Implement UK Open Banking AIS consent authorization using the FAPI 1.0 Advanced hybrid flow that the Open Banking security profile mandates, not FAPI 2.0
domain: standards.openbanking.org.uk · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Confirm which security profile the target ASPSP directory entry expects: as of the v4 Open Banking API Standard, UK Open Banking uses FAPI 1.0 Advanced, adopted following a Technical Design Authority vote, not FAPI 2.0
Implement the OAuth hybrid flow (not the plain authorization code grant) for the authorization request, since FAPI 1.0 Advanced mandates hybrid grant for UK ASPSPs
Do not implement JWT Secured Authorization Response Mode (JARM) as a UK-specific requirement; it is out of scope for the UK profile even though it is an option within the broader FAPI 1.0 Advanced specification
Use the ID token returned in the hybrid flow's authorization response, rather than JARM, to protect and verify the integrity of the authorization response parameters
Complete mutual TLS or a signed client assertion for token endpoint authentication per the ASPSP's registered client credentials
Known gotchas
Conflating FAPI 1.0 Advanced with the newer FAPI 2.0 Security Profile produces an integration that fails OBIE conformance testing; verify which profile version a given ASPSP's directory metadata actually references before building
Because JARM is optional in the general FAPI spec but excluded from the UK profile, code copied from generic FAPI reference implementations may wire up JARM handling that UK ASPSPs never send
The security profile is set at the standards-body level and can be revised, so check standards.openbanking.org.uk for the currently adopted profile version rather than relying on older blog posts or SDK defaults
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?