Control tower for defining access permissions based on data type
Systems, methods, and apparatuses for providing a central location to manage permissions provided to third-parties and devices to access and use user data and to manage accounts at multiple entities. A central portal may allow a user to manage all access to account data and personal information as well as usability and functionality of accounts. The user need not log into multiple third-party systems or customer devices to manage previously provided access to the information, provision new access to the information, and to manage financial or other accounts. A user is able to have user data and third-party accounts of the user deleted from devices, applications, and third-party systems via a central portal. The user is able to impose restrictions on how user data is used by devices, applications, and third-party systems, and control such features as recurring payments and use of rewards, via a central portal.
1. A security system of a first entity, the security system comprising one or more hardware processors configured to:
serve, to a user device, an internet portal comprising an interactive graphical user interface (GUI) granting security control over account access permissions for client applications, wherein the internet portal is used as an access control portal provided for controlling account access by a service provider computing system of a second entity;
accept, via the internet portal, a login credential and verify that the login credential grants access to the internet portal;
present, by the first entity in the GUI of the internet portal, in response to verifying that the login credential grants access to the internet portal, an account listing comprising a financial account linked with one or more client applications which communicate, when executed on the user device, with the service provider computing system of the second entity;
detect, via the account listing in the GUI of the internet portal, selection of the financial account comprising financial and nonfinancial account data;
present, by the first entity in the GUI of the internet portal, an access permissions listing comprising one or more security settings attributable to a client application of the linked one or more client applications as a service provider client application running on the user device;
detect, by the first entity via the access permissions listing in the GUI of the internet portal, selection of a first set of one or more security settings corresponding to one or more data types or functionalities associated with the client application;
generate, by the first entity in response to the selection of the first set of security settings, an access token corresponding to the first set of security settings attributed to the client application and transmit the access token to the service provider computing system of the second entity indicating limited access, by the client application, to a first subset of the financial and nonfinancial data of the financial account;
receive, from the service provider computing system of the second entity, a first application programming interface (API) call comprising the access token generated by the first entity and a first account request associated with the client application;
authenticate by the first entity the access token received and sent by the second entity and verify that the first API call complies with the first set of security settings attributed to the client application;
in response to authenticating the received access token sent by the second entity and verifying that the first account request complies with the first set of security settings, grant the first account request to the client application;
present, in the GUI of the internet portal, the access permissions listing comprising the one or more security settings attributable to the client application;
detect, via the access permissions listing in the GUI of the internet portal, selection of a different second set of one or more security settings corresponding to the one or more data types or functionalities associated with the client application;
receive by the first entity, from the service provider computing system of the second entity, a different second API call comprising the access token generated by the first entity and a second account request for the client application;
determine by the first entity that the second API call does not comply with the second set of security settings attributed to the client application; and
in response to determining by the first entity that the second API call does not comply with the second set of security settings, decline the second account request.
2. The system of claim 1 , wherein the one or more processors are configured to verify that the first API call complies with the first set of security settings attributed to the client application by determining that the first request is for a data type or a functionality granted to the client application through the first set of security settings.
3. The system of claim 1 , wherein the one or more processors are configured to determine that the second API call does not comply with the second set of security settings attributed to the client application by determining that the second request is for a data type or a functionality not granted to the client application through the second set of security settings.
4. The system of claim 1 , wherein the access control listing presented by the one or more processors comprises an access control corresponding to financial transactions involving the financial account.
5. The system of claim 4 , wherein the access control listing presented by the one or more processors comprises an access control corresponding to accessing information on financial transactions involving the financial account.
6. The system of claim 1 , wherein the first set of security settings defines one or more data types in the account data that are accessible to the client application.
7. The system of claim 1 , wherein the access control listing presented by the one or more processors comprises an access control corresponding to access to nonfinancial account data.
8. The system of claim 1 , wherein the access control listing presented by the one or more processors corresponds to financial transactions involving the financial account.
9. The system of claim 1 , wherein the second set of security settings revokes one or more access permissions granted in the first set of security settings.
10. The system of claim 1 , wherein the second set of security settings revokes all access permissions granted by the first set of security settings.
11. The system of claim 1 , wherein the second set of security settings adds one or more access permissions not granted in the first set of security settings.
