What is Open Banking ?
Open banking allows the use of open APIs enabling third-party developers to build applications and services around financial institutions. It comes to bring more financial transparency options for account holders ranging from open data to private data.
Open Banking Functional Conformance Suite
To be able to get the Functional Conformance Certificate, Open Banking provides a Functional Conformance Tool to allow implementers to check if your API has successfully developed all required functional elements of the OBIE Read/Write API Specifications.
This Open Banking tool allows an ASPSP (Account Servicing Payment Service Provider) and a TPP (Third Party Provider) to test the response of any API endpoint and validate that the JSON and data formats meet the schema, permissions and interfaces against the Functional API standard.
How to identify Test Cases covered in the OB Functional Conformance Suite ?
How do you know what else needs to be covered and if there is indeed something more to cover ? After digging into the project on bitbucket, I found some useful json files where you can check the assertions for each test case, the test cases itself and another file to translate the list of the assertions.
So, you can find the asserts that are being done for each test case inside the manifests folder.
For example, this one contains the assertions for this test case: The x-fapi-interaction-id is replayed for an Account. You can find the file with the accounts transactions test cases here.
Then you would need to check what this assertion actually means, and you can find the dictionary of the assertions on this file.
Remember that all the tests currently assume that consent is granted at the ASPSP portal for each requested PSU Consent (Payment Service User Consent).
Also, you will find that some test cases are missing for instance what should happen when you send an invalid token to the payments endpoint, but you can see there is a test case for the accounts endpoints for when you send a token without the required permissions to get a 401 response.
In this example, you can see that for payments the consent model is a bit different because each access token doesn’t have a range of permissions, but is associated with a single payment consent id. So, in order to get a 401 response, the request can present the wrong token along with a payment call or present no token at all. The conformance tool is not sending any token in this instance.
So make sure you are aware and cover the missing test cases with another approach.
I found quite hard to have a straight answer about what are all the test cases they are covering and also the details, so hope this helps to have a bit more clarity in case you are having the same issues.
Resources:
https://openbankinguk.github.io/knowledge-base-pub/conformance-tools/
https://openbanking.atlassian.net/wiki/spaces/DZ/pages/1061716467/Functional+Conformance
https://medium.com/zoidcoin-network/open-banking-use-cases-for-users-8678d11d770b
Rafaela Azevedo 