AA Community Guidelines - AA Client Integration

• An application that enables citizens to interact with the AA for the purposes of registration, account discovery and linking and consent management – thus implying that the “interface” (e.g. a screen) used by the citizen during the interaction is considered part of the AA Client.

• Available as either a web application or a mobile application or a library that can be embedded in other web or mobile applications (subject to constraints imposed by security concerns)

• Owned by an AA

The term “library” is interchangeable with the term “SDK”.

Further, as mentioned in the first characteristic, the “library” (or “SDK”) includes the customer-facing interface (such as a “Screen”).

A “set of APIs” or a “headless library” (i.e. without screens) does not qualify to be called an AA Client. These are internal engineering assets of an AA, which may be provided to their partner FIUs on the basis of bilateral agreements, for the purpose of co-development of an AA client.

However, the interfaces (e.g. screens) that are part of the AA Client design may be customised or co-designed by FIUs, in partnership with AAs, to suit their user interface and user experience requirements.

The co-development scope may include any or all of the following:

• User interface redesign
• User experience (i.e. workflow or sequence of steps that a user experiences) redesign
• Development assistance, supporting the redesign efforts

As long as the interaction is bound by common guidelines derived from Master Directions and/or technical specifications, FIUs and AAs are free to redesign AA Client interfaces as per their requirements.

Such common guidelines are codified in a community-driven “Customer Experience Guidelines Checklist”.

Further, any redesigned interface screens are also “owned” by the AA, with respect to all aspects of development and devops. As part of a joint design and development effort with respect to the interface screens, AAs may provide access to internal APIs as they deem fit, while retaining complete control over all aspects of development, testing and distribution.

FIUs and AAs are, however, free to enter into any bilateral legal agreements to restrict usage of such co-designed interfaces to named parties mutually agreed to.

While it is possible for one AA to partner with other AAs and provide an AA library that works with multiple AA services, it is not necessary for AAs to do so.

Further, given that AA libraries have to be owned by AAs, a “super library” owned by a TSP in partnership with AAs is also not feasible.

FIUs therefore, as of now, have to integrate AA libraries from different AAs, if they wish to connect to different AA services using the “library” mode of integration.

One possibility is for AAs to come together to co-own a single library that connects to their services.

This has to be further discussed within the community.

For web apps of an FIU:

• Redirection to a web application of an AA

The redirection may result in the web application of the AA being rendered either standalone or as an iFrame, within the parent web application.

For mobile apps of an FIU:

• Redirection to a web application of an AA
• Invocation of an embedded mobile library of an AA
• App-to-app integration, with an pre-installed mobile application of the AA on the same device

Technical guidelines for Redirection have been Finalised within the community.

Technical guidelines for Invocation and app-to-app integration are being discussed within the community.

Applications that embed such web libraries, in their web applications, are likely to gain control over data that flows to-and-fro between the library and the backend service.

Such risks can be mitigated technically for mobile libraries (e.g. built using Android, iOS) embedded within host mobile applications. They cannot be mitigated for web libraries.

It is therefore recommended that no AA offers an embedded web library to FIUs as an AA client.

This implies the following:

For AA clients of type = web application:

• Ownership of the application code and its underlying infrastructure (including the environment the application is hosted on) has to reside with the AA

For AA clients of type = mobile application OR mobile library:

• Ownership of the application code, distribution of the applications, ownership of the distributed app packages has to reside with the AA

The accountability of all aspects pertaining to the AA client rests solely with the AA.

In addition to parameters that help an AA authenticate the app user (e.g. mobile number) and the FIU determine user experience post-AA-interaction (e.g. whether the user approved a consent request or not), it may be useful for an FIU to determine the termination stage in a user’s AA journey.

This is useful for the FIU to provide appropriate support for repeat tries / grievance redressal to the citizen.

In addition to such information pertinent to an individual citizen’s AA journey, it would also be useful for the FIU to get anonymized, aggregated metadata about its customers’ AA journey. Such metadata may include all information necessary for the FIU and the AA to jointly construct a “drop-off funnel” and use the same to improve user experience.

The parameters that constitute such “metadata” – both for an individual citizen and at an aggregated, anonymized level – are being discussed within the community.

The FIU name and logo may also be optionally added to such co-designed screens, to ensure there is contextual continuity to users while switching between the FIU and the AA interfaces.

This is to enable contextual continuity to users while switching between the FIU and AA interfaces.

In order to do so, FIUs may get FIP names via the Central Registry API.

FIP logos are currently not part of the Central Registry. The same is being discussed currently.

The redirection and invocation guidelines may include this as an additional parameter. The same is being discussed within the community.