generated: '2026-07-27'
method: searched
source: >-
  x-scopes vendor extension on every operation in
  openapi/energy-queensland-cds-energy-openapi.yml and
  openapi/energy-queensland-cds-common-openapi.yml (DSB Consumer Data Standards
  v1.36.0), cross-checked against the Authorisation Scopes section of the
  published standard.
docs: https://consumerdatastandardsaustralia.github.io/standards/#authorisation-scopes
description: >-
  The OAuth2 authorisation scopes that govern Ergon Energy Retail's Consumer
  Data Right energy surface. These scopes are NOT defined by Energy Queensland -
  they are set centrally by the Treasury Data Standards Body and are identical
  for all 84 registered Australian energy data holder brands. No scope can be
  requested by a caller who is not an ACCC-accredited data recipient, and every
  scope is consented to by the individual customer through the data holder's
  authorisation flow. The two anonymously callable surfaces recorded in apis.yml
  (Get Generic Plans / Get Generic Plan Detail on the AER host, Get Status /
  Get Outages on Ergon's public base URI) carry NO x-scopes at all and require
  no token; that absence is itself recorded below.
  No OAuth2 securityScheme is declared in the harvested OpenAPI documents - the
  DSB publishes the security model in the Security Profile section of the
  standard rather than in the swagger - so these scopes were read from the
  per-operation x-scopes extension, not from a flows map.
  Anonymous discovery of the token/authorisation endpoints was attempted and
  failed by design: GET https://public.cdr.ergonretail.com.au/.well-known/openid-configuration
  and /.well-known/oauth-authorization-server both returned HTTP 404 on
  2026-07-27, because a CDR data holder publishes its infosec base URI through
  the authenticated portion of the CDR Register, not publicly.
schemes:
  - name: CDR OAuth2 (FAPI 1.0 Advanced profile)
    source: https://consumerdatastandardsaustralia.github.io/standards/#security-profile
    flows:
      - flow: authorizationCode
        authorizationUrl: not publicly discoverable (authenticated CDR Register only)
        tokenUrl: not publicly discoverable (authenticated CDR Register only)
        notes: >-
          Authorization code flow with PKCE and Pushed Authorization Requests,
          OIDC id_token, private_key_jwt client authentication, and mutual TLS
          sender-constrained tokens. Client registration is dynamic (CDR DCR)
          using a software statement assertion issued by the CDR Register.
scopes:
  - scope: openid
    description: >-
      Mandatory OIDC scope for the CDR authorisation flow. Required on every
      consent request under the Security Profile.
    flows: [authorizationCode]
    sources: [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-scopes]
  - scope: profile
    description: >-
      OIDC profile scope. Supported in the CDR authorisation flow alongside the
      CDR data scopes.
    flows: [authorizationCode]
    sources: [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-scopes]
  - scope: common:customer.basic:read
    description: Name and occupation for an individual, or organisation name and industry for a business.
    operations: [getCustomer]
    sources: [openapi/energy-queensland-cds-common-openapi.yml]
  - scope: common:customer.detail:read
    description: Phone, email, mail address and residential address of the customer.
    operations: [getCustomerDetail]
    sources: [openapi/energy-queensland-cds-common-openapi.yml]
  - scope: energy:accounts.basic:read
    description: Account name, type, creation date and plan overview for the customer's energy accounts.
    operations: [listEnergyAccounts]
    sources: [openapi/energy-queensland-cds-energy-openapi.yml]
  - scope: energy:accounts.detail:read
    description: >-
      Full account detail including the plan the account is on, authorised
      contacts, tariff and contract detail.
    operations: [getEnergyAccountDetail]
    sources: [openapi/energy-queensland-cds-energy-openapi.yml]
  - scope: energy:accounts.concessions:read
    description: Concessions and rebates applied to the customer's energy account.
    operations: [getEnergyAccountConcessions]
    sources: [openapi/energy-queensland-cds-energy-openapi.yml]
  - scope: energy:accounts.paymentschedule:read
    description: The agreed payment schedule on the account (direct debit, card debit, digital wallet or manual).
    operations: [getEnergyAccountPaymentSchedule]
    sources: [openapi/energy-queensland-cds-energy-openapi.yml]
  - scope: energy:billing:read
    description: >-
      Account balances, invoices and billing transactions - the largest single
      scope on the energy surface, covering seven operations.
    operations:
      - listEnergyAccountBalancesBulk
      - listEnergyAccountBalancesSpecificAccounts
      - getEnergyAccountBalance
      - listEnergyAccountBillingBulk
      - listEnergyAccountBillingForSpecificAccounts
      - getBillingForEnergyAccount
      - listEnergyAccountInvoicesBulk
      - listEnergyInvoicesForSpecificAccounts
      - getEnergyAccountInvoices
    sources: [openapi/energy-queensland-cds-energy-openapi.yml]
  - scope: energy:electricity.servicepoints.basic:read
    description: >-
      Basic electricity service point data - national metering identifier,
      jurisdiction, classification and status.
    operations: [listElectricityServicePoints]
    sources: [openapi/energy-queensland-cds-energy-openapi.yml]
  - scope: energy:electricity.servicepoints.detail:read
    description: >-
      Detailed service point data - meters, registers, distribution loss factor,
      location and related market participants.
    operations: [getElectricityServicePointDetail]
    sources: [openapi/energy-queensland-cds-energy-openapi.yml]
  - scope: energy:electricity.usage:read
    description: >-
      Interval and basic metering reads for a service point. Sourced from AEMO
      as the CDR secondary data holder under the Shared Responsibility model.
    operations:
      - listElectricityUsageBulk
      - listElectricityUsageForServicePoints
      - getElectricityServicePointUsage
    sources: [openapi/energy-queensland-cds-energy-openapi.yml]
  - scope: energy:electricity.der:read
    description: >-
      Distributed energy resource records for a service point - solar/battery AC
      connections, approved capacity, phases, protection mode and islandable
      installation flags. Sourced from the AEMO DER Register.
    operations:
      - listElectricityDERBulk
      - listElectricityDERForSpecificServicePoints
      - getElectricityDERForServicePoint
    sources: [openapi/energy-queensland-cds-energy-openapi.yml]
unscoped_operations:
  note: >-
    These operations declare no x-scopes and are callable with no token at all.
    Both were confirmed live and anonymous on 2026-07-27.
  operations:
    - operationId: listEnergyPlans
      surface: https://cdr.energymadeeasy.gov.au/ergon/cds-au/v1/energy/plans
      auth: none (x-v header only)
    - operationId: getEnergyPlanDetail
      surface: https://cdr.energymadeeasy.gov.au/ergon/cds-au/v1/energy/plans/{planId}
      auth: none (x-v header only, minimum version 3)
    - operationId: getStatus
      surface: https://public.cdr.ergonretail.com.au/cds-au/v1/discovery/status
      auth: none (x-v header only)
    - operationId: getOutages
      surface: https://public.cdr.ergonretail.com.au/cds-au/v1/discovery/outages
      auth: none (x-v header only)