What is OAuth 2.0 Rich Authorization Requests (RAR / RFC 9396) for complex financial transactions?
❓ Interview Prompt: Explain RFC 9396 Rich Authorization Requests (RAR), authorization_details JSON objects, fine-grained transaction scopes, and Open Banking.
Standard OAuth 2.0 scopes use simple flat strings (e.g. 'scope="read:payments"'). This fails for complex enterprise transactions (such as Open Banking wire transfers) where authorization requires structured constraints (e.g. "Transfer max $5,000 to IBAN DE89... from account 1042"). Rich Authorization Requests (RAR) (RFC 9396) fixes this.
RAR Structure ('authorization_details' JSON Array):
Clients pass a structured JSON array detailing exact transaction parameters during authorization:
'''json
[
{
"type": "payment_initiation",
"actions": ["execute"],
"locations": ["https://api.bank.com/payments"],
"instructedAmount": { "currency": "EUR", "amount": "5000.00" },
"creditorAccount": { "iban": "DE89370400440532013000" }
}
]
'''
Code Implementation Example
{
"authorization_details": [
{
"type": "openid_credential",
"format": "jwt_vc_json",
"credential_definition": {
"type": ["VerifiableCredential", "UniversityDegreeCredential"]
}
}
]
}RAR (RFC 9396) passes structured JSON arrays (authorization_details) for fine-grained, transaction-specific authorization constraints.