Permissions - Data API API Reference

Permissions define what data your application can access from an end user's accounts. When an end user authorizes your application, they grant specific permissions that determine which API endpoints you can call.

Permission Scopes

Fiskil organizes permissions into logical groups based on the type of data they provide access to.

Banking Permissions

Permission	Description	Related Endpoints
`accounts`	Access to account details	Accounts
`balances`	Access to account balances	Balance
`transactions`	Access to transaction history	Transactions
`payees`	Access to payee information	Payee
`direct_debits`	Access to direct debit information	Direct Debits
`scheduled_payments`	Access to scheduled payment information	Scheduled Payments

Energy Permissions

Permission	Description	Related Endpoints
`energy_accounts`	Access to energy account details	Energy Accounts
`energy_balances`	Access to energy account balances	Energy Balances
`usage`	Access to energy usage data	Usage
`billing`	Access to billing information	Billing
`invoices`	Access to invoice data	Invoices
`concessions`	Access to concession information	Concessions
`service_points`	Access to service point information	Service Points
`der`	Access to Distributed Energy Resources data	DER
`payment_schedule`	Access to payment schedule information	Payment Schedule

Common Permissions

Permission	Description	Related Endpoints
`identity`	Access to identity information	Identity

Requesting Permissions

Permissions are requested during the auth session creation. The end user will see which permissions your application is requesting and can choose to grant or deny access.

Example: Requesting Permissions

When creating an auth session, you can specify which permissions to request:

{
  "end_user_id": "482c0e2b-5866-46b1-b795-220b7bba45b5",
  "permissions": ["accounts", "balances", "transactions"],
  "redirect_uri": "https://yourapp.com/callback"
}

Checking Granted Permissions

You can check which permissions have been granted for a specific consent by using the Consents API. The permissions field in the consent response will list all granted permissions.

{
  "arrangement_id": "94549a73-a554-4b76-b824-d96898829751",
  "end_user_id": "482c0e2b-5866-46b1-b795-220b7bba45b5",
  "permissions": [
    "accounts",
    "balances",
    "transactions"
  ],
  "active": true,
  "expires_at": "2023-01-01T10:42:40Z"
}

Best Practices

Request Only What You Need: Only request permissions for data you actually need. This improves user trust and conversion rates.
Explain Why You Need Each Permission: In your UI, explain to users why you need each permission before they start the consent flow.
Handle Missing Permissions Gracefully: If an API call fails due to missing permissions, provide clear guidance to users on how to grant additional permissions.
Monitor Permission Usage: Track which permissions you're actively using and consider removing unused ones from your requests.