Sandbox Test Accounts and Test Data

General information

XS2A Sandbox has predefined test data that can be used for test purposes:

PSU-IDs
PSU passwords
accounts
balances
transactions

You are not allowed to create your own test data besides consents and payments.

Important: in XS2A, Sandbox-created payments don't have an impact on balances and transactions. It means that an authorised payment will not be listed as a transaction on the accounts that were used as debtor and creditor accounts in the payment.

PSU-ID credentials

PSU-ID	Password	Supported SCA
aspsp1	aspsp1	Embedded, decoupled Decoupled is completed successfully by default.
aspsp2	aspsp2	Embedded, decoupled Decoupled is completed successfully by default. This user has a card account (accountId `12121-999999999`).
aspsp3	aspsp3	Embedded, decoupled Decoupled is completed successfully by default.
aspsp3_single	aspsp3_single	Embedded, decoupled Decoupled is completed successfully by default. The XS2A Server automatically selects the SCA method for this user, as it only supports `CHIP_OTP`.
aspsp3_no_redirect	aspsp3_no_redirect	Embedded, decoupled Decoupled is completed successfully by default. This user has no support for redirect and returns an error (HTTP status `406`) if the redirect would be used.
aspsp4	aspsp4	Embedded, decoupled Decoupled is completed successfully by default.
aspsp5	aspsp5	Embedded, decoupled Decoupled is completed successfully by default.
aspsp6	aspsp6	Error case. The following error will be returned during the SCA process:

PSU accounts

PSU-ID	accountId	accountName	product	iban	bban	pan	maskedPan	bic	currency	paymentId
aspsp1	11111-999999999	Müller	SCT	DE54500105173424724776	4500105173424724776	AEYPM5403H	PM5403H****	DEUTDE8EXXX	EUR	02aa8c9d-182c-483f-ba00-8495f38d23b4
aspsp2	77777-999999999	Müller	SCT	DE89370400440532013000	9370400440532013000	FFGHPM5403H	HPM5403H****	DEUTDE8EXXX	USD
aspsp2	22222-999999999	Müller	SCT	DE75512108001245126199	5512108001245126199	QWEPM6427U	PM6427U****	DEUTDE8EXXX	USD
aspsp2	33333-999999999	Schmidt	SCT	LU280019400644750000	80019400644750000	EWQPS8534R	PS8534R****	DEUTDE8EXXX	EUR
aspsp2	12121-999999999	Mary Müller	SCT	DE89370121210532012121	9370121210532012121	HHTZPO1212M	PO1212M****	DEUTDE8EXXX	USD
aspsp3	44444-999999999	Schmidt	SCT	DE91100000000123456789	1100000000123456789	ASDPS9547Z	PS9547Z****	DEUTDE8EXXX	USD
aspsp3_single	44444-999999999	Schmidt	SCT	DE91100000000123456789	1100000000123456789	ASDPS9547Z	PS9547Z****	DEUTDE8EXXX	USD
aspsp3_no_redirect	44444-999999999	Schmidt	SCT	DE91100000000123456789	1100000000123456789	ASDPS9547Z	PS9547Z****	DEUTDE8EXXX	USD
aspsp4	55555-999999999	Company AG	SCT	DE27100777770209299700	7100777770209299700	DSACC1876N	CC1876N****	DEUTDE8EXXX	EUR
aspsp4	66666-999999999	Company AG	SCT	DE11520513735120710131	1520513735120710131	CC6427T****	PS9547Z****	DEUTDE8EXXX	USD
aspsp4	42fb4cc3-91cb-45ba-9159-b87acf6d8add	Alexander Mueller	SCT	DE52500105173911841934	2500105173911841934				EUR
aspsp5	88888-999999999	Greenpeace	GIRO	DE24500105172916349286	4500105172916349286				EUR
aspsp5	99999-999999999	Telekom	GIRO	DE68500105174416628385	8500105174416628385				EUR
aspsp5	12345-999999999	Jochen Mueller	GIRO	DE06500105171657611553	6500105171657611553				EUR
aspsp5	23236-999999999	Amazon	GIRO	DE49500105175378548627	9500105175378548627				EUR
aspsp6	37289-999999999	HolidayCheck • Ihr Hotelbewertungs- und Reiseportal	GIRO	DE21500105176194357737	1500105176194357737				EUR
aspsp6	868beafc-ef87-4fdb-ac0a-dd6c52b77ee6	Alexander Mueller	GIRO	DE15086016167627403587	5086016167627403587				EUR

PSU transactions and standing orders

Transactions and standing orders are available for all test PSUs, but not for aspsp1.

Challenge

authenticationType

authenticationMethodID

value

format

comment

CHIP_OTP

chip

current time

ddmm

where dd is [currentDate or currentDate+1] and

mm is [currentMinute or currentMinute+1 or currentMinute-1]

dd - current day in a month

mm - current minutes

SMS_OTP

sms

current time

HHmm

where HH is [currentHour or currentHour+2 or currentHour-2h] and

mm is [currentMinute or currentMinute+1 or currentMinute-1]

HH - 24 hour format

mm - current minutes

Example 1 - authenticationType = SMS_OTP

current time = 17:08

challenge data = 1507 is valid
challenge data = 1608 is valid
challenge data = 1909 is valid

Example 2 - authenticationType = CHIP_OTP

current date and time = 21.01.2019 17:08

challenge data = 2107 is valid
challenge data = 2208 is valid
challenge data = 2009 is NOT valid

How to trigger decoupled SCA

To trigger Decoupled SCA please use authenticationMethodId where authenticationType = PUSH_OTP in the response in Step 3 "Provide PSU password".

Other authenticationTypes trigger Embedded SCA.

Example response in Step 3

JSON

{
  "scaStatus": "psuAuthenticated",
  "scaMethods": [
    {
      "authenticationType": "SMS_OTP",
      "authenticationMethodId": "sms"
    },
    {
      "authenticationType": "CHIP_OTP",
      "authenticationMethodId": "chip"
    },
    {
      "authenticationType": "PUSH_OTP",
      "authenticationMethodId": "push"
    }
  ],
  "_links": {
    "selectAuthenticationMethod": "/v2/transaction-history-authorisation/{authorisationId}"
  }
}

Example request in Step 4 “Provide 2^nd factor”

JSON

{
  "authenticationMethodId": "push"
}

This request will trigger decoupled SCA logic in the XS2A-server and the Bank Mock on the Sandbox.

On default, each decoupled SCA is completed successfully.

To verify the status of the SCA in decoupled case, TPP has to execute an additional call to get payment or consent status, or respective authorization status.