Create a Consumer(Dynamic Registration)

POST /obp/v7.0.0/dynamic-registration/consumers

OBPv5.1.0-createConsumerDynamicRegistration No role required Directory Consumer

Create a Consumer with full certificate validation (mTLS access) - Recommended for PSD2/Berlin Group compliance.

This endpoint provides secure, validated consumer registration unlike the standard /management/consumers endpoint.

Not for AI agents or ordinary applications. This is the PSD2 path and requires a QWAC certificate that matches a pre-registered Regulated Entity. An agent or app that simply needs credentials should use OAuth2 dynamic client registration (RFC 7591) on the OBP-OIDC identity provider instead; see the glossary entry "Signal Channels", section "Getting credentials as an agent".

How it works (for comprehension flow):

Extract JWT from request: Parse the signed JWT from the request body
Extract certificate: Get certificate from PSD2-CERT header in PEM format
Verify JWT signature: Validate JWT is signed with the certificate's private key (proves possession)
Parse JWT payload: Extract consumer details (description, app_name, app_type, developer_email, redirect_url)
Extract certificate info: Parse certificate to get Common Name, Email, Organization
Validate against Regulated Entity: Check certificate exists in Regulated Entity registry (PSD2 requirement)
Create consumer: Generate credentials and create consumer record with validated certificate
Return consumer with certificate info: Returns consumer details including parsed certificate information

Certificate Validation (CRITICAL SECURITY DIFFERENCE from regular creation):

[YES] JWT Signature Verification: JWT must be signed with certificate's private key - proves TPP owns the certificate [YES] Regulated Entity Check: Certificate must match a pre-registered Regulated Entity in the database [YES] Certificate Binding: Certificate is permanently bound to the consumer at creation time [YES] CA Validation: Certificate chain can be validated against trusted root CAs during API requests [YES] PSD2 Compliance: Meets EU regulatory requirements for TPP registration

Security benefits vs regular consumer creation:

Feature	Regular Creation	Dynamic Registration
Certificate validation	[NO] None	[YES] Full validation
Regulated Entity check	[NO] Not required	[YES] Required
JWT signature proof	[NO] Not required	[YES] Required (proves private key possession)
Self-signed certs	[YES] Accepted	[NO] Rejected
PSD2 compliant	[NO] No	[YES] Yes
Rogue TPP prevention	[NO] No	[YES] Yes

Prerequisites:

TPP must be registered as a Regulated Entity with their certificate
Certificate must be provided in PSD2-CERT request header (PEM format)
JWT must be signed with the private key corresponding to the certificate
Trust store must be configured with trusted root CAs

JWT Payload Structure:

Minimal:

{ "description":"TPP Application Description" }

Full:

{
  "description": "Payment Initiation Service",
  "app_name": "Tesobe GmbH",
  "app_type": "Confidential",
  "developer_email": "contact@tesobe.com",
  "redirect_url": "https://tpp.example.com/callback"
}

Note: JWT must be signed with the private key that corresponds to the public key in the certificate sent via PSD2-CERT header.

Certificate Information Extraction:

The endpoint automatically extracts information from the certificate:

Common Name (CN) → used as app_name if not provided in JWT
Email Address → used as developer_email if not provided
Organization (O) → used as company
Certificate validity period
Issuer information

Configuration Required:

truststore.path.tpp_signature - Path to trust store for CA validation
truststore.password.tpp_signature - Trust store password
Regulated Entity must be pre-registered with certificate public key

Error Scenarios:

JWT signature invalid → PostJsonIsNotSigned (400)
Certificate not in Regulated Entity registry → RegulatedEntityNotFoundByCertificate (400)
Invalid JWT format → InvalidJsonFormat (400)
Missing PSD2-CERT header → Signature verification fails

This is the SECURE way to register consumers for production PSD2/Berlin Group implementations.

User Authentication is Optional. The User need not be logged in.

JSON request body fields (1)

jwt: eyJhbGciOiJIUzI1NiJ9.eyJlbnRpdGxlbWVudHMiOltdLCJjcmVhdGVkQnlVc2VySWQiOiJhYjY1MzlhOS1iMTA1LTQ0ODktYTg4My0wYWQ4ZDZjNjE2NTciLCJzdWIiOiIyMWUxYzhjYy1mOTE4LTRlYWMtYjhlMy01ZTVlZWM2YjNiNGIiLCJhdWQiOiJlanpuazUwNWQxMzJyeW9tbmhieDFxbXRvaHVyYnNiYjBraWphanNrIiwibmJmIjoxNTUzNTU0ODk5LCJpc3MiOiJodHRwczpcL1wvd3d3Lm9wZW5iYW5rcHJvamVjdC5jb20iLCJleHAiOjE1NTM1NTg0OTksImlhdCI6MTU1MzU1NDg5OSwianRpIjoiMDlmODhkNWYtZWNlNi00Mzk4LThlOTktNjYxMWZhMWNkYmQ1Iiwidmlld3MiOlt7ImFjY291bnRfaWQiOiJtYXJrb19wcml2aXRlXzAxIiwiYmFua19pZCI6ImdoLjI5LnVrLngiLCJ2aWV3X2lkIjoib3duZXIifSx7ImFjY291bnRfaWQiOiJtYXJrb19wcml2aXRlXzAyIiwiYmFua19pZCI6ImdoLjI5LnVrLngiLCJ2aWV3X2lkIjoib3duZXIifV19.8cc7cBEf2NyQvJoukBCmDLT7LXYcuzTcSYLqSpbxLp4

JSON response body fields (24)

app_name: appNameBank
app_type: Web
certificate_pem: certificate_pem
company: Tesobe GmbH
consumer_id: 7uy8a7e4-6d02-40e3-a129-0b2bf89de8uh
consumer_key: bwf0ykmwoirip1yjxcn15wnhuyxcziwgtcoaildq
created
created_by_user
description: Description of the object. Maximum length is 2000. It can be any characters here.
developer_email
email: felixsmith@example.com
enabled: false
issuer_domain_name: issuer_domain_name
not_after: not_after
not_before: not_before
provider: ETHEREUM
provider_id
redirect_url: https://apisandbox.openbankproject.com
subject_domain_name: subject_domain_name
user_id: 9ca9a7e4-6d02-40e3-a129-0b2bf89de9b1
username: felixsmith
certificate_info: certificate_info
logo_url: logo_url
roles_info: roles_info

Example request body

{
  "jwt": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJkZXNjcmlwdGlvbiI6IlRQUCBkZXNjcmlwdGlvbiJ9.c5gPPsyUmnVW774y7h2xyLXg0wdtu25nbU2AvOmyzcWa7JTdCKuuy3CblxueGwqYkQDDQIya1Qny4blyAvh_a1Q28LgzEKBcH7Em9FZXerhkvR9v4FWbCC5AgNLdQ7sR8-rUQdShmJcGDKdVmsZjuO4XhY2Zx0nFnkcvYfsU9bccoAvkKpVJATXzwBqdoEOuFlplnbxsMH1wWbAd3hbcPPWTdvO43xavNZTB5ybgrXVDEYjw8D-98_ZkqxS0vfvhJ4cGefHViaFzp6zXm7msdBpcE__O9rFbdl9Gvup_bsMbrHJioIrmc2d15Yc-tTNTF9J4qjD_lNxMRlx5o2TZEw"
}