12. The system of claim 1 , wherein the one or more processors are configured to, in response to detecting selection of the second set of security settings, deactivate the access token.
13. The system of claim 1 , wherein the one or more processors are configured to, in response to detecting selection of the second set of security settings:
generate a second access token corresponding to the second set of security settings attributed to the client application; and
transmit the second access token to the service provider computing system for limited access, by the client application, to a second subset of the financial and nonfinancial data of the financial account.
14. A method implemented by a security system of a first entity, the security system comprising one or more hardware processors, the method comprising:
serving, to a user device, by the one or more processors, an internet portal comprising an interactive GUI granting security control over account access permissions for client applications, wherein the internet portal is used as an access control portal provided for controlling account access by a service provider computing system of a second entity;
accepting, via the internet portal, by the one or more processors, a login credential and verify that the login credential grants access to the internet portal;
presenting, by the first entity in the GUI of the internet portal, by the one or more processors, in response to verifying that the login credential grants access to the internet portal, an account listing comprising a financial account linked with one or more client applications which communicate, when executed on the user device, with the service provider computing system of the second entity;
detecting, via the account listing in the GUI of the internet portal, by the one or more processors, selection of the financial account comprising financial and nonfinancial account data;
presenting, by the first entity in the GUI of the internet portal, by the one or more processors, an access permissions listing comprising one or more security settings attributable to a client application of the linked one or more client applications as a service provider client application running on the user device;
detecting, by the first entity via the access permissions listing in the GUI of the internet portal, by the one or more hardware processors, selection of a first set of one or more security settings corresponding to one or more data types or functionalities associated with the client application;
generating, by the first entity in response to the selection of the first set of security settings, by the one or more processors, an access token corresponding to the first set of security settings attributed to the client application and transmit the access token to the service provider computing system of the second entity indicating limited access, by the client application, to a first subset of the financial and nonfinancial data of the financial account;
receiving, from the service provider computing system, by the one or more processors, a first API call comprising the access token and a first account request for the client application;
authenticating, by the one or more hardware processors of the first entity, the access token received and sent by the second entity and verifying, by the one or more processors, that the first API call complies with the first set of security settings attributed to the client application;
in response to authenticating the received access token sent by the second entity and verifying that the first account request complies with the first set of security settings, granting, by the one or more processors, the first account request to the client application;
presenting, in the GUI of the internet portal, by the one or more processors, the access permissions listing comprising the one or more security settings attributable to the client application;
detecting, via the access permissions listing in the GUI of the internet portal, by the one or more processors, selection of a different second set of one or more security settings corresponding to the one or more data types or functionalities associated with the client application;
receiving, from the service provider computing system, by the one or more hardware processors of the first entity, a second API call comprising the access token generated by the first entity and a second account request for the client application;
determining, by the one or more hardware processors, that the second API call does not comply with the second set of security settings attributed to the client application; and
in response to determining by the first entity that the second API call does not comply with the second set of security settings, decline the second account request.
15. The method of claim 14 , wherein verifying that the first API call complies with the first set of security settings attributed to the client application comprises determining, by the one or more processors, that the first request is for a data type or a functionality granted to the client application through the first set of security settings.
16. The method of claim 14 , wherein determining that the second API call does not comply with the second set of security settings attributed to the client application comprises determining, by the one or more processors, that the second request is for a data type or a functionality not granted to the client application through the second set of security settings.
17. The method of claim 14 , wherein the access control listing comprises an access control corresponding to financial transactions involving the financial account.
18. The method of claim 14 , wherein the first set of security settings defines one or more data types in the account data that are accessible to the client application.
19. The method of claim 14 , wherein the second set of security settings revokes one or more access permissions granted in the first set of security settings, or adds one or more access permissions not granted through the first set of security settings.
20. The method of claim 14 , further comprising, in response to detecting selection of the second set of security settings, performing at least one of:
deactivating, by the one or more processors, the access token; or
generating, by the one or more processors, a second access token corresponding to the second set of security settings attributed to the client application, and transmitting the second access token to the service provider computing system for limited access, by the client application, to a second subset of the financial and nonfinancial data of the financial account.