← All documentation

Confirmation of funds

For card-based payment instrument issuers (CBPII) under PSD2 Art. 65.

Prerequisite

A consent of type cbpii, authorised by the customer. An account-information consent cannot be used here — the two grant different things, and a data consent must not become a way to poll someone’s solvency. Trying returns CONSENT_UNKNOWN.

Your certificate must carry the PSP_IC role, or you get ROLE_INVALID.

Creating that consent

It has its own endpoint. POST /v1/consents creates account-information consents only and will not give you one that works here.

curl -X POST https://xs2a.paysaxas.com/v1/consents/confirmation-of-funds \
  --cert qwac.pem --key qwac.key \
  -H "Content-Type: application/json" \
  -H "X-Request-ID: 0f9c1a2e-8f1a-4f57-9a1e-0f4b1b6c9d21" \
  -H "TPP-Redirect-URI: https://your-app.example/psd2/return" \
  -d '{
        "account": {"iban": "FI2112345600000785"},
        "cardNumber": "4111111111111111",
        "cardExpiryDate": "2028-05-31"
      }'

• One account, named directly — not an access list. A funds confirmation answers a boolean about a single account.
• cardNumber and cardExpiryDate are optional. We keep only the last four digits of the card number; the full number is never stored.
• The response is the same shape as any consent creation — consentId, authorisationId, and _links.scaRedirect. Send the customer to scaRedirect; the consent is not usable until they authorise it.
• Read, poll and revoke it at /v1/consents/confirmation-of-funds/{consentId}, …/status and DELETE.

Request

curl -X POST https://xs2a.paysaxas.com/v1/funds-confirmations \
  --cert tpp-qwac.pem --key tpp-qwac.key \
  -H "Content-Type: application/json" \
  -H "X-Request-ID: 1a7c9d2e-77d2-4a1c-9e6b-5a3f1b2c8d90" \
  -H "Consent-ID: PSXS-CONSENT-9a1c..." \
  -d '{
        "account":          {"iban": "FI2112345600000785"},
        "instructedAmount": {"currency": "EUR", "amount": "125.50"}
      }'

Response

{ "fundsAvailable": true }

That is the entire response, and it always will be. No balance, no shortfall, no account status, no reason. PSD2 entitles you to a yes or a no; anything more would be a running read on the customer’s finances that no consent covers.

Our own tests assert the response has exactly one key, so a future addition cannot slip in unnoticed.

Notes

• cardNumber may be sent here and is informational only. It is not matched against the consent and does not scope the answer — the consent names an account, and the answer is about that account’s funds. We do not store it. If you need the card on record, declare it when creating the consent, where we keep the last four digits as provenance.
• EUR only; another currency returns PRODUCT_INVALID.
• The check uses the same available-balance definition the customer sees in their portal, so you and they cannot disagree about whether the money is there.
• An amount exactly equal to the available balance returns true.
• The account must be covered by the consent; anything else returns CONSENT_INVALID — including an account belonging to someone else, which is indistinguishable on purpose.
• Every check is logged for supervisory traceability.