{"id":16504,"date":"2021-10-21T20:28:20","date_gmt":"2021-10-21T14:58:20","guid":{"rendered":"https:\/\/cigniti.com\/blog\/?p=16504"},"modified":"2022-11-25T17:13:50","modified_gmt":"2022-11-25T11:43:50","slug":"api-testing-open-banking","status":"publish","type":"post","link":"https:\/\/www.cigniti.com\/blog\/api-testing-open-banking\/","title":{"rendered":"The importance of API Testing in Open Banking"},"content":{"rendered":"
[vc_row][vc_column][vc_column_text]UK’s Competition and Markets Authority (CMA), after a market study, issued a statement that the nine biggest banks (CMA9) allow authorized startups\u00a0and\u00a0third-party providers (TPPs) access to their data.<\/span>\u00a0<\/span><\/p>\n The Open Banking Implementation Entity (OBIE) was created to help with this. OBIE’s mission is to collaborate with the UK’s top banks and building societies to promote competition,\u00a0open\u00a0up\u00a0personal data, and provide an individual with a vendor option.<\/span>\u00a0<\/span><\/p>\n Open Banking means the bank’s ability to share financial data with third parties with the customer’s permission. Third parties will access the customer’s financial information, including transaction history, how they interact with banks, businesses used, and spending habits.<\/span>\u00a0<\/span><\/p>\n FinTech\u2019s can utilize APIs to connect their services to financial data, thanks to Open Banking. With the consumer’s cooperation, Open Banking marked a move from a closed data model to an open one, in which data can be shared across different stakeholders in the banking ecosystem.<\/span>\u00a0<\/span><\/p>\n Banks can provide clients more control over their financial data by allowing them to connect to other regulated providers.\u00a0Third-party money management software, such as Intuit, can display all transaction details and balances in one place.\u00a0It will also pave the way for a plethora of fintech innovations.<\/span>\u00a0<\/span><\/p>\n It is thus important to understand the business drivers behind the advent of Open Banking.<\/span>\u00a0<\/span><\/p>\n The critical\u00a0business drivers behind the advent of Open Banking are:<\/span>\u00a0<\/span><\/p>\n While we\u2019ve seen the business drivers behind the advent of Open Banking, it is imperative to understand the key requirements and implementation of Open Banking.<\/span>\u00a0<\/span><\/p>\n An API is an application programming interface\u00a0that\u00a0works to connect an application to the web and other APIs.\u00a0In essence, it\u00a0is the brain of the connected world\u00a0and\u00a0is a set of tools\/protocols\/standards and code.\u00a0<\/span>\u00a0<\/span><\/p>\n The use of APIs is fundamental to the concept of\u00a0the\u00a0Open Banking and Payment Services Directive\u00a0(PSD2). The requests for services and products which can deliver multichannel customers and provide relationships to these customers need significant development in the Open API sector.\u00a0<\/span>\u00a0<\/span><\/p>\n The API Platform’s primary function is to publish and secure APIs. The Platform is described as a layer that communicates with bank middleware.<\/span>\u00a0<\/span>[\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column][vc_column_text][\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column][vc_column_text]<\/p>\n Communication between the various components of Open Banking will be accomplished through an ‘API’-based infrastructure that includes numerous hardware and software components.\u00a0<\/span>\u00a0<\/span><\/p>\n End-to-end testing of these complex infrastructures will be difficult, time-consuming, and error-prone, resulting in higher costs, longer onboarding times, and a danger to reputation.<\/span>\u00a0<\/span>[\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column][vc_column_text][\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column][vc_column_text]<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column width=”1\/4″][vc_column_text]Potential Areas<\/span><\/span><\/strong>\u00a0\u00a0<\/span><\/span>[\/vc_column_text][vc_column_text][\/vc_column_text][\/vc_column][vc_column width=”3\/4″][vc_column_text]Testing considerations<\/span><\/span><\/strong> \u00a0<\/span><\/span>[\/vc_column_text][vc_column_text]<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column width=”1\/4″][vc_column_text][\/vc_column_text][\/vc_column][vc_column width=”3\/4″][vc_column_text]<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column width=”1\/4″][vc_column_text][\/vc_column_text][\/vc_column][vc_column width=”3\/4″][vc_column_text]<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column