Implement UK Open Banking VRP sweeping consent: create mandate, authenticate once, and initiate subsequent payments without per-payment SCA

Steps

1. Register as a PISP with your ASPSP and obtain OAuth2 scopes including 'payments' and 'recurring-payments:sweeping'
2. POST /domestic-vrp-consents with ControlParameters specifying MaximumIndividualAmount, PeriodicLimits, ValidFromDateTime, ValidToDateTime, and CreditorAccount; attest in the request that the use case qualifies as sweeping (funds moving between accounts owned by the same PSU)
3. Redirect the PSU through the ASPSP's authorization endpoint; the ASPSP applies the 'Payment to Self' or 'Trusted Beneficiary' SCA exemption so only one strong authentication is required at mandate setup
4. Exchange the authorization code for a VRP consent access token; store the ConsentId and the token for reuse
5. Initiate each recurring payment by POST /domestic-vrp-payments with the ConsentId plus per-payment fields (InstructedAmount, DebtorAccount, CreditorAccount); no further PSU interaction is required while the mandate constraints are satisfied
6. Monitor the VRP consent status via GET /domestic-vrp-consents/{ConsentId} and refresh the mandate before ValidToDateTime expires to avoid payment failures