generated: '2026-07-20'
method: searched
source: https://consumerdatastandardsaustralia.github.io/standards/#security-profile
docs: https://consumerdatastandardsaustralia.github.io/standards/#security-profile
summary:
  types: [none, oauth2, openIdConnect, mutualTLS]
  public_surface: unauthenticated
  authenticated_surface: cdr-fapi
notes: >-
  The OpenAPI in this repo is the Data Standards Body CDR Banking API. Only the
  Product Reference Data (PRD) endpoints (GET /banking/products and
  GET /banking/products/{productId}) are exposed on Australian Military Bank's
  public host and they require NO authentication. All consumer-data endpoints
  (accounts, balances, transactions, direct debits, scheduled payments, payees)
  are available only to CDR-accredited data recipients over the authenticated,
  FAPI-profiled CDR data-holder flow; the spec documents the required CDR scopes
  as x-scopes extensions (bank:accounts.basic:read, bank:accounts.detail:read,
  bank:transactions:read, bank:regular_payments:read, bank:payees:read) but
  declares no formal OpenAPI securitySchemes.
schemes:
  - name: public-prd
    type: none
    applies_to:
      - listBankingProducts
      - getBankingProductDetail
    description: >-
      Public, unauthenticated Product Reference Data. No API key, token, or
      client certificate is required. Callers MUST send an x-v header to
      negotiate the endpoint version (currently x-v: 3 for products).
  - name: cdr-fapi
    type: oauth2
    scheme: authorization_code
    profile: FAPI 2.0 (AU-CDR)
    token_binding: mutualTLS
    description: >-
      Consumer data sharing uses the CDR security profile: OpenID Connect
      hybrid/authorization-code flow with PAR, mTLS-bound access tokens, and
      the AU adaptations of FAPI. Access is limited to software products
      registered with the CDR Register and accredited by the ACCC/OAIC. Not
      exercisable via this public repo.
    scopes:
      - bank:accounts.basic:read
      - bank:accounts.detail:read
      - bank:transactions:read
      - bank:regular_payments:read
      - bank:payees:read
      - common:customer.basic:read