Raiffeisen PAY Portal (RPP)
The Raiffeisen PAY Portal is an interface provided and operated by the bank, where persons registered in the System Administrator and Approver roles can log in.
On the portal, System Administrator and Approver persons log in with strong customer authentication (SCA) and must also authenticate all their settings each time with strong customer authentication.
The Approver role only exists when using products that require consent, namely Payment API and Balance API.
Raiffeisen PAY Users
System Administrator
The role of the System Administrator (Admin) is to create API users and associated certificates (CERT) on the Raiffeisen Pay Portal, as well as to compile, create and submit consents via API message to the Raiffeisen Pay Portal, and to correctly and properly use the consent IDs received from the bank for mandates and transfers.
Approver
A user with a signatory role registered at the bank. The bank only accepts as Approver a person who has a signature card registered and accepted at the bank. If the bank deletes the signature card associated with the user (e.g. at the client's request), the approver's signing authority ceases and the consents created for them will become invalid.
The content of consents created for the Approver user can be checked, validated or revoked by the Approver by logging into the Raiffeisen Pay Portal 24/7. Through the Portal, they can also check the list of transactions executed in the name of their consent.
The Approver can check and validate Consents created for the Approver user, or Consents created without a prior approver (signer), for which the user has the appropriate authorization for the accounts. After approval (validation), the Consents approved by the user can be revoked by logging into the Raiffeisen Pay Portal 24/7. The Approver can also check the list of transactions executed on behalf of the user's consent through the Portal.
Certificates and Consents
Consent creation is ONLY required for the Payment API and the Balance API.
Consent
A declaration of consent given by the Approver user, according to which the Bank treats transfers submitted via API channel equipped with the approver's consent as transfers bankingly signed by the Approver.
The transfers submitted via API channel do not need to be checked and approved by the approver at the time of submission, as this is replaced by the valid consent, as a pre-given signature.
One approver and one or more account numbers can be assigned to a consent. The consent is sent by the client from their own IT system to the bank's system via API call or by logging into the Raiffeisen Pay Portal from the user interface. The consent created with the signer appears as a request on the Raiffeisen Pay Portal for the pre-designated Approver, while the consent created without the signer appears as a request for every person with approver rights.
The validity of the consent is determined on one hand by the bank by checking the validity and account authorization specified in the consent for each transfer, and on the other hand by the Approver themselves by approving (accepting) the consent's usability by the client for signing transfers on the Raiffeisen Pay Portal interface. This approval can be revoked at any time (24/7) on the same interface.
A consent is valid for a maximum of 3 months. It can be renewed if it has not yet expired. After expiration, a new consent must be created. The bank does not notify the client about the expiry of consents. The client must take care of creating a new consent and consent ID and having it accepted by the Approver.
One approver can have multiple consents at the same time with the same or different authorizations.
A consent can also be created without a pre-designated approver (signer).
A consent created without a signer can be approved by any person with approver rights for the accounts included in the consent, among the incoming requests on the Raiffeisen Pay Portal.
When the consent is approved, the approving person is recorded as the signer.
Consent ID
The identification number belonging to the consent. The consent ID must be attached to the message in the client-side system sending the transfer or mandate. The consent ID determines which consent the bank should regard as the signature (approval) of the Approver. 2 consent IDs must be attached to each mandate.
API user (CERT or Certificate)
The API user is essentially a client profile created by the System Administrator. One or more account numbers of the client, the expiry date, and the function for which the profile can be used (QR, RTP or Payment) can be assigned to the profile. The System Administrator can create multiple API user profiles for the client (company) with different or identical account numbers, expiry dates and functions.