si mai multa lume, si mai putini oameni
Despre ..pisiciBlogArhiva blogGalerieSeriiComercialblog rss
 
ING, va alearga cineva
2026-08-25 23:20:15
comentarii(0)
Ziceam ca de vreo 2 saptamani nu mai merge ceva in legatura dintre ING si GoCardless.
ING a publicat pe 23 martie "Breaking Change Announced for PSD2 APIs" in care zice "The current endpoints will be decommissioned per September 1st 2026".
Banuiala mea e ca "Until 1 September 2026, both the current and new endpoints are working in parallel" nu s-a mai intamplat, odata ce statusul s-a schimbat in live.
Iar GoCardless foloseste inca API-ul vechi, asteptandu-se sa functioneze.
Zic ca e banuiala pentru ca in anuntul ING se vorbeste despre AIS / PIS APIs, dar la GoCardless pica fluxul de consimtamant, requisition blocat in UNDERGOING_AUTHENTICATION. Dar pe un alt cont, cu consimtamant valid, totul merge OK - de asta-mi da cu virgula.
ING a retras articolul original si a publicat unul actualizat si am gasit cateva lucruri interesante in diferenta dintre cele doua versiuni:
- "The customer consent itself remains valid" - ceea ce explica de ce pe un cont cu consimtamant valid lucrurile inca mergeau;
- "However, because the existing OAuth 2.0 tokens are not compatible with the new JWS-enabled endpoints, end users will need to perform a new Strong Customer Authentication (SCA)." - deci probabil si autorizarile existente vor trebui trecute prin noul flux;
- Am gasit explicatia erorii pe un flux nou: "Steps to perform" avea 3 pasi, acum are 4. A aparut pasul 3, "Creation and renewal of OAuth2 tokens need to be created by using JWS signatures", iar pasul 4 s-a schimbat din "Call the PSD2 APIs on the new endpoints with JWS signing" in "Call the PSD2 APIs on the new endpoints with JWS signature and OAuth2 tokens created with JWS". Adica endpoint-urile vechi functioneaza, dar nu mai poti obtine un token cu care sa le apelezi, pentru ca emiterea de token-uri cere acum JWS.
Partea buna e ca m-am ales cu o varianta de backup, prin Enable Banking. Partea proasta e ca preturile sunt in spatele lui call us, ceea ce pune vreo 2 zerouri in plus. Poate chiar 3, ca de fapt e we'll call you.
Dar voiam sa ramana aici doua lucruri amuzante.
Primul a fost raspunsul celor de la GoCardless la tichetul de suport: "Our developers keep chasing the bank, however, we wanted to assure you that we haven't forgotten and that we'll keep you updated.".
Al doilea a fost mesajul de la Enable Banking, cand am incercat sa activez 2FA: "SMS unable to be sent until this region enabled by the app developer.". O sa le scriu, poate pun Romania pe harta lor. Here be dragons drones.
Am primit raspuns de la Enable Banking: nu se poate.
Sau altfel zis, no security for you. "Just to let you know that SMS 2FA is supported for paid users."
Mixed feelings: timp de raspuns foarte bun, serviciu OK, dar eroarea nu descrie problema si pare 🤷‍♂️ sa oferi securitatea contului in spatele unui paywall. Adica pot intelege, cu greu, SMS-ul in spatele unui paywall, dar sunt si alte solutii, chiar mai bune, de 2FA.
GoCardless, cu timp de raspuns si mai bun: "According to the bank - until September 1st both the current and new endpoints are working in parallel so this should not be related but we are not excluding it either."
Articolul initial de la ING, cum era disponibil pe 25 august
https://developer.ing.com/openbanking/inspiration/news/breaking-change-announced-for-psd2-apis

Breaking Change Announced for PSD2 APIs

23 Mar 2026

Mandatory Endpoint Migration for Third Party Providers; Enhanced Security with JWS Signing

Introduction

ING is introducing new endpoints for the Account Information Services (AIS) API, Payment Initiation API (PIS), Confirmation on Availability of Funds (CAF) API and the Real-Time Reporting API affecting all PSD2 licensed Third Party Providers (TPPs) and all users of the Real-Time Reporting API.

The current endpoints will be decommissioned per September 1st 2026 and requires all users to migrate from the existing endpoints to new ones that offer advanced security features.

Why are we implementing this breaking change?

The new endpoints support JSON Web Signature (JWS) headers, delivering a higher standard of message integrity and aligning with Open Banking Europe’s specifications.

