generated: '2026-07-20'
method: searched
source: live probes of HSBC Australia CDR public host
host: https://public.ob.hsbc.com.au
other_hosts:
- host: https://www.hsbc.com.au
  documents:
  - path: /.well-known/security.txt
    status: 404
hosts:
- host: https://public.ob.hsbc.com.au
  documents:
  - path: /.well-known/openid-configuration
    status: 200
    file: hsbc-australia-openid-configuration.json
    note: CDR/FAPI OpenID Connect discovery document for the HSBC Australia consumer data sharing surface.
      Advertises PAR-required, mTLS-bound tokens, private_key_jwt, PS256/ES256, JARM, PKCE S256, acr urn:cds.au:cdr:2
      and :3, and the full CDR banking scope set.
  - path: /.well-known/security.txt
    status: 403
  - path: /.well-known/oauth-authorization-server
    status: 403
  - path: /.well-known/api-catalog
    status: 403
  - path: /.well-known/ai-plugin.json
    status: 403
x-shape-fix:
  converted: '2026-08-20'
  from: documents
  note: Rewritten into hosts[] -> documents[], the only shape well_known_docs() in score.rb reads. A served
    .well-known surface recorded in any other shape scores as absent.