UK Open Banking Conformance Profile
The UK Open Banking conformance profile is available on CONTRACT tier accounts only. This profile requires the uk_open_banking_conformance entitlement. Contact your account manager to enable it. See plan availability and pricing.
The UK Open Banking conformance profile verifies that your API meets the UK Open Banking Security Profile, which is based on Financial-Grade API (FAPI) standards and required for PSD2-compliant Open Banking implementations.
What it checks
| Check | Description |
|---|---|
| MTLS or private_key_jwt | The client authenticates using Mutual TLS or private_key_jwt (not client_secret_basic) |
| PKCE + state parameter | Authorization Code flows use PKCE with a state parameter |
x-fapi-interaction-id header | Responses echo the x-fapi-interaction-id request header |
x-fapi-auth-date / x-fapi-customer-ip-address | Required headers are present in TPP-originated requests |
| Consent IDs in responses | Account and payment APIs return consent resource IDs |
| TLS 1.2+ | All connections use TLS 1.2 or higher |
| JARM (JWT Secured Authorization Response Mode) | Where required by the profile level |
To turn the profile on, see Enable a standards profile, which lists the four UK Open Banking profiles in Manage Standards Profiles.
Relationship to FAPI
The FAPI-RW-ID2 (FAPI Read/Write) checks are part of the UK Open Banking (TLS Client Auth) and UK Open Banking (Private Key JWT) profiles. The v4 profiles do not include them. FAPI-RW-ID2 is not a separate option in Manage Standards Profiles. For the current FAPI baseline, see FAPI 2.0.
For where results appear and how to read them, see Enable a standards profile.
See also
- API Conformance capabilities: continuous conformance checking with drift detection and audit trails
- Enable a standards profile
- Conformance overview
- FAPI 2.0 profile