BIAN · Consent Administration

Consent

:8081 · openbank-consent

The trust anchor for UK Open Banking. Owns the full consent lifecycle for account-access, domestic-payment and funds-confirmation — every other service validates against it.

View on GitHubThe whole estate ↗

What it is

The Consent microservice implements the BIAN Consent Administration service domain. It owns the OBIE consent lifecycle — AwaitingAuthorisation → Authorised → Consumed/Revoked — for all three consent types in the estate. The AISP, PISP and CBPII services never store consent themselves; they validate against this service before acting.

DEPENDS ON No upstream dependencies
USED BY openbank-accountsopenbank-paymentsopenbank-fundsopenbank-party

Key endpoints

Speaks the OBIE contract on the wire. A selection of the endpoints this service exposes:

MethodPathPurpose
POST/account-access-consentsCreate an AIS (account information) consent
POST/domestic-payment-consentsCreate a PIS (payment) consent
POST/funds-confirmation-consentsCreate a CBPII (funds) consent
POST/internal/consents/{id}/authoriseStand-in for PSU authentication → Authorised
GET/internal/consents/{id}Service-to-service consent projection

Run it — zero infrastructure

Clone the repo and start the service with an in-memory store. No database required to try it.

# clone and run (in-memory store, no infra)
git clone https://github.com/Sreenivas-Sadhu-Prabhakara/openbank-consent.git
cd openbank-consent && go run .

# it is now serving OBIE on :8081
curl localhost:8081/health

FAQ

What is a consent in UK Open Banking?
A consent is the customer’s explicit, scoped and time-boxed authorisation for a third party to read specific data or initiate a specific payment. In OBIE it has a type (account-access, domestic-payment, funds-confirmation), a set of permissions, and a lifecycle from AwaitingAuthorisation through Authorised to Consumed or Revoked.
Why is Consent the “trust anchor”?
Because no other service trusts the caller’s claim. Accounts, Payments, Funds and Party each fetch and validate the consent from this service — its status, type, permissions and expiry — before releasing data or moving money. Authorisation is enforced in one place, in code.
Is openbank-consent production-ready?
No. It is an educational reference implementation. The FAPI security profile (OAuth2/OIDC, MTLS, signed request objects) is stubbed, and an internal endpoint stands in for the PSU authentication redirect. Do not use it as-is for real customer data or live payments.

Explore the estate

openbank-bian rebuilds UK Open Banking as five consent-first services. Explore the rest:

▲ openbank-bian — overview Accounts :8082 Payments :8083 Funds :8084 Party :8085