How is form data collected from borrower shared by BAP to BPP?

[manojcraftsvilla]

The xinput form which is received from BPP, BAP will render that form and collect data from borrower using those form elements and generate a unique submission id to be shared by BAP tp BPP.

How is submitted form data by borrower shared by BAP to BPP? I was expecting a "data" field along with submission id but "data" field is missing in the spec shared

Manoj

[92shreyansh]

The Form submission data directly be transmitted from Borrower to the BPP directly. On submission of this formdata it would respond with a unique submission_id which the BAP will get and they send this submission_id as part of the next api call from BAP to BPP.

Will update the forms to inculde the submission button and action url in the examples to make it more clear.

[manojcraftsvilla]

"On submission of this formdata it would respond with a unique submission_id which the BAP" - Will submission id be shared by BPP to BAP via an on_select API or any callback url shared by BAP since BAP will also need to know a form has been submitted at BPP's end?

[92shreyansh]

In case of text/html form submission id will be part of form submission response in case of application/html it will be available or sent by BPP by on_status api.

status and on_status APIs can be used to query the state of the transaction including last submission and its status

[nemishzalavadiya-pirimid]

Collected form data will be directly sent to Lender from Buyer App, where there will be no signature creation from Buyer App for lender to verify integrity of the received information.

According to last call we discussed there will be hidden formId to identify form <> application connetion. But still that formId does not clarify that received data is coming from buyer app only.

Shouldn't it will create security issue?
please confirm.
@92shreyansh

[92shreyansh]

As of now there is know signing or encryption security enabled on form layer of the protocol and we are rest on HTTPs. However we can evaluate enabling this in the next community call