TPA

What is TPA?

• Tactical Process Application

• Touch Point Architecture

• Third Party Administrator

• Through Payment Access

What are Access Tokens? (can choose multiple answers)

• A valid Access Token will make sure the API Gateway will pass the request on to the API and can be used as input for the permissions check

• The Access Token is sent with any request from the client; signed, so it can be trusted; encrypted, so the contents cannot be read outside ING; decrypted when it passes the API Gateway

• Access Tokens are JSON objects (JSON Web Tokens). Because these objects contain data, the API Gateway does not require a database, which makes it scalable.

• Access Tokens are does not contain any data. The API Gateway requires a database, which makes it scalable.

What is means?

• Means are used to identify and authenticate

• There are many types of means. Next to the examples on the right, think of SMS TAN, Smart Secure, One Time Passwords, Grid Cards, etc.

• The means are primarily used by the clients, e.g. calling ING CLT (Customer Loyalty Team)

• In TPA, every means has its own implementation that complies to the interfaces of the authentication platform, The Gateway.

What are means used for?

• Authentication

• Authorisation

• Both

• None of the above

Who is responsible for authenticating API request?

• Capability API

• API Gateway

• Experience API

• All of the above

Who is responsible for authorisation of API request?

• Capability API

• API Gateway

• Experience API

• All of the above

What is Permission API?

• Authenticating User

• Providing Permission for the user

• It is an external service used by ING

• It is called by API Gateway

What are APIs?

• It is a set of endpoints

• It can be accessed through http method

• It can be defined by swagger or open API specifications

• It cannot connect to the database

Does TPA recommend to create Experience APIs?

• Yes

• No