{
  "group_header": {
        "message_identification": "7ddc011e-6f4a-4e", 
        "creation_date_time": "2021-04-04T07:51:48.205Z", 
        "http_code": 200 
  },
  "refund_payment": {
    ...
  },
  "original_payment": {
    ...
  }
}

https://open.nordea.com/corporate/v2/some/api/endpoint

https://open.nordea.com/corporate/v3/some/api/endpoint

GET: https://open.nordea.com/corporate/payment-refunds/v1/refunds/{id}
X-Nordea-Originating-Host: open.nordea.com
X-Nordea-Originating-Date: Thu, 05 Jun 2019 21:31:40 GMT
Signature: keyId="<clientId>",algorithm="rsa-sha256",
  headers="(request-target) x-nordea-originating-host x-nordea-originating-date", signature="<signature>"

(request-target): get /corporate/payment-refunds/v1/refunds\n
x-nordea-originating-host: open.nordea.com\n
x-nordea-originating-date: Thu, 05 Jun 2019 21:31:40 GMT

POST: https://open.nordea.com/corporate/payment-refunds/v1/refunds
X-Nordea-Originating-Host: open.nordea.com
X-Nordea-Originating-Date: Thu, 05 Jun 2019 21:31:40 GMT
content-type: application/json
digest: <digest>
Signature: keyId="<clientId>",algorithm="rsa-sha256",
  headers="(request-target) x-nordea-originating-host x-nordea-originating-date content-type digest", signature="<signature>"

(request-target): post /corporate/payment-refunds/v1/refunds\n
x-nordea-originating-host: open.nordea.com\n
x-nordea-originating-date: Thu, 05 Jun 2019 21:31:40 GMT\n
content-type: application/json\n
digest: SHA-256=jcC/ttW7JucGTN9hWfqMsFeON6D+vZtQGWJA+W0PL/g=

{%raw%}
import java.util.LinkedHashMap;
import java.util.Map;
public class SignatureNormalizedStringBuilder {
     /**
     * Produces signature normalized string:
     * {@code
     *   "(request-target): post /corporate/payment-refunds/v1/refunds\n" +
     *   "x-nordea-originating-host: open.nordea.com\n" +
     *   "x-nordea-originating-date: Fri, 20 Sep 2019 09:41:25 GMT\n" +
     *   "content-type: application/json\n" +
     *   "digest: SHA-256=jcC/ttW7JucGTN9hWfqMsFeON6D+vZtQGWJA+W0PL/g="
     * }
     * MAKE SURE THAT THE LAST LINE DOESN'T HAVE '\n' CHAR
     */

    public static void main(String[] args) {

        Map<String, String> claims = new LinkedHashMap<>();

        // key should be lower case

        claims.put("(request-target)", "post /corporate/payment-refunds/v1/refunds");

        claims.put("x-nordea-originating-host", "open.nordea.com");

        claims.put("x-nordea-originating-date", "Fri, 20 Sep 2019 09:41:25 GMT");

        claims.put("content-type", "application/json");

        claims.put("digest", "SHA-256=jcC/ttW7JucGTN9hWfqMsFeON6D+vZtQGWJA+W0PL/g=");

        SignatureNormalizedStringBuilder builder = new SignatureNormalizedStringBuilder();
        claims.forEach(builder::append);
        System.out.println("Normalized String: " + builder.normalize());

    }

    private final StringBuilder builder = new StringBuilder();

    SignatureNormalizedStringBuilder append(String key, String value) {

        if (builder.length() > 0) {
            builder.append('\n');
        }
        builder.append(key).append(": ").append(value);
        return this;
    }
 
    String normalize() {
        String normalizedSignature = builder.toString();
        return normalizedSignature;
    }

} {%endraw%} 

{%raw%} 
// Get Forge library
// Download and compile forge lib from https://github.com/digitalbazaar/forge and put it to service managed by you
// Or just copy whole script to Postman Pre-Script section: https://raw.githubusercontent.com/loveiset/RSAForPostman/master/forge.js

