(NEW) Sandbox Test Accounts and Test Data

Testing will be performed against the finAPI Demobank as of 19 Mar 2025 . This will be replacing the testing against the Mock Server described in (OLD) Sandbox Test Accounts and Test Data

General information

XS2A Sandbox has predefined test data that can be used for test purposes:

PSU-IDs
PSU passwords
accounts
balances
transactions

You are not allowed to create your own test data besides consents and payments.

Important: in XS2A, Sandbox-created payments don't have an impact on balances and transactions. It means that an authorised payment will not be listed as a transaction on the accounts that were used as debtor and creditor accounts in the payment.

PSU-ID credentials

PSU-ID	Password	Supported SCA
aspsp1	aspsp1	Embedded, decoupled Decoupled is completed successfully by default.
aspsp2	aspsp2	Embedded, decoupled Decoupled is completed successfully by default. This user has a card account (accountId `e5ac1396-3f68-4b27-96d3-1c53e0d159d3`).
aspsp3	aspsp3	Embedded, decoupled Decoupled is completed successfully by default.
aspsp3_single	aspsp3_single	Embedded The XS2A Server automatically selects the SCA method for this user, as it only supports `CHIP_OTP`.
aspsp3_no_redirect	aspsp3_no_redirect	Embedded, decoupled Decoupled is completed successfully by default. This user has no support for redirect and returns an error (HTTP status `406`) if the redirect would be used.
aspsp4	aspsp4	Embedded, decoupled Decoupled is completed successfully by default.
aspsp5	aspsp5	Embedded, decoupled Decoupled is completed successfully by default.
aspsp6	aspsp6	Error case. An error will be returned during the SCA process.

PSU accounts

PSU-ID	accountId	accountName	product	iban	bban	pan	maskedPan	bic	currency
aspsp1	d431999a-ebdd-4c50-8bdb-46206cc78bea	Müller	Card Account	DE54500105173424724776	4500105173424724776	AEYPM5403H	PM5403H****	DEUTDE8EXXX	EUR
aspsp2	7950b8e8-8904-4bd8-a688-49008e1a2817	Müller	Card Account	DE89370400440532013000	9370400440532013000	FFGHPM5403H	HPM5403H****	DEUTDE8EXXX	USD
aspsp2	4ec5766c-ea3b-4fa8-97c7-3d092189b6b4	Müller	Current Account	DE75512108001245126199	5512108001245126199	QWEPM6427U	PM6427U****	DEUTDE8EXXX	USD
aspsp2	0038ab74-c0dd-49f2-a98e-dbbb6d0c8e36	Schmidt	Card Account	LU280019400644750000	80019400644750000	EWQPS8534R	PS8534R****	DEUTDE8EXXX	EUR
aspsp2	e5ac1396-3f68-4b27-96d3-1c53e0d159d3	Mary Müller	Card Account	DE89370121210532012121	9370121210532012121	HHTZPO1212M	PO1212M****	DEUTDE8EXXX	USD
aspsp3	cca06e68-6dc0-4744-b0c3-6a1cc8487532	Schmidt	Card Account	DE91100000000123456789	1100000000123456789	ASDPS9547Z	PS9547Z****	DEUTDE8EXXX	USD
aspsp3_single	34f2d343-0bf3-4ae7-8916-7f7b5dc95454	Schmidt	Card Account	DE91200000000123456789	1200000000123456789	YXCVS9547Z	RG4547Z****	DEUTDE8EXXX	EUR
aspsp3_no_redirect	a1034ebd-9bff-43bc-b092-ee32acce1315	Moneyless	Card Account	DE91880000000123456789	1880000000123456789	LKJHG9547Z	ZZ4547Z****	DEUTDE8EXXX	EUR
aspsp4	84880312-4099-4a7b-8a30-c2c5dc4cbf4a	Company AG	Card Account	DE27100777770209299700	7100777770209299700	DSACC1876N	CC1876N****	DEUTDE8EXXX	EUR
aspsp4	263d831d-26b6-44ae-bfbc-97d8c4953b37	Company AG	Card Account	DE11520513735120710131	1520513735120710131	CC6427T****	PS9547Z****	DEUTDE8EXXX	USD
aspsp4	42fb4cc3-91cb-45ba-9159-b87acf6d8add	Alexander Mueller	Current Account	DE52500105173911841934	2500105173911841934				EUR
aspsp5	7751e625-94ed-451b-a085-58108b428530	Greenpeace	Current Account	DE24500105172916349286	4500105172916349286				EUR
aspsp5	a58fc8e2-ff56-4c9e-af56-2e8cf8828abe	Telekom	Current Account	DE68500105174416628385	8500105174416628385				EUR
aspsp5	ba72d1b6-ec89-47ac-89c6-279186be19a9	Jochen Mueller	Current Account	DE06500105171657611553	6500105171657611553				EUR
aspsp5	46eca4fb-575b-474d-97f7-c24356516708	Amazon	Current Account	DE49500105175378548627	9500105175378548627				EUR
aspsp6	ed0b787d-e7b7-46a1-ae20-20ba824bfef8	HolidayCheck • Ihr Hotelbewertungs- und Reiseportal	Current Account	DE21500105176194357737	1500105176194357737				EUR
aspsp6	868beafc-ef87-4fdb-ac0a-dd6c52b77ee6	Alexander Mueller	Current Account	DE15086016167627403587	5086016167627403587				EUR

PSU transactions and standing orders

Transactions and standing orders are available for all test PSUs, but not for aspsp1.

Challenge

authenticationType

authenticationMethodID

value

format

comment

CHIP_OTP

chip

current time

ddmm

where dd is [currentDate or currentDate+1] and

mm is [currentMinute or currentMinute+1 or currentMinute-1]

dd - current day in a month

mm - current minutes

SMS_OTP

sms

current time

HHmm

where HH is [currentHour or currentHour+2 or currentHour-2h] and

mm is [currentMinute or currentMinute+1 or currentMinute-1]

HH - 24 hour format

mm - current minutes

Example 1 - authenticationType = SMS_OTP

current time = 17:08

challenge data = 1507 is valid
challenge data = 1608 is valid
challenge data = 1909 is valid

Example 2 - authenticationType = CHIP_OTP

current date and time = 21.01.2019 17:08

challenge data = 2107 is valid
challenge data = 2208 is valid
challenge data = 2009 is NOT valid

How to trigger decoupled SCA

To trigger Decoupled SCA please use authenticationMethodId where authenticationType = PUSH_OTP in the response in Step 3 "Provide PSU password".

Other authenticationTypes trigger Embedded SCA.

Example response in Step 3

JSON

{
  "scaStatus": "psuAuthenticated",
  "scaMethods": [
    {
      "authenticationType": "SMS_OTP",
      "authenticationMethodId": "sms"
    },
    {
      "authenticationType": "CHIP_OTP",
      "authenticationMethodId": "chip"
    },
    {
      "authenticationType": "PUSH_OTP",
      "authenticationMethodId": "push"
    }
  ],
  "_links": {
    "selectAuthenticationMethod": "/v2/transaction-history-authorisation/{authorisationId}"
  }
}

Example request in Step 4 “Provide 2^nd factor”

JSON

{
  "authenticationMethodId": "push"
}

This request will trigger decoupled SCA logic in the XS2A-server and the Bank Mock on the Sandbox.

On default, each decoupled SCA is completed successfully.

To verify the status of the SCA in decoupled case, TPP has to execute an additional call to get payment or consent status, or respective authorization status.