Proof of transaction approval

In the Config Editor:

0. Go to
   Transaction Approval >> Flows >> <your Transaction Approval Flow>
1. In the Steps list, create a No Operation Step plugin as the last step of the flow. Edit the plugin as follows:
2. Advanced Settings section, Custom Response Attributes property: Create a Value Provider Map plugin, as follows:

3. Value Provider Map plugin configuration

   0. Value Providers property: Add a new row with the following details:
      - Key field: Enter a suitable key, such as “jwt”
      - Plugin field: Create a Ticket String Provider plugin. This plugin provides the JWT token as a string. It defines the signature details and content of the JWT token (which is basically a list of key-value pairs). Edit the plugin as follows:

   1. Ticket String Provider plugin configuration

      • Value Providers list: Add the two plugins User Identity Map and Transaction Approval Parameters Map. These plugins provide the values for the JWT token's key-value pairs.
      • The Key-Value Pairs list defines the key-value pairs that build the encoded content of the JWT token. Add four Ticket Key Value plugins to the list. Per plugin, specify the following properties (see also the table below):
        - The Ticket Key property: Defines the key under which the key-value pair is added to the JWT token.
        - The Value Selector property: Selects an entry from the previously defined value providers to obtain the value for this key-value pair.
      • • Ensure that the values you enter here for the transaction details equal the names of the corresponding parameters defined in the Transaction Approval Parameter Step of your transaction flow. See also Transaction Approval flow with approval proof above.

      • Ticket Key Value plugins configuration

      • Plugin properties
        Ticket Key	Value Selector
        username Keep this key in mind. You'll need it later on.	user-id
        accountNumber	See the name of the corresponding parameter in the Message Parameters list of the Transaction Approval Parameter Step
        amount	See the name of the corresponding parameter in the Message Parameters list of the Transaction Approval Parameter Step
        currency	See the name of the corresponding parameter in the Message Parameters list of the Transaction Approval Parameter Step

      • Ticket Encoder field: Add a JWT Ticket Encoder plugin. This plugin defines the signer and encoder settings of the JWT token. Edit the plugin as follows:

      • JWT Ticket Encoder plugin configuration

        • Claim Settings section, Username Ticket Key field: Defines the key used to find the username for the JWT token. The username will be written to the subject field sub of the JWT. Enter the key you previously defined for the “Username” key-value pair in the Ticket Key Value plugin, namely username.
        • Security Settings section, Signer field: Defines the settings used for signing the JWT. Create a JWT Ticket RSA Signer Settings plugin and edit it as shown in the following table:

        • JWT Ticket RSA Signer Settings plugin configuration

        • Field	Description	Value
          Keystore Path	The keystore that holds the private key for JWT token signing.	By default, the path to the keystore is instances/<instance name>/server.p12
          Keystore Password	The password of the keystore.	<your keystore password>
          Private Key Alias	Alias for the private key in the keystore used for signing the JWT token. You can leave this field empty if your keystore only contains one private key.	<your private key alias>
          Private Key Password	Password of the private key in the keystore.	<your private key password>
4. Click Activate to activate your configuration.
5. You have now configured a No Operation Step at the end of your Transaction Approval flow. This step returns a signed JWT token with details from the current transaction flow. The token can be used as proof of approval.

REST requests and final response

0. Select the default transaction approval flow:
1.  

   Example

   POST /transaction-approval/flows/default/select/
2. Identify the respective end-user:
3.  

   Example

   POST /transaction-approval/user/identify/ 
   { 
       "username": "itester"
   }
4. Provide the transaction parameters to be approved by the end-user:
5.  

   Example

   POST /transaction-approval/parameters/ 
   { 
        "messageParameters": { 
          "accountNumber": "12345", 
          "amount": "300", 
          "currency": "CHF" 
        } 
   }
6. Check the status of the transaction approval (here with Airlock 2FA as second factor):
7.  

   Example

   POST /transaction-approval/airlock-2fa/status/poll/
8. When the end-user succesfully approved the transaction, IAM will return the following response, including the encoded JWT token:
9.  

   Example

   { 
       "meta": { 
           "type": "jsonapi.metadata.document", 
           "timestamp": "2025-04-17T10:22:38.182+02:00" 
       }, 
       "data": { 
           "type": "transaction-approval.session", 
           "id": "592545411708722659", 
           "attributes": { 
               "customAttributes": { 
                   "jwt": "eyJraWQiOiI0MWNjMDhmZDYxNzc2MGZhZTc3ZTk1NTdhYTAzMDE4ZTJjOGIwMzM5IiwidHlwIjoiSldUIiwiYWxnIjoiUlM1MTIifQ.eyJzdWIiOiJpdGVzdGVyIiwiYW1vdW50IjoiMzAwIiwibmJmIjoxNzQ0ODc4MTUzLCJjdXJyZW5jeSI6IkNIRiIsImV4cCI6MTc0NDg3ODc1OCwiYWNjb3VudE51bWJlciI6IjEyMzQ1IiwiaWF0IjoxNzQ0ODc4MTU4LCJqdGkiOiIyMWU1MDM2Yi0zZjMyLTQxNjAtYjhkZS03ZjIyMThjZjE1Y2EifQ.cbM6bKsI_t-iPQao9OZsJq7pO6RJy2WKpRLp5vsmJQ-2WvBEiQlwan1vSN-h_VwKkWQO6oHELYStbFJhry4J4pUNzonhyUukQLiERysc72gqO9hwHruV9lvhP927TiBHmtNO3cjQInZy84leAgRy1kcD8nl5JJyd6OOIWikPZwYVTgFcLgu4uPv5ZDjWMXAGmhPF-3vlIK5yxHKy9gI0u_4j5NVL_IQuhyMjbeWQ4kH2D3SQ4Na3D3AiVWzhEKYydISvVLvM_VkcwbWnrtukLjL7YYiprxGav4yZQOOSOTjM0Zb-uxThya9utjMiwnXIKQaW7Q0ccBZcQUDLsgMG6fh_J0Ai6LCFF8i7hN94_Q-WPIw0WcQtI-mRiWtUDlq1tgg7YakubRmp-jKolAmlt1d8TtU8eJ1e1HCmnLpnYp-KzjBVxbuA8bTCgGcIDhu0yRL5JJNsWu6y6uNiZQwslzQoLPXQSSALobW5LFeS-stj2VGVL-kbW0QGBjefiDZnO4UeMOdmdmTSzEysf-1t7Y9SOM2AIrsYxOD3u6NcpTEUqim5HDX60rmXwCu1H2rlU-dNxMMVZddHIriNCGuBbZca1668qZ-TynBjCVr5pYK1l_uihCRzXz_AjF119qK9R0zGLzm0KUs15FKthobG2AzklpsHtfM84TaOFZR6LC8" 
               } 
           } 
       } 
   }

10. The decoded JWT has the following content:

11.  

    Example

    { 
      "sub": "itester", 
      "amount": "300", 
      "nbf": 1744878153, 
      "currency": "CHF", 
      "exp": 1744878758, 
      "accountNumber": "12345", 
      "iat": 1744878158, 
      "jti": "21e5036b-3f32-4160-b8de-7f2218cf15ca" 
    }