generated: '2026-07-20'
method: searched
source: >
  https://www.movebank.com.au/about-us/corporate-information/open-banking/ +
  Consumer Data Standards (consumerdatastandardsaustralia.github.io/standards) +
  CDR Security Profile; OpenAPI declares no securitySchemes (the Get Products
  endpoint is public/unauthenticated by CDR mandate).
summary:
  types: [none, oauth2, openIdConnect, mutualTLS]
  model: two-tier
  public_prd: unauthenticated
  consumer_sharing: cdr-security-profile
tiers:
- name: Product Reference Data (PRD)
  authentication: none
  description: >
    The public Product Reference Data API (Get Products / Get Product Detail
    under /cds-au/v1/banking/products) is unauthenticated by design — a CDR data
    holder obligation. No API key, token, or client credential is required;
    callers supply only the CDS version header x-v (currently 4 for Get Products).
  operations: [listBankingProducts, getBankingProductDetail]
  confirmed: true
- name: Consumer Data Sharing (accounts, balances, transactions, direct debits, scheduled payments, payees)
  authentication: oauth2 + openIdConnect + mutualTLS
  profile: CDR Security Profile (FAPI 1.0 Advanced-based, OIDC Hybrid flow, PAR, PKCE, private_key_jwt)
  description: >
    All non-PRD banking resources require the CDR Accredited Data Recipient (ADR)
    model: the caller must be ACCC-accredited, hold consumer consent, and present
    a token obtained under the CDR Security Profile over mutual TLS. This surface
    is not publicly documented by MOVE Bank; it is governed centrally by the DSB
    Consumer Data Standards and the CDR Register. Joint-account data sharing is
    noted by the bank as not currently available.
  operations: [listBankingAccounts, getBankingAccountDetail, getBankingBalance, listBankingBalancesBulk, listBankingBalancesSpecificAccounts, listBankingTransactions, getBankingTransactionDetail, listDirectDebits, listScheduledPayments, listBankingPayees, getBankingPayeeDetail]
schemes: []
notes: >
  The harvested OpenAPI is the shared DSB CDR Banking API standard (v1.36.0),
  which intentionally omits securitySchemes (auth is defined by the separate CDR
  Security Profile, not per-resource in the spec). derive-authentication.py
  therefore found 0 schemes; this profile is the searched upgrade documenting the
  real two-tier model.