Call the data endpoints with your sender-constrained token, the right FAPI headers, scopes, pagination, and error handling.

Requesting Data

With an active consent and a valid access token, you can call Protección's data endpoints. Protección validates the token binding and consent scope, then brokers the request to the resource server and returns the data.

Make a request

Present the access token as a bearer token, over mTLS with the same certificate the token is bound to, and include a fresh x-fapi-interaction-id.

curl --cert client.crt --key client.key \
  https://api.provider.fiskil.com/cds-au/v1/banking/accounts \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "x-fapi-interaction-id: 4f3d2c1b-0a9e-8d7c-6b5a-4938271605fe"

{
  "data": {
    "accounts": [
      {
        "accountId": "acc_001",
        "displayName": "Everyday account",
        "openStatus": "OPEN",
        "maskedNumber": "xxxx-xxxx-1234"
      }
    ]
  },
  "meta": { "totalRecords": 1, "totalPages": 1 }
}

FAPI headers

Header	Direction	Purpose
`x-fapi-interaction-id`	request & response	A UUID you generate per request; Protección echoes it. Log it — it correlates your call end to end for support.
`x-fapi-auth-date`	request	Timestamp of the customer's last authentication. Used for step-up decisions.
`x-fapi-customer-ip-address`	request	The customer's IP when the call is made in their presence. Supports fraud checks.

Always send and store x-fapi-interaction-id. When you contact support about a specific call, this ID is how it's traced across Protección and the resource server.

Scopes gate endpoints

Each endpoint requires the scope the customer consented to. A token missing the scope is rejected — request the right scopes at authorisation time.

Endpoint	Required scope
`GET /cds-au/v1/banking/accounts`	`bank:accounts.basic:read`
`GET /cds-au/v1/banking/accounts/{id}/transactions`	`bank:transactions:read`
`GET /cds-au/v1/common/customer`	`common:customer.basic:read`
`GET /cds-au/v1/energy/accounts`	`energy:accounts.basic:read`

Pagination

List endpoints page with page and page-size (max 1000 records per page). Read meta.totalPages to iterate.

curl --cert client.crt --key client.key \
  "https://api.provider.fiskil.com/cds-au/v1/banking/accounts/acc_001/transactions?page=1&page-size=100" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "x-fapi-interaction-id: $(uuidgen)"

Refreshing tokens

Access tokens are short-lived (typically 15 minutes). Use the refresh_token from the token exchange to obtain a new access token without sending the customer back through consent — as long as the consent is still active.

curl -X POST --cert client.crt --key client.key \
  https://secure.proteccion.prod.provider.fiskil.com/connect/token \
  -d "grant_type=refresh_token" \
  -d "refresh_token=REFRESH_TOKEN" \
  -d "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer" \
  -d "client_assertion=SIGNED_CLIENT_JWT"

Handling errors

Status	Meaning	What to do
`401`	Token missing, expired, or the presenting certificate doesn't match the binding.	Refresh the token; confirm you're using the bound certificate.
`403`	The consent lacks the scope, or `X-Sharing-Refused: true` is set.	Check the consent's scopes and status; re-authorise if needed.
`404`	The account or resource isn't part of this consent.	Re-list consented `account_ids`.
`422`	The resource server rejected the request shape.	Validate query parameters against the reference.
`429`	Rate limited.	Back off and retry using the `Retry-After` header.

A 403 with the X-Sharing-Refused: true response header means the resource server declined to share this specific resource (for example, a joint account requiring all holders' approval). Treat it as a permanent refusal for that resource, not a transient error.

Performance expectations

Protección brokers to the resource server within CDR non-functional requirements — response times measured at the 95th percentile and 99.5% monthly availability.

Traffic tier	Target (95th percentile)
High-priority (customer present)	1000 ms
Low-priority	1500 ms
Unattended (batch)	4000 ms
Large payload	6000 ms

Requesting Data

Requesting Data

Make a request

FAPI headers

Scopes gate endpoints

Refreshing tokens

Handling errors

Performance expectations

Next step

Consent API reference

Consent Management