Q:
We're starting to work with Bulk Verification of Payee API (BVoP) and while calling the endpoint:
POST corporate/premium/v1/bulk-verification-of-payee
we encounter the following error: <httpMessage>Unauthorized</httpMessage>\n <moreInformation>Invalid client id or secret.</moreInformation>
Response Body": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errorResponse>\n <httpCode>401</httpCode>\n <httpMessage>Unauthorized</httpMessage>\n <moreInformation>Invalid client id or secret.</moreInformation>\n</errorResponse>
What could be the reason?
A:
Make sure that the HTTP header in your request is X-IBM-Client-Id and you send a correct Client ID and Client Secret.
Please refer to:
- Bulk Verification of Payee
- Nordea Developer Portal (API Market Sandbox) guide
- Bulk Verification of Payee - API Reference
Q:
(Sandbox) While requesting:
Method: GET, RequestUrl: 'https://api.nordeaopenbanking.com/corporate/premium/v1/bulk-verification-of-payee?batch_identification=123456789', Version: 1.1, Content: , Headers:
{
Authorization: Bearer eyJjdHkiOiJKV1Qi***.XqYauNZjvMw_yKGgLdmywg
X-IBM-Client-Id: 3a51***a056
X-IBM-Client-Secret: ***
X-Nordea-Originating-Host: api.nordeaopenbanking.com
X-Nordea-Originating-Date: Wed, 01 Oct 2025 14:32:07 GMT
Signature: keyId="3a5175***a056",algorithm="rsa-sha256",headers="(request-target) x-nordea-originating-host x-nordea-originating-date",signature="I4mGdjhvSVK***lwhLM1wlbUuwa8lSh6DbNv5"
}
we received the following error: StatusCode: 405, ReasonPhrase: 'Method Not Allowed'.
-----------------------------Response -> 405 not Allowed------------------
Method HTTP response: 405 Method Not Allowed: Time:130 ms FinancialCommunicationsService
10/01/2025 14:32:07 BankConnections Information AutoUser StatusCode: 405, ReasonPhrase: 'Method Not Allowed', Version: 1.1, Content: System.Net.Http.HttpConnectionResponseContent, Headers:
{
Date: Wed, 01 Oct 2025 14:32:07 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Global-Transaction-ID: 7fd914***7572
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/json
}
Why is that?
A:
For your MsgId 123456789 (provided in <CstmrPmtStsRpt><GrpHdr><MsgId> from your POST response), you should have used the following GET request structure:
https://api.nordeaopenbanking.com/corporate/premium/v1/bulk-verification-of-payee/123456789
Q:
We encountered the following error: <code>error.authorization</code><description>Invalid or missing user or access right</description>. What could be the reason?
"response_body": "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?><errorResponse><groupHeader><messageIdentification>3779643e646d484e</messageIdentification><creationDateTime>2026-04-18T07:33:55.585Z</creationDateTime><httpCode>403</httpCode></groupHeader><response xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"errorPayload\"><request><url>/premium/v1/bulk-verification-of-payee</url></request><failures><code>error.authorization</code><description>Invalid or missing user or access right</description></failures></response></errorResponse>",
A:
Make sure you provided a valid logon ID in the Logon-Id header within your request. Refer to:
Bulk Verification of Payee - API Reference
Q:
We try to connect to the Bulk VoP API, but while calling the endpoint:
we get the following error: {\"httpCode\":\"401\",\"httpMessage\":\"Unauthorized\",\"moreInformation\":\"Cannot find valid subscription for the incoming API request.\"}
A:
POST /corporate/v2/authorize endpoint is not a part of Bulk VoP API. You need to request:
POST corporate/premium/v1/bulk-verification-of-payee
and provide Logon ID and Agreement Number in the headers. See:
Bulk Verification of Payee - API Reference
Q:
While calling the endpoint:
POST corporate/premium/v1/bulk-verification-of-payee
we encountered the error: <code>error.signature.invalid</code><description>Signature is invalid./description>
<errorResponse>
<groupHeader>
<messageIdentification>4f12c74a14cfba6c</messageIdentification>
<creationDateTime>2026-05-04T15:48:16.705Z</creationDateTime>
<httpCode>401</httpCode>
</groupHeader>
<response xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="errorPayload">
<request>
<url>/premium/v1/bulk-verification-of-payee</url>
</request>
<failures>
<code>error.signature.invalid</code>
<description>Signature is invalid.</description>
</failures>
</response>
</errorResponse>
How to resolve it?
A:
As the Signature creation is the same for all APIs, please see:
How can I get started signing with eIDAS?
Q:
In Sandbox, while calling:
GET corporate/premium/v1/bulk-verification-of-payee/{batch_identification}
we encountered the following error: <code>error.notfound</code><description>Entity not found for BatchId da500fa5d45ef4d176ad294e5f277d13 and clientId 40d481aa-***-2f4d67f5c65f</description>. What could be the cause?
