FDX API 5.3
Financial Data Exchange (FDX) is an industry body that publishes a common technical standard for sharing consumer-permissioned financial data between banks, data aggregators, and apps. The Financial-Grade API (FAPI) Security Specification v3.4 from FDX is the companion to FDX API v5. It builds on the FAPI 1.0 Advanced and CIBA protocols to secure traffic to an API and to authenticate its end users.
The FDX API 5.3 profile tests against that security specification. It applies to APIs that expose financial data through FDX. When a monitor calls your authorization, token, or resource endpoints, APIContext checks the traffic against a series of checkpoints, from the authorization request through to the resource server response: nine for the No PAR variants and eight for the PAR variant. The checkpoints below describe what each one looks at.
Our implementation of FDX API 5.3 is split into checkpoints, each having multiple checks to confirm whether a particular observation is compliant. This security profile requires you to include your valid MTLS certificate on all the API requests, excluding requests to authorize an endpoint.
To use this profile, select one of its three variants in the Manage Standards Profiles section of Conformance Settings: FDX API 5.3 (No PAR, MTLS), FDX API 5.3 (No PAR, Private Key JWT), or FDX API 5.3 (PAR).
No PAR
Checkpoint 1
Authorization Request Checks
These checks only apply to calls classified as sent to or from the Authorization endpoints and will be looking at the request to these endpoints to ensure the correct information is in the query parameters.
Checkpoint 2
Request JWT Schema Checks
These checks only apply to calls classified as sent to or from the Authorization endpoints and will be looking at the request JWT to these endpoints to ensure the correct information is in the headers, parameters, and payload.
Checkpoint 3
Authorization Response Checks
These checks only apply to calls classified as sent to or from the Authorization endpoints and will be looking at the responses from these endpoints to ensure the correct information is in the URL fragments.
Checkpoint 4
id_token JWT Schema Checks
These checks apply to calls classified as sent to or from the Authorization endpoints and the Access Token endpoints and will be looking at the id_token JWT to ensure the correct information is in the payload.
Checkpoint 5
Token Endpoint Request Checks
These checks only apply to calls classified as sent to or from the Access Token endpoints and will be looking at the requests to these endpoints to ensure the correct information is in the headers and parameters and that the correct HTTP method is being used.
Checkpoint 6
Token Endpoint Response Checks
These checks only apply to calls classified as sent to or from the Access Token endpoints and will be looking at the responses from these endpoints to ensure the correct information is in the headers and parameters.
Checkpoint 7
Access Token Validation
These checks apply to calls classified as sent to or from the Access Token endpoints and the Resource server and will be looking at the access_token JWT to ensure the correct information is in the header and payload.
Checkpoint 8
Resource Server Request Checks
These checks only apply to calls classified as sent to or from the Resource server and will be looking at the requests sent to this server to ensure the correct information is in the header.
Checkpoint 9
Resource Server Response Checks
These checks only apply to calls classified as sent to or from the Resource server and will be looking at the responses from this server to ensure the correct information is in the header and the server returns the correct response code.
PAR
The PAR version of FDX API 5.3 follows the same checkpoints as the No PAR version but skips Checkpoint 2 as there is no JWT for calls using this method.