Implement Berlin Group NextGenPSD2 consent for multi-bank account information aggregation covering the full consent lifecycle
domain: berlin-group.org · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
POST /consents to the ASPSP's AIS consent endpoint with a body specifying access (accounts, balances, transactions — set allPsd2: allAccounts for broad access where supported), recurringIndicator: true, validUntil (ISO date), and frequencyPerDay
Redirect the PSU to the ASPSP's SCA authorization page using the _links.scaRedirect URL from the consent response; after SCA the PSU is redirected to your TPP redirect URI with the consentId in the query string
Confirm the consent status by GET /consents/{consentId}/status; wait for status 'valid' before making data calls — status 'received' means the consent exists but SCA has not yet completed
Access account data using the consentId as the Consent-ID header on all AIS calls: GET /accounts, GET /accounts/{accountId}/balances, GET /accounts/{accountId}/transactions?dateFrom=YYYY-MM-DD&dateTo=YYYY-MM-DD&bookingStatus=booked
Renew the consent before validUntil by creating a new consent and re-authorizing; unlike UK Open Banking, Berlin Group has no built-in confirmation-only renewal — a new full SCA is typically required
Revoke a consent when no longer needed via DELETE /consents/{consentId}; also handle inbound PSU-initiated revocation by polling GET /consents/{consentId}/status and treating 'revokedByPsu' as a terminal state
Known gotchas
frequencyPerDay limits the total number of times you may call the ASPSP's data endpoints per 24-hour period using the consent; setting this too low during consent creation will cause 429 errors before the day ends — set it to the maximum the ASPSP allows and manage your own internal rate limiting
The allAccounts access type is optional under the Berlin Group standard; many ASPSPs only support detailed account-by-account consent where the PSU selects specific accounts — do not assume allPsd2: allAccounts will work without checking the ASPSP's NextGenPSD2 profile
validUntil is hard-enforced by the ASPSP; a consent that expires overnight will cause all data calls to return 401 starting at midnight on the expiry date — implement expiry monitoring with at least 48-hour advance renewal attempts to avoid data outages
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?