Example:
POST https://api.nordeaopenbanking.com/corporate/premium/v1/bulk-verification-of-payee
Payload: nordea_example_pain.001.001.03.xml
Headers:
Digest: SHA-256=ru3g6***IXdk=
Signature: keyId="40d481aa-***-2f4d67f5c65f", algorithm="rsa-sha256", headers="(request-target) x-nordea-originating-host x-nordea-originating-date content-type digest", signature="j9yxeaVr***aPd2ByNK9"
X-IBM-Client-Id: 40d481aa-***-2f4d67f5c65f
X-Nordea-Originating-Date: Fri, 22 May 2026 05:49:00 GMT
X-Nordea-Originating-Host: api.nordeaopenbanking.com
Logon-Id: 123456781
Agreement-Number: 123456781
Document-Version: pain.001.001.03
Agreement-Type: WS
X-IBM-Client-Secret: <HiddenValue>
Content-Type: application/xml
Response
Content
<root xmlns:ns2="urn:iso:std:iso:20022:tech:xsd:pain.002.001.10">
<groupHeader>
<messageIdentification>da500fa5d45ef4d176ad294e5f277d13</messageIdentification>
<creationDateTime>2026-05-22T05:52:37.496Z</creationDateTime>
<httpCode>202</httpCode>
</groupHeader>
<response xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="ns2:Document">
<ns2:CstmrPmtStsRpt>
<ns2:GrpHdr>
<ns2:MsgId>3e4daf56f78f446abadf5fd2d8daed62</ns2:MsgId>
<ns2:CreDtTm>2026-05-22T05:52:37.493Z</ns2:CreDtTm>
</ns2:GrpHdr>
<ns2:OrgnlGrpInfAndSts>
<ns2:OrgnlMsgId>AAAAAAAA0001234-01</ns2:OrgnlMsgId>
<ns2:OrgnlMsgNmId>pain.001.001.03</ns2:OrgnlMsgNmId>
</ns2:OrgnlGrpInfAndSts>
<ns2:OrgnlPmtInfAndSts>
<ns2:OrgnlPmtInfId>00000001234</ns2:OrgnlPmtInfId>
<ns2:TxInfAndSts>
<ns2:OrgnlEndToEndId>AAAE2EidTEST000001</ns2:OrgnlEndToEndId>
<ns2:TxSts>RVNC</ns2:TxSts>
</ns2:TxInfAndSts>
<ns2:TxInfAndSts>
<ns2:OrgnlEndToEndId>AAAE2EidTEST000002</ns2:OrgnlEndToEndId>
<ns2:TxSts>RVNC</ns2:TxSts>
</ns2:TxInfAndSts>
<ns2:TxInfAndSts>
<ns2:OrgnlEndToEndId>AAAE2EidTEST000003</ns2:OrgnlEndToEndId>
<ns2:TxSts>RVNC</ns2:TxSts>
</ns2:TxInfAndSts>
<ns2:TxInfAndSts>
<ns2:OrgnlEndToEndId>AAAE2EidTEST000004</ns2:OrgnlEndToEndId>
<ns2:TxSts>RVNC</ns2:TxSts>
</ns2:TxInfAndSts>
</ns2:OrgnlPmtInfAndSts>
</ns2:CstmrPmtStsRpt>
</response>
</root>
Headers:
Signature: keyId="40d481aa-***-2f4d67f5c65f", algorithm="rsa-sha256", headers="(request-target) x-nordea-originating-host x-nordea-originating-date", signature="ZUtLW46DL2SJ***gp5sze3Sw"
X-IBM-Client-Id: 40d481aa-***-2f4d67f5c65f
X-Nordea-Originating-Date: Fri, 22 May 2026 05:57:00 GMT
X-Nordea-Originating-Host: api.nordeaopenbanking.com
Agreement-Number: 123456781
Document-Version: pain.001.001.03
Agreement-Type: WS
Vop-Return-Status: mix
X-IBM-Client-Secret: <HiddenValue>
Response
Content
<errorResponse>
<groupHeader>
<messageIdentification>33d2d7bfcbd1c630632324367c116fa0</messageIdentification>
<creationDateTime>2026-05-22T05:59:17.013Z</creationDateTime>
<httpCode>404</httpCode>
</groupHeader>
<response xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="errorPayload">
<request>
<url>/premium/v1/bulk-verification-of-payee/da500fa5d45ef4d176ad294e5f277d13</url>
</request>
<failures>
<code>error.notfound</code>
<description>Entity not found for BatchId da500fa5d45ef4d176ad294e5f277d13 and clientId 40d481aa-***-2f4d67f5c65f</description>
</failures>
</response>
</errorResponse>
A:
You should have used 3e4daf56f78f446abadf5fd2d8daed62 value from:
<ns2:CstmrPmtStsRpt>
<ns2:GrpHdr>
<ns2:MsgId>3e4daf56f78f446abadf5fd2d8daed62</ns2:MsgId>
Q:
Our Web Service channel certificate was automatically updated. After that, we began receiving this error: <code>error.authorization</code><description>Invalid or missing user or access right</description>
response_body": "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?><errorResponse><groupHeader><messageIdentification>37947791613ae7e4</messageIdentification><creationDateTime>2026-05-28T02:38:38.242Z</creationDateTime><httpCode>403</httpCode></groupHeader><response xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"errorPayload\"><request><url>/premium/v1/bulk-verification-of-payee</url></request><failures><code>error.authorization</code><description>Invalid or missing user or access right</description></failures></response></errorResponse>
Should we update it for your service?
A:
You need to update your certificate in our:
Please follow the guide: How to update a premium API certificate via production portal - NEW user guide from 2026-05-27