// After the Forge library section, add the code below 
// Signature generation section
// Common
function getHeaderValue(headerName) {
    const headerValue = request.headers[headerName];
    if (headerValue === undefined) {
        throw new Error(`Required header: ${headerName} is not defined`);
    }
    //return resolveVariables(headerValue);
    return headerValue;
}
  
function resolveVariables(textWithPossibleVariables) {
    return textWithPossibleVariables.replace  (/{{(\w*)}}/,g, (str, key) => {
        const value = environment[key];
        return value === null ? "" : value;
    });
}
  
// Digest Calculation
function resolveRequestBody() {
    const contentType = getHeaderValue("content-type");
      
    if (contentType === "application/x-www-form-urlencoded") {
        const data = Object.keys(request.data)
            .sort((a, b) => {
                if(a < b) { return -1; }
                if(a > b) { return 1; }
                return 0;
            })
            .map(key => key + "=" + request.data[key])
            .join('&');
        return resolveVariables(data);
    } else if (Object.entries(request.data).length === 0 && request.data.constructor === Object) {
        return "";
    }
  
    //return resolveVariables(request.data.toString());
    return (request.data.toString());
}
  
function calculateDigest() {
    const requestData = resolveRequestBody();
    const sha256digest = CryptoJS.SHA256(requestData);
    const base64sha256 = CryptoJS.enc.Base64.stringify(sha256digest);
    const calculatedDigest = 'sha-256=' + base64sha256;
    pm.environment.set("Digest", calculatedDigest);
    return calculatedDigest;
}
  
// Signature Calculation  
const sdk = require("postman-collection");
const moment = require("moment");
  
const requestWithoutContentHeaders = "(request-target) x-nordea-originating-host x-nordea-originating-date";
const requestWithContentHeaders = "(request-target) x-nordea-originating-host x-nordea-originating-date content-type digest";
  
function getSignatureBaseOnRequest() {
    const url = new sdk.Url(request.url);
    const host = url.getHost().toLowerCase();
    const path = url.getPathWithQuery().toLowerCase();
    const method = request.method.toLowerCase();
    const date = moment().utc().format("ddd, DD MMM YYYY HH:mm:ss") + " GMT";
  
    let headers = requestWithoutContentHeaders;
  
    let normalizedString =
        `(request-target): ${method} ${path}\n` +
        `x-nordea-originating-host: ${host}\n` +
        `x-nordea-originating-date: ${date}`;
  
    if (method === "post" || method === "put" || method === "patch") {
        const contentType = getHeaderValue("content-type");
        const digest = calculateDigest();
        normalizedString += `\ncontent-type: ${contentType}\ndigest: ${digest}`
  
        headers = requestWithContentHeaders;
    }
    return {host, path, method, date, headers, normalizedString};
}


function encryptSignature(normalizedSignatureString) {
    const messageDigest = forge.md.sha256.create();
    messageDigest.update(normalizedSignatureString,"utf-8");
    return forge.util.encode64(getPrivateKey().sign(messageDigest));           
}
  
function getPrivateKey() {
    let eidasPrivateKey = pm.environment.get("eidasPrivateKey");
     
    if (!eidasPrivateKey.includes('PRIVATE KEY')) {
        eidasPrivateKey = "-----BEGIN RSA PRIVATE KEY-----\n" + eidasPrivateKey + "\n" + "-----END RSA PRIVATE KEY-----";
    }
    return forge.pki.privateKeyFromPem(eidasPrivateKey);
}
const clientId = getHeaderValue("x-ibm-client-id");
const signature = getSignatureBaseOnRequest();
const encryptedSignature = encryptSignature(signature.normalizedString);
const signatureHeader = `keyId="${clientId}",algorithm="rsa-sha256",headers="${signature.headers}",signature="${encryptedSignature}"`;
  
pm.environment.set("Signature", signatureHeader);
pm.environment.set("X-Nordea-Originating-Host", signature.host);
pm.environment.set("X-Nordea-Originating-Date", signature.date);
{%endraw%} 

