Account Broker
/
Overview
/
Glossary
API Diagram
Decision Tree
Overview
Client App Integrates with Account Broker API
The third-party client (e.g. fintech app) integrates with the Account Broker API.
This API is exposed by AHS, which is a licensed AISP.
The Account Broker API serves as a bridge between client-facing apps and Open Banking-compliant bank APIs (ASPSPs).
PSU Accesses Client App
The end user (PSU) logs into the client app and initiates the journey to view their banking data.
The client app invokes the Account Broker API to begin the data access process.
User is shown a checkbox asking "Do you consent to retrieve and reuse your existing banking consent?"
If the user selects it, consent reuse logic is triggered.If not selected, the app may redirect the user to initiate a new consent journey.
Consent Management via Core Platform
Since Account Broker (AHS) is AISP-licensed and operates its own core platform, it securely persists existing consents and access tokens.
If the checkbox was selected, the system
Validates existing consent and token (against OrganisationID, UserID, and ASPSPID).
Reuses consent only if it’s valid, active, and scoped correctly.
If no valid consent exists, the app may prompt for new authorisation.
No separate redirect to the bank is initiated unless consent reuse fails.
Handling Multiple Consents
A PSU may grant consent via multiple client apps.
The platform persists each consent uniquely using a composite key:
OrganisationID
UserID
ASPSPID
A unique consent reference is generated and returned to the client app for future API requests.
API Call to ASPSP for Data or Payment Execution
The Account Aggregation Consumer Service within the core platform is triggered.
It makes API calls to the appropriate ASPSPs using the stored consent and access token.
The APIs called include:
accounts
balances
transactions
Core Platform Acts as Proxy – Minimal Business Logic
The core platform does not implement critical business logic.
It acts purely as a secure data vehicle, fetching and relaying banking data from ASPSPs to the client app via the Account Broker API.
Data Delivered to Client App
The requested account data is securely returned via the Account Broker API to the client app.
The PSU can now view their financial data aggregated from multiple ASPSPs.
Consent Reuse in Future Calls
On future API requests, the client app uses the unique consent reference to retrieve data without repeating the consent flow.
Core platform validates consent reference and access token behind the scenes.