We have introduced new fields in the Payment Initiation Service that are compliant with changes to the SEPA Rules and NextGen messaging standards.

What do you need to do before 1 September 2026?

We hereby request you to migrate your connection to the new endpoints as per the steps below.

To maintain connectivity, we ask you to review the updated API References of the PSD2 APIs and Real-Time Reporting API and our Get Started Guide on implementing JWS:

  • Account Information Service
  • Payment Initiation Service
  • Confirmation on Availability of Funds Service
  • Real-Time Reporting API
  • Get Started JSON Web Signatures (JWS)

    • Steps to perform:

    • Enable access to the new endpoints by using the PUT /oauth2/applications/{id} - to update the registered application's metadata to ensure that your application is correctly registered in ING’s administration for operational purposes
    • Implement changes related to JWS signing and the new endpoints that you consume.
    • Call the PSD2 APIs on the new endpoints with JWS signing.

      • Take your time to familiarize yourself with the changes and reach out to us if you have any questions or concerns.

      Current endpoints will be deprecated by 1 September 2026?

      Until 1 September 2026, both the current and new endpoints are working in parallel. After this date the current endpoints supporting HTTPS signing will be decommissioned and the breaking change will be enforced. In order to maintain connectivity, please take action as described above.

      Details of Endpoint Changes

      To ensure a smooth transition, below is a table listing the current (old) endpoints and their new replacements:

      APIOld endpointsNewStatus
      PIS APISingle Payment:
      POST /v1/payments/{payment-product}POST /v2/payments/{payment-product}Live
      GET /v1/payments/{payment-product}/{paymentId}GET /v2/payments/{payment-product}/{paymentId}Live
      DELETE /v1/payments/{payment-product}/{paymentId}DELETE /v2/payments/{payment-product}/{paymentId}Live
      GET /v1/payments/{payment-product}/{paymentId}/statusGET /v2/payments/{payment-product}/{paymentId}/statusLive
      POST /v1/payments/pain.001-{payment-product}POST /v2/payments/pain.001-{payment-product}Expected in Q2 2026
      GET /v2/payments/pain.001-{payment-product}/{paymentId}/statusGET /v3/payments/pain.001-{payment-product}/{paymentId}/statusExpected in Q2 2026
      PIS APIPeriodic Payments:
      POST /v1/periodic-payments/{payment-product}POST /v2/periodic-payments/{payment-product}Live
      GET /v1/periodic-payments/{payment-product}/{paymentId}GET /v2/periodic-payments/{payment-product}/{paymentId}Live
      DELETE /v1/periodic-payments/{payment-product}/{paymentId}DELETE /v2/periodic-payments/{payment-product}/{paymentId}Live
      GET /v1/periodic-payments/{payment-product}/{paymentId}/statusGET /v2/periodic-payments/{payment-product}/{paymentId}/statusLive
      POST /v1/periodic-payments/pain.001-{payment-product}POST /v2/periodic-payments/pain.001-{payment-product}Expected in Q2 2026
      GET /v1/periodic-payments/pain.001-{payment-product}/{paymentId}GET /v2/periodic-payments/pain.001-{payment-product}/{paymentId}Expected in Q2 2026
      PIS APIBulk Payments:
      POST /v1/bulk-payments/{payment-product}
      POST /v2/bulk-payments/{payment-product}      		POST /v3/bulk-payments/{payment-product}Live
      GET /v1/bulk-payments/{payment-product}/{paymentId}
      GET /v2/bulk-payments/{payment-product}/{paymentId}      		GET /v3/bulk-payments/{payment-product}/{paymentId}Live
      DELETE /v1/bulk-payments/{payment-product}/{paymentId}DELETE /v3/bulk-payments/{payment-product}/{paymentId}Live
      GET /v1/bulk-payments/{payment-product}/{paymentId}/statusGET /v3/bulk-payments/{payment-product}/{paymentId}/statusLive
      New: GET /v1/bulk-payments/{payment-product}/{paymentId}/extended-statusLive
      APIOld endpointsNewStatus
      AIS APIAccount Information Service:
      GET /v3/accountsGET /v4/accountsLive
      GET /v3/accounts/{account-id}/balancesGET /v4/accounts/{account-id}/balancesLive
      GET /v3/accounts/{account-id}/transactionsGET /v4/accounts/{account-id}/transactionsLive
      GET /v1/card-accounts/{account-id}/transactionsGET /v2/card-accounts/{account-id}/transactionsLive
      APIOld endpointsNewStatus
      CAF APIConfirmation Availability of Funds:
      POST /v2/funds-confirmationsPOST /v3/funds-confirmationsLive
      POST /v2/funds-confirmations/accountsPOST /v3/funds-confirmations/accountsLive
      APIOld endpointsNewStatus
      Real-Time Reporting APIReal-Time Reporting:
      GET /v1/openbanking/accountsGET /v2/openbanking/accountsLive
      GET /v1/openbanking/accounts/{account-id}/balancesGET /v2/openbanking/accounts/{account-id}/balancesLive
      GET /v1/openbanking/accounts/{account-id}/transactionsGET /v3/openbanking/accounts/{account-id}/transactions_standardLive
      GET /v1/openbanking/accounts/{account-id}/transactionsGET /v3/openbanking/accounts/{account-id}/transactions_extendedLive
      GET /v1/openbanking/card-accounts/{account-id}/transactionsGET /v2/openbanking/card-accounts/{account-id}/transactionsLive
      Articolul actualizat de la ING, cum este disponibil pe 27 august
      https://developer.ing.com/openbanking/inspiration/news/breaking-change-announced-for-psd2-apis---updated

