generated: '2026-07-26' method: searched source: >- https://developer.corelogic.asia/guides/api-authentication (guide text compiled into the portal bundle main.aefa4bad.js), https://auth.corelogic.asia/.well-known/openid-configuration, collections/corelogic-au-sample-sandbox.postman_collection.json, collections/corelogic-au-rp-inside-auth-example.postman_collection.json docs: https://developer.corelogic.asia/guides/api-authentication summary: types: [oauth2, openIdConnect, http] api_key_in: [] oauth2_flows: [clientCredentials, authorizationCode, refreshToken] transport: HTTPS only, TLSv1.2 minimum token_format: JWT authorization_model: >- Claim-based, not scope-based. The client_credentials tokens the vendor publishes in its own sample collection carry scope "openid" only; entitlement is carried in JWT claims (roles, geo_codes, authorities) provisioned against the commercial licence, so there is no data-product scope surface to request. verbatim: - >- "Our APIs use the OAuth 2.0 protocol to enable applications to request our client credential token using Client ID and Client Secret." - >- "The Access Token response is a JSON Web Token (JWT) and may be decoded to obtain expiry time (a Unix epoch timestamp) so that you know when to refresh the access token. Each grant_type token expiry is subject to change without notice." - '"All API requests must be made over HTTPS, with TLSv1.2 minimum."' - '"API requests without a valid Authorization header will fail."' - '"OAuth2 supported grant types: client_credentials, authorization_code, refresh_token."' schemes: - name: CotalityOAuth2ClientCredentials type: oauth2 flow: clientCredentials client_authentication: HTTP Basic — base64(client_id:client_secret) in the Authorization header token_urls: - https://access.api.cotality.com.au/as/token.oauth2 - https://access.api.cotality.com.au/oauth/token sandbox_token_url: https://api-sbox.corelogic.asia/access/as/token.oauth2 legacy_token_url: https://api.corelogic.asia/access/oauth/token uat_token_url: https://access.api-uat.cotality.com.au token_format: JWT scopes_requested: [openid] applies_to: every Cotality Australia / New Zealand data API sources: - collections/corelogic-au-sample-sandbox.postman_collection.json - https://developer.corelogic.asia/guides/api-authentication - name: CotalityOAuth2AuthorizationCode type: oauth2 flow: authorizationCode purpose: >- RP.Inside silent login / deep linking — obtains a USER token so an integrating platform can redirect a subscriber into RP Data or Property Guru without a second login. The portal is explicit that this is "not an authentication method for APIs. It is designed for user-level access and redirection, not for backend API integration." endpoints: authorize: https://access-uat-api.corelogic.asia/access/oauth/authorize login: https://access-uat-api.corelogic.asia/access/login token: https://access-uat-api.corelogic.asia/access/oauth/token userinfo: https://access-uat-api.corelogic.asia/access/userinfo logout: https://access-uat-api.corelogic.asia/access/logout sources: - collections/corelogic-au-rp-inside-auth-example.postman_collection.json - https://developer.corelogic.asia/guides/application-silent-login - name: CotalityOAuth2RefreshToken type: oauth2 flow: refreshToken note: >- The portal recommends securely caching the token and refreshing prior to expiry, decoding the JWT exp claim rather than assuming a fixed lifetime. sources: [https://developer.corelogic.asia/guides/api-authentication] - name: CotalityDeveloperPortalOIDC type: openIdConnect openIdConnectUrl: https://auth.corelogic.asia/.well-known/openid-configuration issuer: https://auth.corelogic.asia vendor: PingFederate (Ping Identity) purpose: >- Human login to the Cotality Developer Portal — NOT the data-API auth path. Scopes here are portal identity scopes only. endpoints: authorization: https://auth.corelogic.asia/as/authorization.oauth2 token: https://auth.corelogic.asia/as/token.oauth2 userinfo: https://auth.corelogic.asia/idp/userinfo.openid jwks: https://auth.corelogic.asia/pf/JWKS registration: https://auth.corelogic.asia/as/clients.oauth2 revocation: https://auth.corelogic.asia/as/revoke_token.oauth2 introspection: https://auth.corelogic.asia/as/introspect.oauth2 end_session: https://auth.corelogic.asia/idp/init_logout.openid device_authorization: https://auth.corelogic.asia/as/device_authz.oauth2 backchannel_authentication: https://auth.corelogic.asia/as/bc-auth.ciba pkce_methods: [plain, S256] token_endpoint_auth_methods: - client_secret_basic - client_secret_post - client_secret_jwt - private_key_jwt - tls_client_auth - none claims_supported: - email - family_name - fax_number - given_name - mobile_number - personal_email - phone_number - sub - title - user_roles - username sources: [well-known/corelogic-au-openid-configuration.json] - name: SSO (SAML) type: saml2 purpose: >- Application single sign-on for Cotality end-user products. The portal states plainly: "SSO is not an authentication method for APIs. It is intended for user login flows and session management." Not all applications support it yet. sources: [https://developer.corelogic.asia/guides/application-silent-login] credential_lifecycle: self_serve_sandbox_client: https://developer.corelogic.asia/apps/create rotate_secret: Portal "Reset Client Secret" action on the sandbox client revoke_client: Portal "Remove Client" action support: api.support@corelogic.com production_credentials: >- Not self-serve. Production and UAT credentials are provisioned only after a Cotality commercial data licence is signed; the portal FAQ says an integration representative contacts the signup to discuss pricing and provisioning a full-access paid service plan. environment_binding: >- Tokens are environment-bound. The portal FAQ documents the error "Invalid token provided." with the explanation that a token generated in UAT can only be used to make subsequent calls in UAT. A sandbox client calling UAT or production returns 401 "Restricted environment access denied."