1、 API standards for data-sharing(account aggregator)Report submitted by Consultative Group on Innovation and the Digital Economy October 2022 BIS Representative Office for the Americas Restricted CGIDE API standards for data-sharing October 2022 2 This publication is available on the BIS website(www.

2、bis.org).Bank for International Settlements 2022.All rights reserved.Brief excerpts may be reproduced or translated provided the source is stated.ISBN 978-92-9259-606-4(online)Restricted CGIDE API standards for data-sharing October 2022 3 Table of contents Foreword.5 Executive summary.6 Introduction

3、.7 1 Background.7 1.1 Definitions.7 1.1.1 Data-sharing.7 1.1.2 API content.8 1.1.3 Data serialisation.8 1.1.4 API dimensions.8 1.1.5 API standards.9 1.2 Messaging data formats and data models.9 1.3 Data providers.9 1.4 Data consumers.10 1.5 Consent architecture.10 1.6 The account aggregator.10 2 Dat

4、a-sharing implementation process.12 3 Data-sharing flow models.13 3.1 Centralised model.13 3.2 Decentralised model.14 3.3 Trust ecosystem model.15 4 Interaction and data flow.15 4.1 A fully centralised model via APIs.16 4.2 A centralised model via a third-party consent app.17 4.3 A trust model witho

5、ut centraliser.18 5 Technological considerations for API design.19 5.1 Service API design patterns.19 5.2 API protocols and styles.22 5.3 Service API access levels.24 5.4 Security considerations.24 5.4.1 JSON Web Token.25 5.4.2 OAuth 2.0.25 5.4.3 OpenID Connect.26 Restricted CGIDE API standards for

6、data-sharing October 2022 4 5.4.4 Financial-grade API(FAPI).26 Open finance in Brazil.27 Open finance in Mexico.29 6 API aggregator implementation(demo).30 6.1 Preconditions.30 6.2 Software architecture.30 6.3 Implementation.31 6.4 Testing.35 7 Conclusions.38 Annex A:Survey on API standards for data