Merge pull request 'feature/OVPAY-2485' (#63) from feature/OVPAY-2485 into develop

Reviewed-on: #63
This commit is contained in:
Mirjam Herald 2026-06-22 14:45:48 +00:00
commit 1f8e8f1381
2 changed files with 486 additions and 87 deletions

View File

@ -1081,6 +1081,10 @@ paths:
"photo": null, "photo": null,
}, },
"gboAgeProfile": null, "gboAgeProfile": null,
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
"_links": "_links":
{ {
"self": "self":
@ -1130,9 +1134,9 @@ paths:
}, },
}, },
} }
OV pas without PAD: OV pas without PAD, without AGO:
summary: OV pas without PAD summary: OV pas without PAD, without AGO
description: OV pas without PAD description: OV pas without PAD, without AGO
value: value:
{ {
"ovPayTokens": "ovPayTokens":
@ -1164,6 +1168,10 @@ paths:
"photo": null, "photo": null,
}, },
"gboAgeProfile": null, "gboAgeProfile": null,
"tatSecurity": {
"isSecured": false,
"isAuthorized": null,
},
"_links": "_links":
{ {
"self": "self":
@ -1213,9 +1221,9 @@ paths:
}, },
}, },
} }
OV pas with PAD and autoReload: OV pas with PAD, with autoReload, with AGO:
summary: OV pas with PAD and autoReload summary: OV pas with PAD, with autoReload, with AGO
description: OV pas with PAD and autoReload description: OV pas with PAD, with autoReload, with AGO
value: value:
{ {
"ovPayTokens": "ovPayTokens":
@ -1287,6 +1295,10 @@ paths:
"ageFromInclusive": 4, "ageFromInclusive": 4,
"ageToInclusive": 11, "ageToInclusive": 11,
}, },
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
"_links": "_links":
{ {
"self": "self":
@ -1385,6 +1397,10 @@ paths:
"ageFromInclusive": 4, "ageFromInclusive": 4,
"ageToInclusive": 11, "ageToInclusive": 11,
}, },
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
"_links": "_links":
{ {
"self": "self":
@ -1501,6 +1517,10 @@ paths:
"ageFromInclusive": 4, "ageFromInclusive": 4,
"ageToInclusive": 11, "ageToInclusive": 11,
}, },
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
"_links": "_links":
{ {
"self": "self":
@ -1599,6 +1619,10 @@ paths:
"photo": null, "photo": null,
}, },
"gboAgeProfile": null, "gboAgeProfile": null,
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
}, },
{ {
"customerProfileId": 18, "customerProfileId": 18,
@ -1621,6 +1645,10 @@ paths:
"photo": null, "photo": null,
}, },
"gboAgeProfile": null, "gboAgeProfile": null,
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
}, },
{ {
"customerProfileId": 132, "customerProfileId": 132,
@ -1643,6 +1671,10 @@ paths:
"photo": null, "photo": null,
}, },
"gboAgeProfile": null, "gboAgeProfile": null,
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
}, },
{ {
"customerProfileId": 166, "customerProfileId": 166,
@ -1668,6 +1700,10 @@ paths:
"photo": null, "photo": null,
}, },
"gboAgeProfile": null, "gboAgeProfile": null,
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
}, },
{ {
"customerProfileId": 166, "customerProfileId": 166,
@ -1690,6 +1726,10 @@ paths:
"photo": null, "photo": null,
}, },
"gboAgeProfile": null, "gboAgeProfile": null,
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
}, },
{ {
"customerProfileId": 1, "customerProfileId": 1,
@ -1712,6 +1752,10 @@ paths:
"photo": null, "photo": null,
}, },
"gboAgeProfile": null, "gboAgeProfile": null,
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
}, },
], ],
_links: _links:
@ -1812,6 +1856,10 @@ paths:
"personalAccountData": "personalAccountData":
{ "name": null, "birthdate": null, "photo": null }, { "name": null, "birthdate": null, "photo": null },
"gboAgeProfile": null, "gboAgeProfile": null,
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
"_links": "_links":
{ {
"self": "self":
@ -1890,6 +1938,10 @@ paths:
"personalAccountData": "personalAccountData":
{ "name": null, "birthdate": null, "photo": null }, { "name": null, "birthdate": null, "photo": null },
"gboAgeProfile": null, "gboAgeProfile": null,
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
"_links": "_links":
{ {
"self": "self":
@ -2086,6 +2138,10 @@ paths:
"personalAccountData": "personalAccountData":
{ "name": null, "birthdate": null, "photo": null }, { "name": null, "birthdate": null, "photo": null },
"gboAgeProfile": null, "gboAgeProfile": null,
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
"_links": "_links":
{ {
"self": "self":
@ -2149,6 +2205,10 @@ paths:
"personalAccountData": "personalAccountData":
{ "name": null, "birthdate": null, "photo": null }, { "name": null, "birthdate": null, "photo": null },
"gboAgeProfile": null, "gboAgeProfile": null,
"tatSecurity": {
"isSecured": true,
"isAuthorized": true,
},
"_links": "_links":
{ {
"self": "self":
@ -3636,7 +3696,6 @@ paths:
"vouchers": [] "vouchers": []
} }
} }
/customers/devices: /customers/devices:
post: post:
summary: Add a new device to a customer profile. summary: Add a new device to a customer profile.
@ -4603,4 +4662,3 @@ components:
customerDataItem: customerDataItem:
type: string type: string
example: emailAddress example: emailAddress

