Skip to content

Domain API can be publicly discoverable + fixes with User Auth Context + redact consumer_key from responses + card counterparty binding - #2942

Merged
simonredfern merged 6 commits into
OpenBankProject:developfrom
simonredfern:develop
Oct 12, 2026
Merged

simonredfern merged 6 commits into
OpenBankProject:developfrom
simonredfern:develop

Conversation

@simonredfern

Copy link
Copy Markdown
Member

No description provided.

and can only be answered there. Alsok starting one needs the App Scope
or the User Role CanCreateUserAuthContextUpdate (now a bank-level Role)
at that bank whatever the scope settings. Additions to
UserAuthContextUpdateTest, UserAuthContextTest
allow_direct_login both DirectLogin routes share one handler that
refuses first with the new error
DirectLoginIsDisabled (OBP-20409, 403). + DirectLoginTest + OBP Sentinel
glossary item
  Consumers and Update Consumer responses and v6 Get Consumer; v7
  Get Consumers, Get Consumer and Update Consumer
  redirect_url/logo_url/certificate/name without consumer_key; consent
  consumer
  mismatch logs consumer_id not consumer_key + record consumer last used
  in redis. + use client_id if azp is not present so we don't create
  multiple consumers with client credentials tokens
 (description, and the error list entry updated to include
 CounterpartyNotFoundByCounterpartyId)
@sonarqubecloud

Copy link
Copy Markdown

@simonredfern
simonredfern merged commit 58ffbce into OpenBankProject:develop Oct 12, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant