Skip to content

TPP Validation. The gatekeeper between your regulated APIs and the world.

$

0

EU/EEA jurisdictions

0ms

Median end-to-end

0ms

Added latency on push

0

Operating since

Who has to say yes

One product. Three reasons to buy it.

Open banking access control is not an engineering ticket. It is a procurement decision, a compliance obligation, and an integration job — at the same time. The page is written for all three.

A single vendor, a single Azure invoice, thirty jurisdictions.

  • Procure through your existing Microsoft Enterprise Agreement — no new vendor onboarding circus.
  • One integration replaces country-by-country registry connectors and QTSP lookups.
  • SaaS, Marketplace, or source license for air-gapped / on-prem estates.
  • Explorer is free. Production is consumption-priced. Institution is a proper MSA.
Talk to us about a private offer

Signed, timestamped, hash-chained — traceable to TSL, OCSP and the NCA.

  • A valid eIDAS certificate does not prove the license is still active. We check both, every time.
  • Article 32(3) SCA-RTS: no obstacles to legitimate TPPs. Push adds zero latency at the gate.
  • Cryptographically signed results with provenance. Hand the trail to the supervisor, not a screenshot pack.
  • PSD3 and PSR schemas are already parameterized. Flip a header — do not open a programme.
Request a technical briefing

POST /v5. Deterministic 200 or 422. Then we call you when anything changes.

  • Pull on first handshake, push thereafter. HMAC-signed webhooks, idempotent, retryable.
  • TLS 1.3, mTLS, P95 under 78ms, zero-cache policy against live-refreshed trust anchors.
  • CLI in one line. MCP for agents. Slack and Teams for the ops channel.
  • No per-jurisdiction code paths. Swap the country header, keep the same client.
Read the integration shape

The problem

Two ways to fail. Caching is both of them.

Deny a legitimate TPP and you obstruct access — a commercial loss and a regulatory one under Article 32(3). Admit a revoked certificate and you have accepted an unauthorized party onto a regulated API. Pull-based checks force the choice: add latency, or cache trust and serve the stale.

A

Obstruct the legitimate

Live lookups on every request add milliseconds the TPP — and the supervisor — will notice. Slow gates are obstacles.

B

Admit the revoked

A certificate issued 18 months ago does not prove standing today. Cached trust is how revoked QWACs reach production.

Push is the third option.

We call you the instant a certificate or license changes state. The verdict already lives in your system when the request arrives. Zero extra latency for valid holders. A closed gate for the rest. Non-obstructive, by design.

How a verdict is made

Four passes. One signed result.

Forward a QWAC or QSealC. We return status, authorizations and grounds — cryptographically signed, with hash-chained provenance.

Event-driven

Don’t call us. We’ll call you.

Most customers run both: pull on first handshake, push thereafter. We reconcile the two into one audit trail.

Add a webhook URL. We POST when anything changes.

  • Zero delay added at request time
  • cert.revoked · expired · role.changed · passport.lost · license.withdrawn
  • HMAC-signed with a rotating key
  • Idempotent and retryable

Incoming to your webhook

Push

cert.status_changed

NL

Plejd Demo, B.V.

certificateRevoked · valid → invalid

—

cert.status_changed

DE

Plejd Demo, B.V.

certificateExpired · valid → invalid

—

role.changed

FR

PSDFR-ACPR-16828

AISP withdrawn

—

passport.lost

FI

TPP-FI-2041

passporting ended

—

Illustration — the bank is told the moment standing changes.

The rulebook

Built for what is. Ready for what comes.

The same service engine, parameterized per regime. Swap the version header — do not wait for a vendor roadmap.

AISP, PISP and CBPII across 30 EU/EEA jurisdictions. Article 34 attributes checked against live EBA and national registers on every request.

  • The regulation

    Identify the TPP as AISP, PISP or CBPII before any AIS/PIS call reaches the gateway.

    What this service does

    We read roles off the QWAC and return them as X-TPP-Entity / passports — before the request hits your gateway.

  • The regulation

    Article 34: confirm authorization against the home NCA and the live EBA register — not a nightly copy.

    What this service does

    Every POST /v5 hits live EBA and national registers. Cached copies are refused by design.

  • The regulation

    Honor passporting: a TPP authorized in one member state must not be blocked in another.

    What this service does

    One signed verdict maps DE, FR, NL… so the host ASPSP does not re-check 29 countries.

  • The regulation

    Do not create an obstacle for a legitimate TPP. A delayed or cached check is still an obstacle.

    What this service does

    78ms median. Push when standing changes — 0 ms added on the request path.

  • The regulation

    Verify the eIDAS QWAC presented on the connection, not just the license number in a header.

    What this service does

    We validate the certificate against LOTL / QTSP. A string in a header is not a check.

How you buy it

SaaS. Marketplace. Source.

Choose the control plane that matches the estate. The verdict engine is the same.

Hosted by us

SaaS

Multi-cloud, managed latency, uptime, updates and support. Start on Explorer, promote to Production when the gateway is ready.

Start a trial

Transactable on Azure

Marketplace

Procure and subscribe through Microsoft Marketplace. Bill against the existing Azure enterprise agreement. Slack and Teams included.

Open Azure offer

Run it yourselves

Source

Buy the source, run it behind your own gateway. Air-gapped environments, full code-audit rights, optional maintenance contract.

Inquire about licensing

For the integration team

Machine-readable. Agent-callable. In the channel.

The same command core, exposed three ways. Engineers keep the API. Ops keep Slack and Teams. Agents get MCP.

INSTALL node 18+

Replay →
curl -fsSL https://tppvalidation.com/cli/install.sh | bash
tppv
tppv validate qwac.pem

Install pagetpp-cli.ziptpp-cli.tar.gz

REST /v5

api.tppvalidation.com/v5

One POST for all jurisdictions. Raw PEM or JSON. Country via query. Deterministic 200 / 422.

CLI

tppv validate file.pem

One-line install, Node 18+. Interactive trial signup or non-interactive validation against production.

MCP

ai.tppvalidation.com/mcp

Native tools for Claude, Cursor and Copilot agents: validate_certificate, audit_chain, search_entity.

Teams & Slack

/tppvalidate

Validate a certificate in the ops channel. Adaptive Cards, OAuth, revocation alerts without leaving the room.

CLI install notes

Commercials

Evaluate for free. Automate when you are ready.

Explorer is the real product, rate-limited. Production is unlimited and signed. Institution is the MSA.

Explorer

Free

Rate-limited · all jurisdictions

  • Certificate types and web UI
  • Sandbox and documentation
  • Basic speed, all 30 markets
  • Enough to take to architecture review
Validate a certificate

Production

€5 / hour

× 24 × 30, or annual with discount

  • Unlimited access
  • Signed events and audit endpoint
  • 99.99% SLA · P95 < 78ms
  • Agentic ready · monthly or annual
Request a trial

Institution

Custom

MSA, DPA, private VPC or source

  • Everything in Production
  • On-prem / private VPC / source code
  • Custom audit, 24/7 support
  • Zero-data options
Request a briefing

Next step

Request a trial or a technical briefing.

Tell us which seat you sit in. We reply from Stockholm within one business day.