Glossary
Terminology
System: Managed platform leveraging industry standards for data providers and data recipients to empower the consumers with a secure and transparent way to share data.
Data API: The Data API allows recipients to request consumer-permissioned data to flow from Akoya. Based on the FDX specification, it includes FDX endpoints.
Data Recipient Hub: This is where you manage your API credentials and register your redirect URI(s).
Permission API: The Akoya Permission API allows a data provider to create or support a permission dashboard for its consumers.
Sandbox: A dedicated test environment, sandbox, allows recipients to make real calls to token and data access endpoints. The only data provider available in sandbox is the test financial institution.
Data Access
Client ID: Public identifier of an app.
Client secret: Private identifier of an app used during authentication of an API.
Consumer: An individual or representative acting on behalf of an individual with ownership rights to the data and transactional capabilities at a data provider.
Data aggregator: Entities that obtain consumer financial data from data providers.
Data provider: A financial institution, like a bank, investment firm, or other organization which provides financial services to consumers.
Data recipient: A third-party, like a data aggregator or fintech company, which processes financial data on behalf a consumer.
Financial Data Exchange (FDX): A nonprofit dedicated to unifying the financial industry around a common, interoperable, royalty-free standard for the secure access of consumer and business financial data.
Screen scraping: When a customer gives their user name and password to a third-party, usually a data aggregator, to sign in as that consumer, and extract information to populate its service. With these credentials, a third-party has the same access to an account as the customer themselves. This means that customers lack control over the scope or even duration of access they give to a third-party.
Authorization, Authentication, and Tokens
Authentication: Process of obtaining credentials from a user to verify the user's identity.
Authorization: Process of granting access rights to an authenticated entity.
Authorization code: Temporary code that the data recipient (data aggregator or fintech company) exchanges for an ID token. In Akoya's testing environment, the authorization code is valid for 5 minutes.
ID token: An OIDC security token which contains the user’s authentication information in a JSON Web Token (JWT). JWT is a standardized, validated and/or encrypted container format used to securely transfer data between two parties. In the testing environment, the ID token is valid for 30 minutes.
OAuth: An open standard for token-based authorization protocol on the internet. It enables apps to obtain limited access to a consumer’s data using a token instead of a consumer’s password. The token grants access to only the information a consumer has authorized for a specific app.
OpenID Connect (OIDC): An identity layer built on top of the OAuth 2.0 protocol. It defines a sign-in flow that enables a client application to authenticate a user and to obtain information (or "claims") about that user, such as the user name and email. A secure JSON Web Token (JWT) encodes the user identity information.
Redirect URI: The location (typically in your application) where financial institutions send users after they authenticate successfully.
Refresh token: A token used to get a new set of refresh and ID tokens when the ID token expires or becomes invalid.
API Terminology
API: Acronym for Application Programming Interface. APIs let applications (and devices) seamlessly connect and communicate securely.
cURL: Tool to transfer data from or to a server using one of the supported protocols.
Endpoint: Specifies where third-party software can access resources. Third-party software typically accesses resources via a URI, posting HTTP requests and receiving responses.
Header: A user defined HTTP header which carries information about a request in a REST call.
HTTP Verbs: The four basic HTTP verbs Akoya uses in requests to interact with resources in a REST system:
GET — retrieve a specific resource (by id) or a collection of resources
POST — create a new resource
PUT — update a specific resource (by id)
DELETE — remove a specific resource by id
REST (or Representational State Transfer): An architectural style for providing standards between computer systems on the web, making it easier for systems to communicate with each other. In brief, the REST architectural style treats data and functionality as resources and accesses them using Uniform Resource Identifiers (URIs).
Uniform Resource Identifier (URI): A string of characters that refers to a resource. The most common are URLs, which identify the resource by giving its location on the web.