Example success response

{
  "consumer_id": "7uy8a7e4-6d02-40e3-a129-0b2bf89de8uh",
  "consumer_key": "bwf0ykmwoirip1yjxcn15wnhuyxcziwgtcoaildq",
  "app_name": "appNameBank",
  "app_type": "Web",
  "description": "Description of the object. Maximum length is 2000. It can be any characters here.",
  "developer_email": "felixsmith@example.com",
  "company": "Tesobe GmbH",
  "redirect_url": "https://apisandbox.openbankproject.com",
  "certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIFIjCCBAqgAwIBAgIIX3qsz7QQxngwDQYJKoZIhvcNAQELBQAwgZ8xCzAJBgNV\r\nBAYTAkRFMQ8wDQYDVQQIEwZCZXJsaW4xDzANBgNVBAcTBkJlcmxpbjEPMA0GA1UE\r\nChMGVEVTT0JFMRowGAYDVQQLExFURVNPQkUgT3BlcmF0aW9uczESMBAGA1UEAxMJ\r\nVEVTT0JFIENBMR8wHQYJKoZIhvcNAQkBFhBhZG1pbkB0ZXNvYmUuY29tMQwwCgYD\r\nVQQpEwNWUE4wHhcNMjMwNzE3MDg0MDAwWhcNMjQwNzE3MDg0MDAwWjCBizELMAkG\r\nA1UEBhMCREUxDzANBgNVBAgTBkJlcmxpbjEPMA0GA1UEBxMGQmVybGluMRQwEgYD\r\nVQQKEwtUZXNvYmUgR21iSDEPMA0GA1UECxMGc3lzb3BzMRIwEAYDVQQDEwlsb2Nh\r\nbGhvc3QxHzAdBgkqhkiG9w0BCQEWEGFkbWluQHRlc29iZS5jb20wggEiMA0GCSqG\r\nSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCwxGuWUN1H0d0IeYPYWdLA0I/5BXx4DLO6\r\nzfi1GGJlF8BIXRN0VTJckIY9C3J1RnXDs6p6ufA01iHe1PQdL6VzfcaC3j+jUSgV\r\n1z9ybEUPyUwq3PCCxqoVI9n8yh+O6FDn3dvu/9Q2NtBpJHUBDCLf7OO9TgsFU2sE\r\nMys+Hw5DuuX5n5OQ2VIwH+qlMTQnd+yw5y8FKHqAZT5hE60lF/x6sQnwi58hLGRW\r\nSqo/548c2ZpoeWtnyY1I6PyR7zUYGuhruLY8gVFfLE+610u/lj2wYTXMxntpV+tV\r\nralLFRMhvbqZXW/EpuDb/pEbCnLDNDxq5NarLVDzcHs7VhT9MPChAgMBAAGjggFy\r\nMIIBbjATBgNVHSUEDDAKBggrBgEFBQcDAjAaBgNVHREEEzARgglsb2NhbGhvc3SH\r\nBH8AAAEwggEGBggrBgEFBQcBAwSB+TCB9jAIBgYEAI5GAQEwOAYGBACORgEFMC4w\r\nLBYhaHR0cHM6Ly9leGFtcGxlLm9yZy9wa2lkaXNjbG9zdXJlEwdleGFtcGxlMIGI\r\nBgYEAIGYJwIwfjBMMBEGBwQAgZgnAQMMBlBTUF9BSTARBgcEAIGYJwEBDAZQU1Bf\r\nQVMwEQYHBACBmCcBAgwGUFNQX1BJMBEGBwQAgZgnAQQMBlBTUF9JQwwlRHVtbXkg\r\nRmluYW5jaWFsIFN1cGVydmlzaW9uIEF1dGhvcml0eQwHWFgtREZTQTAlBgYEAI5G\r\nAQYwGwYHBACORgEGAQYHBACORgEGAgYHBACORgEGAzARBglghkgBhvhCAQEEBAMC\r\nB4AwHgYJYIZIAYb4QgENBBEWD3hjYSBjZXJ0aWZpY2F0ZTANBgkqhkiG9w0BAQsF\r\nAAOCAQEAKTS7exS9A7rWJLRzWrlHoTu68Avm5g9Dz1GKjgt8rnvj3D21SE14Rf5p\r\n0JWHYH4SiCdnh8Tx+IA7o0TmPJ1JRfAXR3i/5R7TJi/HrnqL+V7SIx2Cuq/hkZEU\r\nAhVs07nnvHURcrlQGwcfn4TbgpCURpCPpYZlNsYySb6BS6I4qFaadHGqMTyEkphV\r\nwfXyB3brmzxj9V4Qgp0t+s/uFuFirWyIayRc9nSSC7vuNVYvib2Kim4y8kvuWpA4\r\nZ51+fFOmBqCqpmwfAADNgDsLJiA/741eBflVd/ZUeAzgOjMCMIaDGlwiwZlePKT7\r\n553GtfsGxZMf05oqfUrQEQfJaU+/+Q==\n-----END CERTIFICATE-----\n",
  "certificate_info": {
    "subject_domain_name": "OID.2.5.4.41=VPN, EMAILADDRESS=admin@tesobe.com, CN=TESOBE CA, OU=TESOBE Operations, O=TESOBE, L=Berlin, ST=Berlin, C=DE",
    "issuer_domain_name": "CN=localhost, O=TESOBE GmbH, ST=Berlin, C=DE",
    "not_before": "2022-04-01T10:13:00.000Z",
    "not_after": "2032-04-01T10:13:00.000Z",
    "roles_info": "PEM Encoded Certificate does not contain PSD2 roles."
  },
  "created_by_user": {
    "user_id": "9ca9a7e4-6d02-40e3-a129-0b2bf89de9b1",
    "email": "felixsmith@example.com",
    "provider_id": "Chris",
    "provider": "http://127.0.0.1:8080",
    "username": "felixsmith"
  },
  "enabled": true,
  "created": "1100-01-01T00:00:00Z",
  "logo_url": "https://apisandbox.openbankproject.com/logo"
}

Possible errors (3)

OBP-10001: Incorrect json format.
OBP-20108: Invalid redirect URL. Each redirect URL must use https, use http only for localhost, 127.0.0.1 or [::1], or use an app scheme in reverse-domain form such as com.example.app, and must not contain a wildcard, user information or a fragment. Rejected entry:
OBP-50000: Unknown Error.