Exchange registered provider client authentication and existing consumer direction for a data-only token

POST/open-banking/tokens

Authenticate using an existing dedicated provider client_credentials token with exactly openbanking:exchange. The returned third_party bearer lasts at most 60 seconds, has only openbanking:data:read and fixes provider/customer/consent version/purpose/fields/accounts. No owner session, refresh token, API key or operational authority is issued. The credential generation is rechecked on each read; raw bearer secrets are never stored.

Headers

Idempotency-KeystringOptional

Send on every write that creates or changes money or state; a replay with the same key returns the original result with 200.

Body parameters

consent_idstringRequired

Returns

200 OK

access_tokenstringRequired

The Bearer token, an EdDSA JWT

expires_inintegerRequired

Seconds until it expires

scopestringRequired

The scopes it carries

token_typestringRequired

Bearer

Errors

Every error is a problem document with a stable code. See Errors.

400401403404409412413422424429500503