Try it Out (Sandbox)

A guide for developers to test Rabobank's OAuth Premium Authorization and Consent Details Service APIs in the Sandbox environment.

📘
The Sandbox simulates OAuth and consent flows.

Use Sandbox endpoints only.

Consent and token flows return simulated responses.

Do not use Sandbox credentials in production.

Before you start

Make sure you have:

A Rabobank Developer Portal account
A registered application
A configured OAuth redirect URI
A subscription to:
- Consent Details Service (optional)

Base URLs

All sandbox API endpoints start with:

OAuth Premium

https://oauth-sandbox.rabobank.nl/openapi/sandbox/oauth2-premium

Consent Details Service

https://api-sandbox.rabobank.nl/openapi/sandbox/oauth2-premium

Example Requests And Responses

Authorization code and implicit grants

Endpoint: https://oauth-sandbox.rabobank.nl/openapi/sandbox/oauth2-premium/authorize

Request

oauth-sandbox.rabobank.nl/openapi/sandbox/oauth2-premium/authorize?response_type=code&scope=bai.accountinformation.read&client_id={{X-IBM-Client-ID}}&redirect_uri={{redirect_uri}}/v1/callback&state=123

Response

https://your.redirect.url

If the user does not approve the consent request, the response from the Rabobank OAuth server to your application's URL contains an ‘access_denied’ error message.

https://your.redirect.url?error=access_denied

If the user cancels before authorizing the consent request, the response from the Rabobank OAuth server to your application's URL contains an ‘access_denied’ error message.

https://your.redirect.url?error=access_denied

Request Access Tokens

Endpoint: https://oauth-sandbox.rabobank.nl/openapi/sandbox/oauth2-premium/token

Request

Headers:

Content-Type: application/x-www-form-urlencoded
Authorization: Basic BASE64(CLIENT_ID:CLIENT_SECRET)

Body:

grant_type=authorization_code
code=AUTHORIZATION_CODE

Response

{
  "token_type": "bearer",
  "access_token": "ACCESS_TOKEN",
  "expires_in": 86400,
  "consented_on": 1507267950,
  "metadata": "a:consentId 123a1a2a-888c-4015-8099-f88b080d0bbb",
  "scope": "bai.accountinformation.read",
  "refresh_token": "REFRESH_TOKEN",
  "refresh_token_expires_in": 2592000
}

📘
The metadata field contains the Consent ID. Use this value when calling the Consent Details Service.

Refresh an access token

Endpoint: https://oauth-sandbox.rabobank.nl/openapi/sandbox/oauth2-premium/token

Request:

grant_type=refresh_token
refresh_token=REFRESH_TOKEN

Response:

{
  "token_type": "bearer",
  "access_token": "ACCESS_TOKEN",
  "expires_in": 86400,
  "consented_on": 1507267950,
  "metadata": "a:consentId 123a1a2a-888c-4015-8099-f88b080d0bbb",
  "scope": "bai.accountinformation.read",
  "refresh_token": "REFRESH_TOKEN",
  "refresh_token_expires_in": 2592000
}

📘
Refresh tokens are single-use tokens. Store them securely and replace them after every refresh request.

Consent Details Service

Use this API to retrieve consent details and validate consent status.

Endpoint

GET https://api-sandbox.rabobank.nl/openapi/sandbox/oauth2-premium/v1/consents/{consentId}

Required headers

X-IBM-Client-Id: <CLIENT_ID>
X-Request-ID: <UUID>
Authorization: Bearer <ACCESS_TOKEN>

Example request

GET /v1/consents/6dfa1a2a-888c-4015-8099-f88b080d0bbb

Example response

{
  "consentId": "6dfa1a2a-888c-4015-8099-f88b080d0bbb",
  "access": {
    "bai.accountinformation.read": [
      {
          "currency": "EUR",
          "iban": "NL52RABO0125618484",
          "status": "valid",
          "validUntil": "9999-12-31"
      },
      {
          "currency": "EUR",
          "iban": "NL80RABO1127000002",
          "status": "valid",
          "validUntil": "9999-12-31"
      }
    ]
  }
}

Consent statuses

Status	Meaning
valid	Consent is active
revokedByPsu	Revoked by the user
cancelled	Cancelled by Rabobank

If the consent status is not valid, request a new consent from the user.

Sandbox test scenarios

Authorization

Scenario	Result
Valid authorization request	Authorization code returned
Invalid client_id	401 Unauthorized
Invalid redirect_uri	Authorization error page
User denies consent	Redirect with `error=access_denied`
User cancels consent	Redirect with `error=access_denied`

Token exchange

Scenario	Result
Valid authorization code	200 OK
Expired authorization code	400 `invalid_grant`
Reused authorization code	400 `invalid_grant`
Invalid refresh token	401 `invalid_grant`
Missing grant_type	400 `invalid_request`
Invalid client credentials	401 `invalid_client`

Consent Details Service

Scenario	Result
Valid consentId	200 OK
Unknown consentId	404 Not Found
Invalid access token	401 Unauthorized
Expired or revoked consent	403 Forbidden (`CONSENT_INVALID`)

Security guidelines

Store Client Secrets on the server side only.
Store Access Tokens and Refresh Tokens securely.
Use HTTPS for all client-server and server-server communication.
Open Rabobank authorization pages in the user's browser.
Never embed Rabobank authorization pages inside your application.
Validate TLS certificates during HTTPS communication.
Use established OAuth 2.0 libraries instead of custom implementations.