MIIG5AIBAAKCAYEAyQYYtwon+ZOF9hRyWPFJZbKu9C4AbX46TSmsUcLon7x7pMx9
H3jk8mwIcQNFszx4Mx8m3iw83zpM4DmQpvprdP8+Le0sSB8d6k8X1gF4KTv1G9SN
b7+Qf33jOToMUDy0t3LkypkoMupMmBStkVnV6mGDj6S+cIozLlBsSoKzXtnJhvAN
Li+zAMWMr1OkOw5PUhwPu9HyhN8YnuPvWBvXEhb08tMoYpvRCgP62IIA7qjpc8Xf
NIDHJC2wjLIyhgjzEl4tAOEEOSz712cKCsnxOnICioRK0ceN9SS40bWqxbWXvMGj
rG08Ep35q2E0zVZ4S0yar0THhS/cY+RZnrEmoG3trp3g6g7lyRf3BqN4t0QiY+fs
syi0h+eBkZQl4Hx8QZev5AsRX/A73Px9R88kVVHNxs/FQI9kWP08/+7PGxBkOfM+
VxxAt4wiWTP/ZngPYRlWlAV3yIhxVtIh36Ngm2Vb1QLcDKYeuqTZasBsed5OIJA+
RcjpR54VS8Uk76HFAgMBAAECggGAFq+dcmqvADdp0s+T5/2y7ssve1cFrVWldrfR
Ppjkb8JxobOCG18lV0Zh3X8lCok0d3B4jnInnHmT22ojrPRt1BJKDhzJ9omscpji
c8BOsziU/MMMAyR3RiwKzJaEdTmkm19X+pU2OCjA5BjRTan5vi2rDzbkVwcBp6Rj
1DTT0Ux6tcO5eRDg/qFMsyyZSCDhSr7n96ZF3EDhIm1OwX7C0sPMeOrjj91NxfeV
A4IIYOanEe2uttohny+Y0Qf7M60mrhLJJdzAeFHFkE7NhR2nEgYInNbWhPmNtLEg
8kD3xqNtgyy7knVIbE8Nn5KRnjbPoCQjn079hk4WVhXM8LfgGWGXtHQ31/9+AJgZ
Oa0lN4UYqYcy0qn7HdNTjXH2gQruEJjDXYyTvI9ymiNkREAg1yOJfPC5xl9tETzT
6MBEEEU/0FiOFP8MMZGFH5Hmi9YKNp1Om4b4XISGzJVUUCReBSHy0RjtC6OVa+kZ
MYb7f8O8quzBVIsKKCA8gcon4yCBAoHBAO7Vutrhk8z0pyU83tC2eQcy1v6CAAiC
WdUdoWCIE44eq51KOBHqLCmT9/r2pPh0R2Vkkx/lPo1yqFkDTdzpbmIXgZDP0q6E
T6Fp9wOaaUgoIhnzzNtb4dzWue2yuE2f/yCnXuT3p4rAphGBvJwyPqDHCb7q6qg0
moH3bQWkrPzd5rDMA/Gv12zLzJ1zejrxTyrZvzvGZPPtSa1V2oReXC9CaMXbSK+b
++HAut1XiTTjsfzmMnr2ZCfuXOUuZ6mjGQKBwQDXeLBuEPElq3Vv+K2Dn5Pm67ri
j6zRTE92DCha0iQtGDuBRnOF/cU6my1ZdgMi0V/etwZ4twI1Ocn7Oqis++NlvPqD
khhVCivR54iaj0KADx5hftek9b5Sgmb5HYS60xrX4EHTMCrME4IUYBYbvw62d6Mz
bhsB0H44tIAsisNCSb9iX6ILQFeMdQ/G3LD/5LCLRni3uXhVnR3ukbU8yU3ALcAk
NVjHNiCmRLiyyTc3KPoOkfJFnhdb+BwEVVTV1Y0CgcEAqhqVtBFX6HETnuUEuVhN
SQA/uhMzHNxiSPSKnKsualmT1zomRzQm8hIOW7NRehevRhrk4qGu9KWGG6fLzByB
3uFpCY/LOTrJUGidYvaWJ6tV5nALJu0BJ/3TfOV+eOMMneA3KRLuRFfDr9JcWE88
5dv9J/o+2UBmD0z/XDaWcp9FEASuhnO8FiPs/vNhShvWS+m8V0GNY2JMyGTOdtqS
A6Lj5o+w7EpHktlm/gC7m2zUtw/pQkS8vuf5R83OTTb5AoHBAJzi7WNWxp6s9vcu
U/hwappKrWplPmmubHUBaSintVt4N2trRpYbLk37ystGmAXz+SAKl5WxetQSXbSl
A0fgp7PeI3FFIJ5ap4lQUjBnev4PBAns90rO+2LMO/nKumflabghOwxwF9k7owz+
4VoWhLnq5lN+Kf/qNN1I38KOzpknZUhVZYFXuec1HOWort/DPaBLEX6Eds+vdKnO
Qe4ejJQPO8WhaiCykpc9llXnGGL7XQba0VJLR6rZPl0RXJHNyQKBwE5tozFL24oP
Dy2qOWXbX3thNe3nHtI2wQQM0Bvj6r1uCGS4TN5qH/T9SNi/OWfzq5RWoocZckQo
2uroBa7CCH7B2xvoItfV90wwFUXX79jlOSWYiCnpgOmybzGbcbTicStHxv0WVIXr
3zK36PEA2gFOoKT9C21ZzW9BvQbYQviw1FR2AKKuKxhT5WvvpF25UiAdHhIYsOmQ
DQIj5eKbT8Q2SWo7sEkeOeFtGFj6oslahYwi5G2Bs4kv+8cobS0ScA==

