> For the complete documentation index, see [llms.txt](https://doc.api.tieto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.api.tieto.com/open-banking-platform/sandbox-guide/testing-regulatory-apis.md).

# Testing Regulatory APIs

This is the part worth spending twenty minutes on. The regulatory sandbox is **dynamic**: responses are emulated from mock data that changes as you interact with it — sample customer accounts, balances and transaction histories — so a consent and a payment can be taken from start to finish rather than returning a canned example each time.

The practical consequence is that the sandbox behaves like an interface rather than a brochure. A consent you create exists afterward. A payment you initiate has a status that moves.

## Testing flow

If you only do one pass, do this one. It is the journey behind most open banking products, and it exercises every mechanism that matters.

{% stepper %}
{% step %}

#### Create a consent

Ask for access to accounts. Notice that you are asked what you want access to and for how long — the consent, not the token, is what defines the scope of everything that follows.
{% endstep %}

{% step %}

#### Authorize it

Complete the authentication step. This is where the customer would approve the access, and it is the point at which a real institution's own authentication comes into play.
{% endstep %}

{% step %}

#### Read the data

List accounts, then take balances and transaction history for one of them. Compare what comes back against the [API reference](/api-references/nextgenpsd2-xs2a/account-information-service.md) — the reference is generated from the specification the gateway serves, so they should agree exactly.
{% endstep %}

{% step %}

#### Initiate a payment

Create a payment, authorize it, submit it, then poll its status. Watch the status codes: they are ISO 20022, the same values your payments people already read.
{% endstep %}

{% step %}

#### Ask a funds question

A single call that returns yes or no, with no balance disclosed. It is the smallest of the three services and shows how narrow a permission can be.
{% endstep %}
{% endstepper %}

## What is available

| Service             | Covers                                                                                                                   |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Account Information | Account lists, account details, balances, transaction history, card accounts where the institution supports them         |
| Payment Initiation  | Single payments, bulk and multi-bulk payments, future-dated and recurring payments, payment status, payment cancellation |
| Funds Confirmation  | Confirmation that funds are available on an account                                                                      |

## Strong Customer Authentication

Access is consent-based throughout. The platform creates the consent, then drives strong customer authentication (SCA) against the institution's own authentication service — and the approaches available in the sandbox are the ones available in production.

| Approach        | Behavior                                                                                   |
| --------------- | ------------------------------------------------------------------------------------------ |
| Redirect        | The customer is redirected to the institution's authentication page and returned afterward |
| Decoupled       | The customer authenticates in a separate channel, typically the institution's mobile app   |
| Embedded        | Credentials are collected by the TPP and passed through for verification                   |
| Multi-level SCA | Several people must authorize the same operation                                           |
| Channel-based   | Corporate authorizations are collected inside the institution's own channels               |
| SCA exemption   | The operation proceeds without authentication where the regulation permits                 |

Six approaches is not padding. Each tenant institution picks what its own customer base and authentication estate can support, and a platform that only did redirect would exclude the corporate flows entirely.

A consent moves through received, authorized, partially authorized, expired, revoked, replaced, terminated and rejected, each mapped to its Berlin Group value. For payment initiation the platform creates a consent per payment — which is why a payment identifier and its consent identifier are the same value seen from outside.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://doc.api.tieto.com/open-banking-platform/sandbox-guide/testing-regulatory-apis.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.