Learning Objectives:

  • Define APIs and understand their role in open banking.

  • Explain API architecture, including REST, SOAP, and GraphQL.

  • Understand API security best practices and governance.

  • Analyse how APIs enable open banking and fintech integration.

3.1 What are APIs?

APIs (Application Programming Interfaces) are the backbone of open banking, defining how different software systems can communicate and exchange information. The HKIB syllabus covers “API – SOAP, REST, GraphQL” as a core topic . The GIFT IFI course covers “APIs for Core Banking Integrations” as a core topic .

Key Functions of APIs in Open Banking:

  • Secure Data Sharing: APIs provide a secure and standardised intermediary for data exchange .

  • Standardised Communication: APIs define how different software systems can communicate and exchange information .

  • Third-Party Integration: The HKIB syllabus covers “API Centric Financial Hub” .

3.2 API Architecture

The HKIB syllabus covers “API – SOAP, REST, GraphQL” as a core topic .

SOAP (Simple Object Access Protocol):

  • A protocol for exchanging structured information.

  • Uses XML for messaging.

  • More rigid and complex than REST.

REST (Representational State Transfer):

  • The most common API architecture for web services.

  • Uses HTTP methods (GET, POST, PUT, DELETE).

  • Simpler and more flexible than SOAP.

GraphQL:

  • A query language for APIs.

  • Allows clients to request specific data they need.

  • More efficient than REST for complex queries.

3.3 API Security Best Practices

The assignment notes identify several key security measures required for open banking APIs :

Strong Authentication and Authorization:

  • Authentication: Ensuring only legitimate users/applications can access the API (e.g., using OAuth 2.0 Tokens or API Keys).

  • Authorization: Implementing role-based access control (RBAC) to ensure authenticated users can only access the data they absolutely need (principle of least privilege) .

Data Encryption:

  • Using HTTPS (TLS) to encrypt data while it is being sent over the internet (data in transit), preventing eavesdropping.

  • Encrypting sensitive data when stored (data at rest) .

Input Validation:

  • Ensuring all data received from the client is sanitized and validated to prevent injection attacks (e.g., SQL Injection) .

Rate Limiting:

  • Restricting the number of requests a user can make within a specific time period to prevent API misuse or Denial-of-Service (DoS) attacks .

Logging and Monitoring:

  • Logging all API activity to detect anomalies or attempted attacks in real-time .

3.4 API Management and Governance

The HKIB syllabus covers “API Management” as a core topic . The GIFT IFI course covers “Middleware and API Management Tools” as a core topic .

Key API Management Functions:

  • API Gateway: A single entry point for API requests.

  • API Lifecycle Management: Managing APIs from design to retirement.

  • Developer Portals: The Uphilos course covers “Developer portals and onboarding” and how to “attract and support fintech partners by building intuitive developer experiences, sandboxes, and documentation” .

  • Sandbox Testing: The GIFT IFI course covers “Banking APIs and Sandbox Testing” . The HKIB syllabus covers “Sandbox arrangement” .

Case Analysis:
The HKIB syllabus includes “Case Analysis – Transformation of Banking and Payments Through Open APIs” and “Case Study – Koho Financial Inc.: Facing a New Banking Era” .

PreviousNext