View File

@ -0,0 +1,341 @@
openapi: 3.0.1
info:
title: Service Engine APIs for TAT security
description: >-
Service Engine APIs for TAT security. These are NOT the raw GBO APIs to access TAT security at GBO directly.
To be used by touch points to get secure a TAT.
version: "2.0"
servers:
- url: https://services.acc.api.htm.nl/abt/touchpoint/2.0
tags:
- name: TAT Security
paths:
/tokens/securetoken:
parameters:
- name: X-HTM-JWT-AUTH-HEADER
in: header
schema:
type: string
example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
required: false
description: The JWT of a customer in case of touchpoint were customer logs in themselves
- name: X-HTM-CUSTOMER-PROFILE-ID-HEADER
in: header
schema:
type: integer
example: 323
required: false
description: The id of the customer Profile
- name: X-HTM-ROLE-HEADER
in: header
schema:
type: string
example: Customer
required: false
description: The role of the HTM employee in the case of the SMP
post:
tags:
- TAT Security
summary: Request additional OV-pas security for a token either in profile or anonymous.
description: Request additional OV-pas security for a token either in profile or anonymous
requestBody:
content:
application/json:
schema:
$ref: "#/components/schemas/SecureTokenRequest"
examples:
With customer account:
value:
ovPayTokenId: 42
emailAddress: stasjo@htm.nl
Without customer account:
value:
xtat: 62914b49-2c7f-437f-b4b0-2ad61a9f902d
emailAddress: stasjo@htm.nl
responses:
"200":
description: OK
content:
application/json:
schema:
$ref: "#/components/schemas/EmailNotPreApprovedResponse"
example:
uid: 7594f3ee-cd3d-40a3-8e82-73b90d16c481
recipient: xxxxxx.user@gmail.com
key: 123456789123456789123456789abcde
description: OTP Sent
"400":
description: Bad Request
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
Missing Parameters:
value:
status: 400
title: Missing Mandatory Parameter
detail: Required parameter {0} is missing.
Invalid Parameters:
value:
status: 400
title: Invalid Parameter
detail: Required parameter {0} is invalid.
"401":
description: Unauthorized
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
Unauthorized:
value:
status: 401
title: Unauthorized
detail: Invalid Access Token
"404":
description: Not found
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
TAT not found:
value:
status: 404
title: Not Found
detail: TAT Account Not Found
"409":
description: Conflict
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
TAT Already Secured:
value:
status: 409
title: Conflict
detail: TAT Already Secured
"500":
description: Internal server error
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
error: An unknown error has occurred
/tokens/verifyotp:
parameters:
- name: X-HTM-JWT-AUTH-HEADER
in: header
schema:
type: string
example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
required: false
description: The JWT of a customer in case of touchpoint were customer logs in themselves
- name: X-HTM-CUSTOMER-PROFILE-ID-HEADER
in: header
schema:
type: integer
example: 323
required: false
description: The id of the customer Profile
- name: X-HTM-ROLE-HEADER
in: header
schema:
type: string
example: Customer
required: false
description: The role of the HTM employee in the case of the SMP
post:
tags:
- TAT Security
summary: Submit an OTP for a triggered OTP flow.
description: |
Submit an OTP for a triggered OTP flow. This can either be result of an AGO activation, or
result of an AGO authorization flow. Since the backoffice behaves slightly different depending
on which use case is executed, the calling TP needs to provide an `action` in the request body.
