TSB OAuth Toolkit (OTK) Server

TSB's OpenID Connect / OAuth2 authorization server (Curity OAuth Toolkit, OTK Server APIs v4.3.1), backing the FAPI-secured OBIE Read/Write services. Exposes the authorize, token, token-revocation, userinfo, JWKS, session, and OIDC dynamic-client-registration endpoints. The OpenAPI 3.0.2 contract and the OpenID Provider discovery document are publicly served at apis.tsb.co.uk; token issuance and protected operations require client credentials and (for account/payment APIs) mutual-TLS with OBIE/eIDAS certificates.

Documentation Provider Profile APIs.io OpenAPI GitHub

TSB OAuth Toolkit (OTK) Server is one of 5 APIs that TSB Bank publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include OAuth, OpenID Connect, Identity, and FAPI. The published artifact set on APIs.io includes an OpenAPI specification and API documentation.

This API exposes 19 operations across 14 paths, organized into 3 resource areas, and defines 14 schemas. It is described by OpenAPI 3.0.2, at version 4.3.1.

Requests are made against a single base URL, https://apis.tsb.co.uk:443/.

19 operations 14 paths 14 schemas 9 GET4 OPTIONS6 POST

Metadata

The identity and technical contract details declared by the specification.

Specification

OpenAPI 3.0.2

API Version

4.3.1

Base URL

https://apis.tsb.co.uk

Authentication

OAuth 2.0

Resource Areas

Authentication & Security 1

TSB OAuth Toolkit (OTK) Server declares 1 security scheme for authenticating requests. It supports OAuth 2.0 (OAuth2) using the implicit flow, exposing 5 scopes.

Paths & Operations 19

Across 14 paths, the API surfaces 19 operations — 9 GET, 4 OPTIONS, 6 POST. They span 3 resource areas: Authorization Server APIs, Resource Server APIs, Token Server APIs. Each is listed below with its method, path, parameters, and response codes.

Authorization Server APIs 14

GET

/auth/oauth/v2/authorize

Initializes an OAuth 2.0 flow using a responsetype. See RFC 6749 (https://tools.ietf.org/html/rfc6749) for more details.

Get_request_authorization 15 params → 200302400401403405500

GET

/auth/oauth/health

An endpoint that can be used to verify your OAuth authentication flow is working correctly. Is only usable if the context variable otk.health.apikey is defined inside the corresponding service policy.

Get_request_health_check 1 param → 200500503

GET

/auth/oauth/v2/authorize/login

Receives a request as the result of a redirect from the /auth/oauth/v2/authorize endpoint. Creates a login page or forwards a request to the consent screen.

Get_request_authorize_login 3 params → 200400403405500

POST

/auth/oauth/v2/authorize/login

Authenticates a user during the OAuth 2.0 responsetype flow OR Authenticates a user during the OAuth 2.0 responsetype using a social platform.

Post_request_authorize_login 10 params → 200302400401403405500

POST

/auth/oauth/v2/authorize/consent

Handles the 'deny' and 'grant' result of a resource owner's decision at the consent page when 'action' is: 'consent', the API returns an HTML page for the user to grant or deny the request. 'grant',…

Post_request_authorize_consent 1 param body → 200302400401403405500

POST

/connect/session/logout

The resource owner deletes his active session on the OAuth server.

