§1
Account Information — Permissions array flattening
→The Permissions field on consent responses is now a flat array of strings (previously a nested array of arrays).
Post-publication corrections · v2.1
Erratas
The authoritative register of corrections to published documentation against v2.1 — the TPP Standards, LFI Integration Guide, and OpenAPI specifications. Each entry records what was corrected, why the change was required, and the effective date.
17corrections
1errata release
12specs touched
Filter the register
Find a correction
Narrow by audience, functional area, or section. Add a keyword to refine further. Click a section chip on a result row to open the page the correction applies to.
Audience
Functional area
Section
Keyword
17 of 17 sections
v2.1-errata2
17 corrections
§2
Account Information — TrustFrameworkCode enum corrected to FI
→The TrustFrameworkCode enum on party responses now declares FI (previously the unemittable Undefined).
§3
Authorization Endpoints — POST /token restructured as oneOf; client_credentials grant added; client_id optional
→POST /token response is now a oneOf across grant types, client_credentials is documented, and client_id is optional to reflect mTLS client authentication.
§4
Confirmation of Payee — 204 response description corrected
→The 204 response description on POST /confirmation now reads "IBAN is not recognised" rather than the previous opt-out wording.
§5
Confirmation of Payee — aud claim tightened from array to single string
→The aud claim on every *BodySigned JWT payload on CoP is now a single string (previously an array of strings).
§6
Over-escaped regex patterns — doubled-backslash defect corrected across affected schemas
→Regex patterns published with doubled-backslash YAML escapes — the monetary Amount pattern across five specs, and the rarType and CoP response patterns on Ozone Connect User Operations — have been corrected to their canonical single-backslash form.
LFI · API Hub · Consent Manager · consents →LFI · API Hub · Consent Manager · consents-consentId →LFI · API Hub · Consent Manager · patch-consents-consentId →LFI · API Hub · Consent Manager · consent-groups-consentGroupId-consents →LFI · API Hub · Consent Manager · payment-log →LFI · API Hub · Consent Manager · payment-log-id →LFI · Banking · Service Initiation · payments →LFI · Banking · Service Initiation · payments-PaymentId →LFI · Banking · Service Initiation · payment-consents-ConsentId-refund →LFI · Consent Events · validate →LFI · Consent Events · event-op →
§7
Webhook Template — Permissions array flattening
→The Permissions field on consent webhook payloads is now a flat array of strings, matching §1.
§8
API Hub Consent Manager — unused AERiskExternalAccountIdentificationCode schema removed
→The unused namespaced AERiskExternalAccountIdentificationCode schema has been removed from the Consent Manager spec.
§9
Ozone Connect Health Check — echo-cert clientCertificate described as mTLS client cert, not server cert
→The clientCertificate.subject description and example on GET /echo-cert now describe the caller’s mTLS client certificate; the issuer example has been refreshed to the Sandbox Trust Framework issuing CA.
§10
Ozone Connect Bank Data Sharing — meta block added to GET /accounts/{AccountId}/statements
→The GET /accounts/{AccountId}/statements response now carries an optional meta block with firstAvailableDateTime and lastAvailableDateTime, letting LFIs advertise the date range of available statement data on the account.
§11
Risk object — nested schemas tightened to match the Standards definition
→The Risk object on the payment-initiation surfaces now rejects undeclared properties throughout its nested objects; the SupplementaryData blocks remain open extension points and AddressLine items are bounded.
TPP · Consent · par →TPP · Consent · payment-consents →TPP · Consent · payment-consents-ConsentId →TPP · Consent · patch-payment-consents-ConsentId →TPP · Banking · Service Initiation · payments →LFI · API Hub · Consent Manager · consents →LFI · API Hub · Consent Manager · consents-consentId →LFI · API Hub · Consent Manager · patch-consents-consentId →LFI · API Hub · Consent Manager · consent-groups-consentGroupId-consents →LFI · Banking · Service Initiation · payments →LFI · Consent Events · validate →LFI · Consent Events · event-op →
§12
Risk object — AccountType enum corrected to Retail / SME / Corporate
→The AccountType enum on the Risk object’s Creditor indicators is now Retail / SME / Corporate, replacing a divergent product-category enum; the Ozone Connect AEAccountTypeCode gains SME.
TPP · Consent · par →TPP · Consent · payment-consents →TPP · Consent · payment-consents-ConsentId →TPP · Consent · patch-payment-consents-ConsentId →LFI · API Hub · Consent Manager · consents →LFI · API Hub · Consent Manager · consents-consentId →LFI · API Hub · Consent Manager · patch-consents-consentId →LFI · API Hub · Consent Manager · consent-groups-consentGroupId-consents →LFI · Consent Events · validate →LFI · Consent Events · event-op →
§13
Account Information — AESupplementaryData opened as an extension point
→The AESupplementaryData schema on Bank Data Sharing responses is now an open object, so LFIs may carry implementation-specific fields that strict validation previously rejected.
§14
API Hub Consent Manager — ReadStatements and ReadProductFinanceRates added to the permission set
→The AEAccountAccessConsentPermissionCodes enum in the Consent Manager now includes ReadStatements and ReadProductFinanceRates, matching the v2.1 Standards Bank Data Sharing permission set.
§15
API Hub Consent Manager — consent-update schemas closed to unknown properties
→The three per-consent-type schemas behind the PATCH /consents/{consentId} request body now set additionalProperties: false, enforcing the field separation between consent types.
§16
API Hub Consent Manager — payment-log reject reason code casing reverted
→The payment-log reject reason code reverts to lower-case — rejectReasonCode at the top level and code / message inside CbuaePaymentLogRejectReasonCode — matching the v2.0.x Consent Manager contract.
§17
Ozone Connect Bank Data Sharing — GET /accounts/{accountId}/products scoped to the account
→The GET /accounts/{accountId}/products description now states the endpoint returns the products linked to the account in the path, not every product at the financial institution.
Governance
How this register works
The Errata register is bound by the policies that control how published content evolves. Once a version is published, its existing content MUST NOT be changed without an associated Errata record.
Changes to Published Documentation
How published content may change after release — what requires an Errata, what does not, and how corrections are communicated.
Read policy→
Version Management
How versions are numbered, when errata releases are cut, and how the relationship between Standards, API Hub, and Ozone Connect versions is maintained.
Read policy→
Operating rules
- Each entry has a unique identifier in the form
<version>-errata<n>— for example,v2.1-errata2. - Each entry states the affected document(s) and section(s), what changed, why the change was required, and the effective date.
- Existing published content MUST NOT be changed without an associated Errata record.
- Pre-publication content (for example
-rc,-rc-final) can be updated without an Errata.
For changes to operational systems rather than documentation, see the Release Notes for API Hub or Trust Framework.