      Breaking Change Announced for PSD2 APIs - UPDATED

      23 Mar 2026

      Mandatory Endpoint Migration for Third Party Providers; Enhanced Security with JWS Signing

      Update on 26 August 2026:

      The current signing mechanisms of the PSD2 API will be updated. This change was initially scheduled for 1 September 2026.

      The implementation would impact ING customers, to mitigate the impact we want to extend the deadline. We will come back with a new date by the end of August 2026.

      Introduction

      ING is introducing new endpoints for the Account Information Services (AIS) API, Payment Initiation API (PIS), Confirmation on Availability of Funds (CAF) API and the Real-Time Reporting API affecting all PSD2 licensed Third Party Providers (TPPs) and all users of the Real-Time Reporting API.

      The current endpoints will be decommissioned and requires all users to migrate from the existing endpoints to new ones that offer advanced security features. We will come back with a new deadline end of August 2026.

      Why are we implementing this breaking change?

      The new endpoints support JSON Web Signature (JWS) headers, delivering a higher standard of message integrity and aligning with Open Banking Europe’s specifications.

      We have introduced new fields in the Payment Initiation Service that are compliant with changes to the SEPA Rules and NextGen messaging standards.

      What do you need to do?

      We hereby request you to migrate your connection to the new endpoints as per the steps below.

      To maintain connectivity, we ask you to review the updated API References of the PSD2 APIs and Real-Time Reporting API and our Get Started Guide on implementing JWS:

      • Account Information Service
      • Payment Initiation Service
      • Confirmation on Availability of Funds Service
      • Real-Time Reporting API
      • Get Started JSON Web Signatures (JWS)

        • Steps to perform:

        • Enable access to the new endpoints by using the PUT /oauth2/applications/{id} - to update the registered application's metadata to ensure that your application is correctly registered in ING's administration for operational purposes
        • Implement changes related to JWS signing and the new endpoints that you consume.
        • Creation and renewal of OAuth2 tokens need to be created by using JWS signatures
        • Call the PSD2 APIs on the new endpoints with JWS signature and OAuth2 tokens created with JWS.

          • Take your time to familiarize yourself with the changes and reach out to us if you have any questions or concerns.

          Current endpoints will be deprecated

          Both the current and new endpoints are working in parallel. After the new end date the current endpoints supporting HTTPS signing will be decommissioned and the breaking change will be enforced. In order to maintain connectivity, please take action as described above.

          Is there any impact on existing consents that ING customers have granted for the Account Information Service (AIS), Check Availability of Funds (CAF) and Real-Time Reporting API?

          Yes, existing OAuth 2.0 tokens effectively become unusable for the new JWS-enabled endpoints. Tokens issued under the HTTP-signing model cannot be used when calling endpoints that require JWS.

          The customer consent itself remains valid. However, because the existing OAuth 2.0 tokens are not compatible with the new JWS-enabled endpoints, end users will need to perform a new Strong Customer Authentication (SCA). This allows new OAuth 2.0 tokens to be issued that can be used with the JWS-enabled endpoints.