Create_resource_owner_logout_ 5 params → 200204400401403405500

OPTIONS

/.well-known/openid-configuration

OpenID Connect Discovery endpoint

Options_getOpenIDDiscovery 3 params → 204400

GET

/.well-known/openid-configuration

OpenID Connect Discovery endpoint

Get_OpenIDDiscovery → 200403405500

OPTIONS

/openid/connect/register

OpenID Connect Dynamic Registration Configuration endpoint

Options_oidc_register 3 params → 204400

POST

/openid/connect/register

OpenID Connect Dynamic Registration endpoint

Post_oidc_register body → 201400403405429500

OPTIONS

/openid/connect/register/{client_id}

OpenID Connect Dynamic Registration Configuration endpoint

Options_oidc_register_config 4 params → 204400

GET

/openid/connect/register/{client_id}

OpenID Connect Dynamic Registration Configuration endpoint

Get_oidc_register_config 2 params → 200400401403405500

OPTIONS

/openid/connect/jwks.json

OpenID Connect jwks endpoint

Options_jwk_set_ 3 params → 204400

GET

/openid/connect/jwks.json

OpenID Connect jwks endpoint

Get_jwk_set_ → 200403405500

Resource Server APIs 2

GET

/openid/connect/v1/userinfo

This API reflects an implementation according to OpenID Connect. This endpoint returns a message with user details. The content depends on the SCOPE associated with the given accesstoken. IMPORTANT:…

Get_userinfo 1 param → 200400401403405500

GET

/connect/session/status

The client requests the session status by passing in the idtoken of the authenticated user. This informs the client if the resource owner is logged in and has a valid session. The session may be acti…

Get_resource_owner_session_status_ 3 params → 200204400401403405500

Token Server APIs 3

POST

/auth/oauth/v2/token

Request accesstoken or refreshtoken using OAuth 2.0 granttype: password authorizationcode refreshtoken clientcredentials urn:ietf:params:oauth:grant-type:jwt-bearer urn:ietf:params:oauth:grant-type:s…

Create_request_token 13 params → 200204400401403405500

POST

/auth/oauth/v2/token/revoke

Revoke an accesstoken or refreshtoken. See RFC 7009 for more details. Section 2.3 of that RFC is not supported.

revoke_token 5 params → 200204400401403405503

GET

/auth/oauth/v2/client/export

The endpoint returns details about a registered OAuth client. This endpoint is disabled by default. If requests fail due to an unknown endpoint, contact the system administrator.

Get_client_details_export_ 2 params → 200204400401403405500

Schemas 14

The contract defines 14 schemas that model the data the API accepts and returns. The most detailed are OpenIDDiscovery (18 properties), SessionObject (10 properties), RequestParametersObject (7 properties), ClientIdObject (7 properties). Each schema is shown below with its type and property counts.

TokenData

object

7 properties

SessionData

object

3 properties 3 required

ExportData

object

3 properties

CustomObject

object

2 properties

ServerObject

object

4 properties

OAuthObject

object

3 properties

SystemEndpointsObject

object

4 properties

OAuthProtectedEndpointsObject

object

2 properties

ClientObject

object

6 properties

ClientIdObject

object

7 properties

SessionObject

object

10 properties

RequestConsentObject

object

2 properties

RequestParametersObject

object

7 properties

OpenIDDiscovery

object

The OpenID configuration document as defined by the specification: http://openid.net/specs/openid-connect-discovery-10.htmlProviderMetadata

18 properties 7 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

Other APIs TSB Bank publishes across the network.

TSB Open Data API

AE Profile APIs.io

TSB Account and Transaction Information API (AIS)

AE Profile APIs.io

TSB Payment Initiation API (PIS)

AE Profile APIs.io

TSB Confirmation of Funds API (CBPII)

AE Profile APIs.io

#OAuth#OpenID Connect#Identity#FAPI

← Back to T APIs

Discovery

Learnings

Guidance

Toolbox

Alignment

API Evangelist LLC

TSB OAuth Toolkit (OTK) Server

Metadata

Authentication & Security 1

Paths & Operations 19

Schemas 14

Specification

Source

API Details

Provider

Explore more

Discovery

Learnings

Guidance

Toolbox

Alignment

API Evangelist LLC

TSB OAuth Toolkit (OTK) Server

Metadata

Authentication & Security 1

Paths & Operations 19

Schemas 14

Specification

Source

More from TSB Bank 4

API Details

Provider

Explore more