width=”1\/4″][vc_column_text][\/vc_column_text][\/vc_column][vc_column width=”3\/4″][vc_column_text]Develop Tests to validate:<\/strong><\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column][vc_column_text]<\/p>\n Cus1 and Cus2 are two individuals who want to register for HSBC PSD2 and avail themselves of its services. But they have different customer statuses in HSBC existing e-banking system. The details of both are mentioned below:\u202f<\/span>\u00a0<\/span><\/p>\n \u00a0<\/span>Payment initiation service:<\/span><\/i>\u00a0<\/span><\/p>\n Cus1 is an existing customer of HSBC and\u00a0is\u00a0already using the current BOV e-banking channel. Cus1 has a 6-digit numeric unique user ID and a physical VASCO device. Cus1 wants to make a payment from PayPal (TPP) using his HSBC account. \u202f<\/span> \u00a0<\/span>Account information service:<\/span><\/i>\u00a0<\/span><\/p>\n Cus2 is an existing HSBC customer but has not registered for current BOV e-banking channel access. Cus2 wants to inquire about his account details using Mint (TPP) for his HSBC accounts.<\/span>\u00a0<\/span><\/p>\n -Sample API requests: GET-accounts, balances\u00a0etc.<\/span>\u00a0<\/span>[\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column width=”1\/2″][vc_column_text]Sample GET-Account API Request:<\/span><\/span><\/em>[\/vc_column_text][vc_column_text css=”.vc_custom_1634827893135{background-color: #73aed1 !important;}”]<\/p>\n { [\/vc_column_text][\/vc_column][vc_column width=”1\/2″][vc_column_text]Sample GET-Account API Response:<\/span><\/span><\/em>[\/vc_column_text][vc_column_text css=”.vc_custom_1634827924143{background-color: #73aed1 !important;}”]<\/p>\n “response” : {“status” : 200,”body” : “{\\”accounts\\”:[{\\”resourceId\\”:\\”HGlNA7CqT8sjd_1aV2v2LI\\”,\\”iban\\”:\\”DE38760700240320465700\\”,\\”currency\\”:\\”EUR\\”,\\”name\\”:\\”max.musterman\\”,\\”displayName\\”:\\”mock displayname\\”,\\”product\\”:\\”Cash24\\”,\\”cashAccountType\\”:\\”CASH\\”,\\”status\\”:\\”enabled\\”,”}}}]}”, “headers” : { “vary” : [ “Origin”, “Access-Control-Request-Method”, “Access-Control-Request-Headers” ],”x-request-id” : “70a7346e-e769-4c4b-8326-ceb6b785e07c”, “content-type” : “application\/json”, “date” : “Tue, 07 Jul 2020 08:08:14 GMT”,”x-robots-tag” : “none”, [\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column][vc_column_text]Sample HTTP Status Codes:<\/span>\u00a0<\/span><\/p>\n [\/vc_column_text][vc_column_text]<\/p>\n The\u00a0API’s\u00a0are tested with single requests and through collection runners\u00a0via\u00a0the Postman tool to validate the consent.<\/span>\u00a0<\/span><\/p>\n Integration Testing:\u00a0<\/span><\/b>Ensures that all the integration touchpoints are validated correctly to uncover any bottlenecks irrespective of the complexity of the application and technologies involved.<\/span>\u00a0<\/span><\/p>\n Communication\/integration between different components in the system,\u00a0i.e.\u00a0PSU > TPP\u00a0(AIS\/PIS) > ASPSP touch points are validated.<\/span>\u00a0<\/span><\/p>\n Data Validation:<\/span><\/b>\u00a0In a banking ecosystem, several types of data can be accessed through an interface. This can include customer or account information, deposit data, loan information, transaction details, and real-time or end-of-day batch process details. Thorough validation should be performed on the input data, including:\u00a0<\/span>\u00a0<\/span><\/p>\n Performance Testing:\u00a0\u00a0<\/span><\/b>Performance testing<\/span>\u00a0helps to determine a system’s and application’s limitations under expected loads. It also helps fine-tune the application to make sure it is stable, scalable, and performs consistently as expected with optimal resource utilization. PT ensures the application runs in optimal conditions by considering factors like response time, scalability, downtime, and infrastructure costs.\u202f<\/span>\u00a0<\/span><\/p>\n Outcomes of performance testing include:<\/span>\u00a0<\/span><\/p>\n \u00a0<\/span>Security Testing:<\/span><\/b>\u00a0<\/span><\/p>\n Authentication and authorization are especially\u00a0important\u00a0in banking APIs. Testers should ensure multi-factor authentication is performed before authorizing APIs to perform desired functions.\u00a0\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n Compliance Testing:<\/span><\/b>\u00a0<\/span><\/p>\n Testing the processes for onboarding TPPs before they are permitted to integrate with the FI’s APIs and Define clear internal standards for creating audit trails and reporting procedures that consider the FI’s activities and that of their TPP partners.<\/span>\u00a0<\/span><\/p>\n Conclusion<\/span><\/b>\u00a0<\/span><\/p>\n Cigniti’s\u00a0Testing approaches outlined above bring many benefits, as we have seen based on our own experiences,\u00a0i.e.