<dependency>
    <groupId>org.tomitribe</groupId>
    <artifactId>tomitribe-http-signatures</artifactId>
    <version>1.0</version>
</dependency>

{%raw%} 
package com.nordea.openbanking.sandbox.security;

import lombok.SneakyThrows;
import lombok.var;
import org.springframework.stereotype.Component;
import org.tomitribe.auth.signatures.Signature;
import org.tomitribe.auth.signatures.Signer;

import java.security.Key;
import java.security.KeyStore;
import java.util.LinkedHashMap;
import java.util.Map;

@Component
public class TestSignatureGenerator {

    private static final String DIGEST = "Digest";
    private static final String CONTENT_TYPE = "Content-Type";
    private static final String X_ORIGINATING_DATE = "X-Nordea-Originating-Date";
    private static final String X_ORIGINATING_HOST = "X-Nordea-Originating-Host";
    private static final String REQUEST_TARGET_INDICATOR = "(request-target)";
    private static final String VALID_GET_HEADERS = "(request-target) x-nordea-originating-host x-nordea-originating-date";
    private static final String VALID_INSERT_HEADERS = "(request-target) x-nordea-originating-host x-nordea-originating-date content-type digest";


    private static final char[] KEY_STORE_PASSWORD = "1111".toCharArray();
    //Set your .p12 key store file location here, after you will download it from the portal.
    private static final String TEST_KEY_STORE_FILE_NAME_PATH = "certificate/rapi-sandbox-certificate.p12";
    private static final String TEST_KEY_ALIAS = "1";

    public static String calculateTestSignature(String method, String uri, Map<String, String> headers) {
        return getTestSignature(method, uri, headers).getSignature();
    }