          Details of Endpoint Changes

          To ensure a smooth transition, below is a table listing the current (old) endpoints and their new replacements:

          APIOld endpointsNewStatus
          PIS APISingle Payment:
          POST /v1/payments/{payment-product}POST /v2/payments/{payment-product}Live
          GET /v1/payments/{payment-product}/{paymentId}GET /v2/payments/{payment-product}/{paymentId}Live
          DELETE /v1/payments/{payment-product}/{paymentId}DELETE /v2/payments/{payment-product}/{paymentId}Live
          GET /v1/payments/{payment-product}/{paymentId}/statusGET /v2/payments/{payment-product}/{paymentId}/statusLive
          POST /v1/payments/pain.001-{payment-product}POST /v2/payments/pain.001-{payment-product}Expected in Q2 2026
          GET /v2/payments/pain.001-{payment-product}/{paymentId}/statusGET /v3/payments/pain.001-{payment-product}/{paymentId}/statusExpected in Q2 2026
          PIS APIPeriodic Payments:
          POST /v1/periodic-payments/{payment-product}POST /v2/periodic-payments/{payment-product}Live
          GET /v1/periodic-payments/{payment-product}/{paymentId}GET /v2/periodic-payments/{payment-product}/{paymentId}Live
          DELETE /v1/periodic-payments/{payment-product}/{paymentId}DELETE /v2/periodic-payments/{payment-product}/{paymentId}Live
          GET /v1/periodic-payments/{payment-product}/{paymentId}/statusGET /v2/periodic-payments/{payment-product}/{paymentId}/statusLive
          POST /v1/periodic-payments/pain.001-{payment-product}POST /v2/periodic-payments/pain.001-{payment-product}Expected in Q2 2026
          GET /v1/periodic-payments/pain.001-{payment-product}/{paymentId}GET /v2/periodic-payments/pain.001-{payment-product}/{paymentId}Expected in Q2 2026
          PIS APIBulk Payments:
          POST /v1/bulk-payments/{payment-product}
          POST /v2/bulk-payments/{payment-product}          		POST /v3/bulk-payments/{payment-product}Live
          GET /v1/bulk-payments/{payment-product}/{paymentId}
          GET /v2/bulk-payments/{payment-product}/{paymentId}          		GET /v3/bulk-payments/{payment-product}/{paymentId}Live
          DELETE /v1/bulk-payments/{payment-product}/{paymentId}DELETE /v3/bulk-payments/{payment-product}/{paymentId}Live
          GET /v1/bulk-payments/{payment-product}/{paymentId}/statusGET /v3/bulk-payments/{payment-product}/{paymentId}/statusLive
          New: GET /v1/bulk-payments/{payment-product}/{paymentId}/extended-statusLive
          APIOld endpointsNewStatus
          AIS APIAccount Information Service:
          GET /v3/accountsGET /v4/accountsLive
          GET /v3/accounts/{account-id}/balancesGET /v4/accounts/{account-id}/balancesLive
          GET /v3/accounts/{account-id}/transactionsGET /v4/accounts/{account-id}/transactionsLive
          GET /v1/card-accounts/{account-id}/transactionsGET /v2/card-accounts/{account-id}/transactionsLive
          APIOld endpointsNewStatus
          CAF APIConfirmation Availability of Funds:
          POST /v2/funds-confirmationsPOST /v3/funds-confirmationsLive
          POST /v2/funds-confirmations/accountsPOST /v3/funds-confirmations/accountsLive
          APIOld endpointsNewStatus
          Real-Time Reporting APIReal-Time Reporting:
          GET /v1/openbanking/accountsGET /v2/openbanking/accountsLive
          GET /v1/openbanking/accounts/{account-id}/balancesGET /v2/openbanking/accounts/{account-id}/balancesLive
          GET /v1/openbanking/accounts/{account-id}/transactionsGET /v3/openbanking/accounts/{account-id}/transactions_standardLive
          GET /v1/openbanking/accounts/{account-id}/transactionsGET /v3/openbanking/accounts/{account-id}/transactions_extendedLive
          GET /v1/openbanking/card-accounts/{account-id}/transactionsGET /v2/openbanking/card-accounts/{account-id}/transactionsLive
          Lasa un comentariu
          Comentariile trebuie aprobate, deci nu vor apărea imediat pe site. E o soluție de moment împotriva spam-urilor.



          Cauta
          //
          Newsletter
          Top 10 - posturi
          01.pentru mine asta e
          02.Give'em hell!
          03.Walk, idiot !
          04.chip_de_lut
          05...
          06.Gratis
          07.Daydream
          08.What if ..
          09.Schimbarea la fata
          10.Standarde
          Arhiva blog
          Link-uri utile:
          Idei de cadouri
          ©Sorin Buturugeanu - 2006-2026. Toate drepturile rezervate. Reproducerea integrala sau partiala a materialului de pe acest site fara acordul autorului este ilegala.