial institutions) onboarded to the ULI Platform who need to initiate consent-based access to a customer's financial data via the Account Aggregator framework.
Prerequisites
Complete all common platform prerequisites as described in Getting Started with ULI Platform APIs.
Additionally, for this API:
- Subscribe to the Account Aggregator Service in the Platform Dev Portal (separately for Sandbox and Production).
- Obtain the
x-jws-signatureandclient_api_keyvalues from the respective AA service provider during your AA onboarding. Both are required headers. - Construct the request
datapayload as a Base64-encoded string conforming to the ReBIT FIU 2.0.0 consent request specification. - Compute the
hmacas a SHA-256 hash of the raw (pre-encoded) value of thedatafield.
API endpoint
| Environment | URL |
|---|---|
| Sandbox | https://extgw.nonprod.rbihub.io/aaconsent/1.3/en |
| Production | https://extgw.api.rbihub.io/aaconsent/1.3/en |
HTTP method: POST
URL parameters: {ver} = 1.3, {lang} = en
Request headers
| Header | Description | Required | Example |
|---|---|---|---|
Authorization | JWT Bearer token generated via the Authentication and Authorization API | Yes | Bearer EkN-DOsn... |
Content-Type | Must be application/json | Yes | application/json |
client-id | Base64-encoded Client ID issued during onboarding | Yes | pNRxiviTvgBrf7qMANqBVskDYfEa |
provider | AA service provider code: 121 = Perfios, 122 = Finvu, 123 = Saafe, 124 = NADL, 125 = CAMSFinserv, 126 = Onemoney, 106 = Protean | Yes | 121 |
x-jws-signature | JWS signature obtained from the AA service provider during onboarding | Yes | eyJ4NXQiOiJNR... |
client_api_key | API key issued by the AA service provider | Yes | pNRxiviTvgBrf7qMANqBVskDYfEasdWFss1e4121d= |
api-key | 24-character alphanumeric platform API key (optional, reserved for future use) | No | 434950ee34353tty33463399 |
x-env-route | Required only for Sandbox access | Sandbox only | /sb |
Request body
Send a JSON object with the following structure:
{
"meta": {
"ver": "1.3",
"ts": "2024-05-15T17:15:39+0530",
"txncode": "412341231"
},
"data": "<Base64-encoded ReBIT FIU 2.0.0 consent request payload>",
"hmac": "SHA-256 hash of the decoded value of the data field"
}| Field | Description | Required |
|---|---|---|
meta.ver | Version of the request template (e.g., 1.3) | Yes |
meta.ts | Request timestamp in ISO-8601 format | Yes |
meta.txncode | Unique transaction code provided by the lender | Yes |
data | Base64-encoded string of the consent request as per ReBIT FIU 2.0.0 specification. This can include GSTN and other consent types — the platform passes this through to the AA provider without inspection. | Yes |
hmac | SHA-256 hash of the value of the data key (the raw decoded string, not the Base64 value) | Yes |
Response fields
| Field | Description |
|---|---|
result.errcode | Error code. E000 indicates success. |
result.status | success or fail |
meta.txncode | Lender-supplied transaction code |
meta.ver | Response template version |
meta.ts | Timestamp of the request in ISO-8601 format |
data.ver | AA response version |
data.Customer.id | Customer identifier in the format customer_id@AA_identifier |
data.ConsentHandle | Consent handle UUID returned by the AA provider — use to track consent status |
data.timestamp | Timestamp of consent creation at the AA provider |
data.txnid | AA-assigned transaction ID |
signature | Digital signature (SHA256withECDSA) of the data object |
hmac | SHA-256 hash of the data object |
publickey | Platform public key for source verification |
sig-algo | Signing algorithm — SHA256withECDSA |
The response data field also contains the Base64-encoded AA response conforming to ReBIT FIU 2.0.0. The platform passes this through without modification.
Response headers
| Header | Description |
|---|---|
x-jws-signature | JWS signature received from the AA service provider response |
Error codes
| Error Code | Description |
|---|---|
E096 | x-jws-signature header is missing |
E097 | client_api_key header is missing |
Refer to the latest Platform Error Code document available in the Platform API Spec folder for all platform-level error codes.
Who to contact?
For integration support, email support@rbihub.in with the following details:
- Service Name: Account Aggregator Details
- Platform Environment: Sandbox / Production
- Service Provider: Perfios / Finvu / Saafe / NADL / CAMSFinserv / Protean / Onemoney
- Request Headers sent to the platform
- Error Code and Error Message received
- Screenshot or log of the error
- Status of prerequisites: IP Whitelisting, URL Whitelisting, Service Subscription, Token Generation
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article