generated: '2026-07-20'
method: searched
source: https://www.bankofus.com.au/open-banking
docs: https://consumerdatastandardsaustralia.github.io/standards/#security-profile
note: >-
  The harvested OpenAPI (openapi/bank-of-us-cds-banking-products-openapi.yml) is
  the shared DSB Consumer Data Standards banking contract and declares no in-spec
  securitySchemes (authorization is defined by the CDR Security Profile, an
  FAPI-based OAuth2/OIDC regime enforced outside the OpenAPI document). This profile
  is derived from the CDR regime + the confirmed live behaviour of Bank of us's
  public Product Reference Data endpoint.
summary:
  types:
  - none
  - oauth2
  - openIdConnect
  - mutualTLS
  public_prd_auth: none
  consumer_data_auth: CDR FAPI 2.0 profile (OAuth2 authorization code + PAR + PKCE, OIDC, MTLS-bound tokens)
schemes:
- name: ProductReferenceData
  type: none
  description: >-
    The Product Reference Data (PRD) endpoints (GET /banking/products,
    GET /banking/products/{productId}) are public and unauthenticated. Access is
    governed only by API version negotiation via the mandatory x-v request header
    (Bank of us currently serves x-v 4 for the product list). No token, key, or
    consent is required. Confirmed live: HTTP 200 at
    https://api.bankofus.com.au/OpenBanking/cds-au/v1/banking/products.
  applies_to:
  - listBankingProducts
  - getBankingProductDetail
- name: CDR-OAuth2
  type: oauth2
  description: >-
    Consumer-data endpoints (accounts, balances, transactions, direct debits,
    scheduled/regular payments, payees) require the CDR consent + authorization
    flow: OAuth2 authorization code with Pushed Authorization Requests (PAR) and
    PKCE, per the CDR Security Profile (FAPI-based). Consent is brokered through
    Bank of us Internet Banking identity verification and a one-time password; not
    exposed for unauthenticated harvest and requires an Accredited Data Recipient (ADR).
  flows:
  - authorizationCode
- name: CDR-OIDC
  type: openIdConnect
  description: >-
    OpenID Connect underpins consumer consent and ID token issuance under the CDR
    Security Profile. The data holder's OIDC discovery document is published on the
    ADR-facing infosec baseline endpoint (not on the public PRD host; the public
    /.well-known/openid-configuration returned 403/404 on 2026-07-20).
- name: CDR-MTLS
  type: mutualTLS
  description: >-
    Consumer-data (holder) endpoints are served over mutual TLS with
    sender-constrained (MTLS-bound) access tokens per the CDR Security Profile.