Open Banking API Penetration Testing

Usually a full-function sandbox that mirrors production, because payment initiation testing against live accounts is rarely sensible. Where production testing is required we agree strict limits, small amounts and a named window.

Yes. FAPI 1.0 Advanced requires one of those methods, rejects public clients and expects the request object to carry an nbf no more than 60 minutes old, an exp within 60 minutes of it, and an aud set to your issuer. We try another client’s certificate or assertion, stale and long-lived request objects, and PAR requests without PKCE S256, against the FAPI 1.0 Part 2 text.

Very. A third-party provider holds certificates, tokens and consents for many users at once, which makes it a high-value target. We pen test your consent storage, token handling and certificate management as well as the API surface.

Yes. The specification defines ExpirationDateTime as the date up to which the consent is valid and applies it to every permission. A refresh token that still mints access tokens after that date, or after the PSU revokes access at the bank, is a finding, and we try exactly that against your token endpoint, as set out in the account and transaction profile.

Yes. We test whether an access token continues to work beyond the consent’s agreed scope or expiry date, whether a revoked consent is honoured immediately by every endpoint, and whether a token issued for account information can also be used for payment initiation. Consent handling is one of the areas where a passing conformance suite does not guarantee secure behaviour.

Yes. We test whether the redirect URI is validated against an exact allow-list, whether an attacker-controlled redirect can be used to intercept an authorisation code or token, and whether state and PKCE parameters are checked correctly to stop a code issued for one session being replayed into another. A weak redirect check can undermine strong consent controls elsewhere.

Yes. Open banking consent, redirects and third-party permissions usually sit inside a larger payments or account platform, and testing the API alone can miss issues that only appear once it is wired into the rest of your product. See our fintech sector page for how we scope the combined engagement.

No. When a PSU revokes access through the bank’s dashboard the specification says the consent status must remain unchanged, so Authorised alone does not prove the access is live. Status also says nothing about the Permissions list, the selected AccountId or the transaction date range. We test each of those separately.