On-Demand

On-Demand allows partners to check whether a user can be matched against users who have already connected to Open Banking and provided consent for their data to be shared. If a match exists, the partner can request Open Banking data for the user. The data can then be used to support quotes on non-ClearScore marketplaces, during credit application journeys and for customer management activities. It avoids asking the user to complete a new Open Banking connection journey when a valid, consented connection is already available through D•One.

The supported purposes are:

• marketplace_quote
• credit_application
• customer_management

How it works

1. The partner collects the customer's email address and date of birth.
2. The partner hashes the email address using SHA-256. See Hashing Emails for On-Demand for the detailed rules and expected hash examples.
3. The partner sends the hashed email address, date of birth, and purpose to the On-Demand match endpoint.
4. D•One matches the user with users who have consented and connected to Open Banking.
5. If a match is found, D•One grants the partner time-limited access to that user's Open Banking data and returns the D•One user identifier, match status, and access expiry.
6. The partner uses the returned user identifier to retrieve Open Banking data from the D•One data endpoints until the access expiry.

The match request must include a valid x-d1-purpose header. This tells D•One why the partner is requesting access to the user's Open Banking data, important to ensure relevant consent has been collected.

Request data

Partners provide:

• hashedEmail - the SHA-256 hash of the email address
• dateOfBirth - the customer's date of birth in YYYY-MM-DD format
• x-d1-purpose - one of the supported purposes listed above

Match responses

If a match is found, the response includes:

{
  "userId": "5e059a8b-2505-4432-9281-35d0c79c756e",
  "status": "CONNECTED",
  "consentExpiry": "2026-07-02T12:34:56Z"
}

Connection status

When a matching user is found, the response status indicates whether the user's Open Banking connection is currently active or lapsed.

• CONNECTED - the user has an active Open Banking connection.
• LAPSED - the user has previously connected to Open Banking, but the consent has not been renewed by the user. The data that was pulled from the bank historically is available but has not been refreshed beyond the 90-day consent window.

Partners may request access to lapsed user data. D•One configures this as a partner setting. If partners do not have lapsed data configured or the lapsed connection falls outside the agreed period, the API returns a not-found response.

Using the returned user identifier

The partner can then use the returned user identifier to call the permitted Open Banking data endpoints. A successful On-Demand match grants time-limited access to that user's data; partners should use the expiry returned in the response as the source of truth for how long access is available.

No match or validation errors

If no matching user is found, the API returns a not-found response. If the hashed email address, date of birth, or purpose is missing or malformed, the API returns a validation error.

Sandbox test data

The following test data is available for sandbox testing. Partners can use the original email to test their hashing implementation, then use the hashedEmail and dateOfBirth values in the match request.