Making use of the pre-approval request ID you received in the previous call. To retrieve an access code that you will use to get a heavy/submission token, make use of the URL and values found below.
| url | https://api.nedbank.co.za/apimarket/sandbox/nboauth/oauth20/authorize |
| username | password | Description |
|---|---|---|
| apimtestuser3 | IamN3db@nk123 | Test Nedbank ID credentials |
| Param | Value | Description |
|---|---|---|
| response_type | code | The type of data the endpoint will respond with |
| scope | openid,homeloans | The type of the scope of the call |
| redirect_uri | <REDIRECT URI> | URI that the authorisation must redirect the request to after completion. |
| client_id | <CLIENT ID> | Your client id, received when you registered your app on the developer portal. |
| intentid | <PRE-APPROVAL REQUEST ID> | The pre-approval request ID you received from the previous call. |
| itype | homeloans | This is the type of intent |
| state | <YOUR UNIQUE IDENTIFIER> | This is the state of call. You can replace with any value that will uniquely identify the request when it comes back to your redirect uri |
The process will redirect the user to the url provided in the 'redirect_uri' parameter. An authorization code will be attached to the redirect url, as in the sample below. Let’s assume your redirect_url was 'https://yourapp.co.za/handle/auth/':
https://yourapp.co.za/handle/auth/?code=xxxxxxxxxxxxxxxxxxxxxxxxxxxx
| Error | Description |
|---|---|
| ITYPE_MISSING_OR_INVALID | The provided itype param is either missing or has an invalid value. |
| INTENT_ID_MISSING | The intentid parameter is missing from the request. |
| INTENT_HAS_BEEN_USED_BEFORE | The intentid that was provided has been used before. |
| INTENT_HAS_EXPIRED | The intentid provided has expired. |
| INTENT_USED_OR_EXPIRED | THe intentid provided has been used before or it has expired. |
| BACK_BUTTON_NOT_ALLOWED | The user clicked on the back button in the authorisation screen. This action is not allowed. The user should click the decline button if they do not wish to authorise the transaction. |
| RIGHT_CLICK_NOT_ALLOWED | The user right clicked on the authorisation screen. This action is not allowed. |
| USER_DECLINED | The user has declined the transaction. |
| APPROVEIT_DECLINED_BY_USER | The user has declined the ApproveIt request. |
| APPROVEIT_TIMED_OUT | The ApproveIt request has timed out. This may be because the user did not respond to the ApproveIt request. |
| TOO_MANY_INVALID_OTP_TRIES | The user has entered too many incorrect ApproveIt OTPs. |
| SESSION_INVALIDATED_DUE_TO_USER_ACTION | The user's client returned invalid data to the authorisation server. |
| BACKEND_ERROR | Getting this error means that something went wrong on the authorisation server. Please contact us with your intentid and clientid so we can help. |
The error will be returned to your redirect uri in this format:
https://yourapp.co.za/handle/auth/error=access_denied&error_description=ITYPE_MISSING_OR_INVALID