Accessing the Document Repository
Explains how to browse the Document Repository, how to sign in against the production Trust Framework directory, and who may view an organisation's protected and private documents.
Finding an organisation's documents
The Document Repository lists every production participant in UAE Open Finance — Licensed Financial Institutions and Third-Party Providers.
The directory itself is open: you can search and filter participants without signing in. Selecting an organisation opens its documents page, at which point you are asked to sign in. Once signed in, an organisation's documents appear in up to three groups:
- Public documents — visible to any signed-in participant; for example trade licences and Central Bank licences.
- Protected documents — visible to the owning organisation and to any other organisation it has chosen to share with. The protected tab is hidden if neither applies to you.
- Private documents — visible only to people authorised within that organisation. The private tab is hidden if you do not have access.
Authenticating with the Trust Framework directory
The repository authenticates you against the production UAE Open Finance Trust Framework directory using OpenID Connect.
When you open an organisation's documents page you are redirected to the directory to sign in with your directory account, then returned to the page. You need only an account in the production Trust Framework directory — there is no separate repository login.
A signed-in session lasts approximately one hour, after which you are asked to sign in again.
Who may view protected documents
Protected documents sit between public and private: the owning organisation controls which other organisations may read them.
Who can read them
- The owning organisation's administrators and Active PBCs — the same people who can see its private documents.
- Any member of an organisation the owner has shared with. Unlike private access, this is not limited to privileged roles — once an organisation is granted, all of its members can read the documents.
- Nebras operators, who may view every organisation's documents.
Managing shares
A privileged member of the owning organisation (administrator or Active PBC), or a Nebras operator, manages the share list from the Protected tab — adding or removing organisations at any time. Sharing is granted per whole organisation and covers all of the owner's protected documents. Organisations that have only been granted access cannot themselves change who else can see the documents, and only Nebras may upload them.
Who may view private documents
An organisation's private documents are visible only to people who hold a privileged role for that organisation in the Trust Framework directory.
Qualifying roles
- Organisation administrators of that organisation.
- Holders of the Principal Business Contact (PBC) contact role, where the role is Active.
Access is assessed per organisation: a PBC or organisation administrator role in one organisation only grants access to that organisation's private documents, not those of any other organisation. Nebras operators may view every organisation's documents.
What the document endpoints provide
The repository pages are powered by a small API at docs.nebras-open-finance.com. It may be called directly — for example to script downloads.
Organisation list
A request to https://docs.nebras-open-finance.com/ returns the list of all production organisations as JSON, each with its identifier and links to its public and private documents. This is the same list the directory page shows, and it requires no sign-in.
Public documents
https://docs.nebras-open-finance.com/{id}/public lists the public documents for a single organisation, where {id} is that organisation's identifier from the root list. Appending a file name to the path returns the file itself. Public documents are open.
Protected documents
https://docs.nebras-open-finance.com/{id}/protected lists — and serves — that organisation's protected documents. This endpoint is gated: you must be signed in and either authorised for the organisation (an administrator or PBC), a member of an organisation it has shared with, or a Nebras operator. The owner's share list is managed at https://docs.nebras-open-finance.com/{id}/grants.
Private documents
https://docs.nebras-open-finance.com/{id}/private lists — and serves — that organisation's private documents. This endpoint is gated: you must be signed in and authorised for the organisation (an administrator or PBC, as above), or a Nebras operator. Without access it returns an authentication or permission error rather than the documents.