\u00a0Web Services Validator utility for automated Test Data Generation for SOAP and RESTful Services.\u00a0<\/span>\u00a0<\/span><\/p>\n Cigniti’s\u00a0utilities and best practices\u00a0help\u00a0shrink the test execution cycle.\u00a0<\/span>Service virtualization<\/span>\u00a0is used\u00a0to simulate request patterns and data parser for both JSON & XML requests\u00a0and\u00a0Open API Accelerators with pre-written test scenarios and checklists. We possess test accelerators and other reusable test artefacts consisting of end-to-end test scenarios and checklists for major open banking APIs functionalities.<\/span>\u00a0<\/span><\/p>\n Cigniti’s\u00a0Solution Alignment with\u00a0<\/span>Open Banking Ecosystem validation<\/span>\u00a0coverage includes Functionalities, API Security, API Performance and API automation. Our value proportions include Omnichannel coverage cutting across all validation areas in the complex Open API ecosystem and adherence to industry standards and Open API compliance and guidelines.<\/span>\u00a0<\/span><\/p>\n Our comprehensive validation solution\u00a0is\u00a0based on cutting-edge technology, best practices, and accelerators\u00a0that\u00a0add significant value in terms of effort, cost, user experience, increased market reach, and demographics.<\/span>\u00a0<\/span><\/p>\n Need help? Contact\u00a0our\u00a0<\/span>Banking and API Testing experts<\/span>\u00a0to learn more about the importance of API testing in Open Banking.<\/span>\u00a0<\/span>[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n","protected":false},"excerpt":{"rendered":" [vc_row][vc_column][vc_column_text]UK’s Competition and Markets Authority (CMA), after a market study, issued a statement that the nine biggest banks (CMA9) allow authorized startups\u00a0and\u00a0third-party providers (TPPs) access to their data.\u00a0 The Open Banking Implementation Entity (OBIE) was created to help with this. OBIE’s mission is to collaborate with the UK’s top banks and building societies to promote […]<\/p>\n","protected":false},"author":58,"featured_media":16505,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[732],"tags":[688,3409,3413,501,3170,3167,3412,565,3848,3847,3849,3169,3408,3410,3411],"ppma_author":[3846],"yoast_head":"\nWhy and what is Open Banking?<\/span><\/b>\u00a0<\/span><\/h4>\n
Business drivers behind the advent of Open Banking<\/span><\/b>\u00a0<\/span><\/h4>\n
\n
Open Banking Key Requirements and Implementation:<\/span><\/b>\u00a0<\/span><\/h4>\n
Challenges\u00a0of API-based infrastructure<\/span><\/b>\u00a0<\/span><\/h4>\n
Testing Considerations<\/strong><\/h4>\n
\n
\n
\n
\n
Open Banking Sample Scenario:<\/span><\/b>\u00a0<\/span><\/h4>\n
\n-Sample API requests: GET-Payment ID, Payment Product\u00a0etc.<\/span>\u00a0<\/span><\/p>\n
\n“id” : “80a64003-3649-44b1-8931-cf665bbf6d36”,
\n“name” : “v1_accounts”,
\n“request” : {
\n“url” : “\/v1\/accounts?withBalance=false”,
\n“method” : “GET”,
\n“headers” : {
\n“X-Request-ID” : {
\n“matches” : “.+”
\n},<\/p>\n
\n“set-cookie” : “SRVNAME=17984ba812b2bfa7d54e249e16048ab4; path=\/; HttpOnly; Secure”,”cache-control” : “private” }<\/p>\n\n\n
\n Status Code<\/span><\/b>\u00a0<\/span><\/td>\n \u00a0\u00a0\u00a0\u00a0 Message<\/span><\/b>\u00a0<\/span><\/td>\n Description<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n \n 200<\/span>\u00a0<\/span><\/td>\n OK<\/span>\u00a0<\/span><\/td>\n Response to a successful REST API action. The HTTP method can be GET, POST, PUT or DELETE.\u00a0<\/span>\u00a0<\/span><\/td>\n<\/tr>\n \n 201<\/span>\u00a0<\/span><\/td>\n Created<\/span>\u00a0<\/span><\/td>\n The request has been fulfilled, and a resource was created. A URI for the created resource is returned in the Location Header.\u00a0<\/span>\u00a0<\/span><\/td>\n<\/tr>\n \n 202<\/span>\u00a0<\/span><\/td>\n Accepted\u00a0<\/span>\u00a0<\/span><\/td>\n The request has been accepted for processing, but processing is not yet complete.\u00a0<\/span>\u00a0<\/span><\/td>\n<\/tr>\n \n 400<\/span>\u00a0<\/span><\/td>\n Bad Request<\/span>\u00a0<\/span><\/td>\n The request is malformed, such as a message body format error.\u00a0<\/span>\u00a0<\/span><\/td>\n<\/tr>\n \n 401<\/span>\u00a0<\/span><\/td>\n Unauthorized\u00a0<\/span>\u00a0<\/span><\/td>\n Wrong or no authentication ID\/password provided.\u00a0<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n API Testing:<\/span><\/b>\u00a0This test ensures an API is working as functionally designed and gracefully\u00a0handles\u00a0failures by responding with\u00a0the\u00a0desired status codes.<\/span>\u00a0<\/span><\/h4>\n
\n
\n