    @SneakyThrows
    private static Signature getTestSignature(String method, String uri, Map<String, String> headers) {
        var signature = new Signature(
                "clientId",
                "rsa-sha256",
                null,
                method.equalsIgnoreCase("GET") ? VALID_GET_HEADERS.split(" ") : VALID_INSERT_HEADERS.split(" ")
        );
        var signer = new Signer(getTestKey(), signature);
        return signer.sign(method, uri, headers);
    }

    @SneakyThrows
    private static Key getTestKey() {
        var keystore = KeyStore.getInstance("PKCS12");
        keystore.load(
                SignatureTestUtil.class.getClassLoader().getResourceAsStream(TEST_KEY_STORE_FILE_NAME_PATH),
                KEY_STORE_PASSWORD
        );
        return keystore.getKey(TEST_KEY_ALIAS, KEY_STORE_PASSWORD);
    }

    public static Map<String, String> getValidHeadersForGet(String host, String date) {
        var requestHeaders = new LinkedHashMap<String, String>();
        requestHeaders.put(REQUEST_TARGET_INDICATOR, null);
        requestHeaders.put(X_ORIGINATING_HOST.toLowerCase(), host);
        requestHeaders.put(X_ORIGINATING_DATE.toLowerCase(), date);
        return requestHeaders;
    }

    public static Map<String, String> getValidHeadersForPost(String host, String date, String contentType, String digest) {
        var requestHeaders = new LinkedHashMap<String, String>();
        requestHeaders.put(REQUEST_TARGET_INDICATOR, null);
        requestHeaders.put(X_ORIGINATING_HOST.toLowerCase(), host);
        requestHeaders.put(X_ORIGINATING_DATE.toLowerCase(), date);
        requestHeaders.put(CONTENT_TYPE.toLowerCase(), contentType);
        requestHeaders.put(DIGEST.toLowerCase(), digest);
        return requestHeaders;
    }

    //Note: In this file is used the lombok plugin.
    //https://mvnrepository.com/artifact/org.projectlombok/lombok-maven-plugin
    //With the following methods, you can generate the POST/GET request signatures.
    /*public static void main(String[] args) {

        var algorithm = "algorithm=\"rsa-sha256\"";
        var keyId = "keyId=\"73f713c8-2a4e-4b40-aded-7442870b68d8\"";

        //Generating of the Signature for Insert data requests (POST,PUT,PATCH).
        var postHeaders = "headers=\"(request-target) x-nordea-originating-host x-nordea-originating-date content-type digest\"";
        var requestPostHeaders = getValidHeadersForPost("api.nordeaopenbanking.com", "Wed, 24 Apr 2019 14:00:37 GMT","application/json","SHA-256=mmbe/mYuzO+LGeL92Nvc4tFu+aSP/NFE8oJoBj8oLOI=");
        var validPostSignature = calculateTestSignature("POST", "/corporate/payment-refunds/v1/refunds", requestPostHeaders);
        var signaturePostHeaderReady = keyId.concat(",").concat(algorithm).concat(",").concat(postHeaders).concat(",").concat("signature=").concat("\"").concat(validPostSignature).concat("\"");
        System.out.println(signaturePostHeaderReady);

        //Generating of the Signature for Non-insert data requests (GET).
        var getHeaders = "headers=\"(request-target) x-nordea-originating-host x-nordea-originating-date\"";
        var requestGetHeaders = getValidHeadersForGet("api.nordeaopenbanking.com", "Wed, 24 Apr 2019 14:00:37 GMT");
        //Note: The id, at the end of the corporate/payment... URL, should match the id, in the testing URL in the Postman/other testing tool).
        var validGetSignature = calculateTestSignature("GET", "/corporate/payment-refunds/v1/refunds/8840410a-297b-4058-a2d0-8d761d6709", requestGetHeaders);
        var signatureGetHeaderReady = keyId.concat(",").concat(algorithm).concat(",").concat(getHeaders).concat(",").concat("signature=").concat("\"").concat(validGetSignature).concat("\"");
        System.out.println(signatureGetHeaderReady);
    }*/
} {%endraw%}