requestBody:
content:
application/json:
schema:
$ref: "#/components/schemas/VerifyOtpRequest"
examples:
OTP verification for TAT security activation for token in customer account:
value:
ovPayTokenId: 42
otp: 123456
action: secure
OTP verification for TAT security authorization for anonymous token:
value:
xtat: 0f0defe8-828c-48e5-97e5-26d1d0179ef0
otp: 123456
action: authorize
responses:
"200":
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/VerifyOtpResponse'
examples:
Tat Secured:
value:
status: Success
description: TAT Secured
Tat Unsecured:
value:
status: Success
description: TAT Unsecured
Tat Authorized:
value:
status: Success
description: TAT Authorized
"400":
description: Bad request
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
Missing Parameters:
value:
status: 400
title: Missing Mandatory Parameter
detail: Required parameter {0} is missing.
Invalid Parameters:
value:
status: 400
title: Invalid Parameter
detail: Required parameter {0} is invalid.
"401":
description: Unauthorized
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
Unauthorized:
value:
status: 401
title: Unauthorized
detail: Invalid Access Token
"500":
description: Internal server error
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
error: An unknown error has occurred
components:
schemas:
unavailable:
type: object
GenerateTatOutput:
type: object
properties:
uid:
type: string
description: >-
An uid IS A unique identifier THAT is associated with the
user.
recipient:
type: string
description: >-
A recipient IS A unique identifier THAT is associated with the
TAT owner.
key:
type: string
description: >-
A key IS a 32 character string THAT uniquely identifies the
OTP session.
EmailNotPreApprovedResponse:
type: object
description: >-
EmailNotPreApprovedResponse IS AN object THAT represents the response of
email pre-approval check.
properties:
uid:
type: string
description: A uid IS A unique identifier THAT is associated with the user.
example: 7594f3ee-cd3d-40a3-8e82-73b90d16c481
recipient:
type: string
description: >-
A recipient IS A unique identifier THAT is associated with the TAT
owner.
example: xxxxxx.user@gmail.com
key:
type: string
description: >-
A key IS a 32 character string THAT uniquely identifies the OTP
session.
example: 123456789123456789123456789abcde
description:
type: string
description: >-
A description IS A string THAT describes the reason why the email is
not pre-approved.
example: OTP Sent
SecureTokenRequest:
type: object
properties:
ovPayTokenId:
type: integer
example: 42
xtat:
type: string
format: uuid
example: 6134db53-9ae5-41d1-a343-36656b60b510
emailAddress:
type: string
format: email
example: stasjo@htm.nl
required:
- ovPayTokenId
VerifyOtpRequest:
type: object
properties:
ovPayTokenId:
type: integer
example: 42
xtat:
type: string
format: uuid
example: f3474452-e1d4-428c-b366-e5ad5965eb8c
otp:
type: string
example: 123456
action:
type: string
example: secure
required:
- otp
- action
VerifyOtpResponse:
type: object
properties:
status:
type: string
example: Success
description:
type: string
example: TAT Secured
ErrorResponse:
description: Default response when an invalid request has been sent
type: object
properties:
status:
type: integer
description: >-
A status IS An integer that represents the HTTP status code of the
response.
example: 400
title:
type: string
description: A title IS A string that provides a brief summary of the error.
detail:
type: string
description: A detail IS A string that provides more details about the error.