To interact with ANZ Fileactive APIs for Hong Kong, authentication is handled using OAuth 2.0 with the Client Credential Grant flow. This ensures secure access to the API resources by obtaining a bearer token, which is then used for authorizing API requests.

Key points:

  • Endpoint: All authentication requests should be sent to the /v1.0/auth endpoint.
  • Grant Type: Use client_credentials as the grant type for obtaining tokens.
  • Token URL: The token URL is https://api.fileactive.anzgcis.com/v1.0/auth.
  • Scopes: Specific scopes define the permissions, such as:
    • HK.INSTO.PAYMENT.ACH.CREATE - For creating ACH Payment resources in Hong Kong.
    • HK.INSTO.PAYMENT.ACH.READ - For retrieving ACH Payment resources in Hong Kong.
    • HK.INSTO.PAYMENT.FAST.CREATE - For creating FAST Payment resources in Hong Kong.
    • HK.INSTO.PAYMENT.FAST.READ - For retrieving FAST Payment resources in Hong Kong.
    • HK.INSTO.PAYMENT.RTGS.CREATE - For creating RTGS Payment resources in Hong Kong.
    • HK.INSTO.PAYMENT.RTGS.READ - For retrieving RTGS Payment resources in Hong Kong.
    • HK.INSTO.PAYMENT.CBFT.CREATE - For creating CBFT Payment resources in Hong Kong.
    • HK.INSTO.PAYMENT.CBFT.READ - For retrieving CBFT Payment resources in Hong Kong.
  • Headers: Include an API key in the header using apikey as the parameter name.

Example Request:

To request a token, send a POST request with the required parameters in application/x-www-form-urlencoded format. The request must also include your API key in the header for authentication.

POST /v1.0/auth HTTP/1.1
Host: api.fileactive.anzgcis.com
Content-Type: application/x-www-form-urlencoded
x-api-key: <your_api_key_here>  # Include your API key in the header

grant_type=client_credentials&
client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&
scope=HK.INSTO.PAYMENT.ACH.CREATE&
client_assertion=<your_client_assertion_here>

Example Response:

On success, you’ll receive a bearer token in the response, which is used for authorisation in subsequent API calls.

{
  "expires_in": 3600,
  "token_type": "Bearer",
  "access_token": "eaaa13ee-b596-a8cc-b9d4-f778f8bb9377"
}

Usage Notes:

  • authorisation Header: Include the access_token in the authorisation header as Bearer <access_token>.
  • Token Refresh: Tokens expire according to the expires_in value. Ensure you handle token renewal to maintain API access.

Important Note:

The client_assertion field in your request must be a JWT (JSON Web Token) that is signed with your private key. This ensures the integrity and authenticity of the request. The private key should correspond to the public key that ANZ has on file.

If the client assertion is not properly signed, the authentication request will fail.