generated: '2026-07-21'
method: searched
source: >-
  Consumer Data Standards (CDS) Information Security profile
  https://consumerdatastandardsaustralia.github.io/standards/#security-profile
  and MyState Bank Open Banking help
  https://mystate.com.au/help-centre/open-banking-help/
docs: https://consumerdatastandardsaustralia.github.io/standards/#security-profile
summary:
  types:
  - none
  - oauth2
  - mutualTLS
  oauth2_flows:
  - authorizationCode
  notes: >-
    Two distinct surfaces. The public Product Reference Data (PRD) API is
    UNAUTHENTICATED. Every consumer-authorised banking endpoint (accounts,
    balances, transactions, direct-debits, scheduled-payments, payees) is
    protected by the CDR accredited-data-recipient (ADR) security model — the
    FAPI-based CDS Information Security profile — not by an API key. The harvested
    DSB OpenAPI declares no securitySchemes because CDR authorisation is defined
    out-of-band at the standards level.
surfaces:
- name: Product Reference Data (public)
  api: openapi/mystate-bank-cds-banking-products-openapi.yml
  auth: none
  detail: >-
    GET /banking/products and GET /banking/products/{productId} are openly
    callable with no credential. Only the x-v version header is required.
- name: Consumer data sharing (authorised)
  api: openapi/mystate-bank-cds-banking-openapi.yml
  auth: oauth2 + mutualTLS
  profile: CDR / FAPI (Consumer Data Standards Information Security profile)
  detail: >-
    Access is restricted to Accredited Data Recipients (ADRs) acting on an
    explicit, revocable consumer consent. Callers must be onboarded to the CDR
    Register and present a valid access token bound to that consent.
schemes:
- name: none
  type: none
  applies_to: PRD (products) endpoints
- name: CDR OAuth2 (FAPI)
  type: oauth2
  scheme_notes: >-
    OAuth 2.0 authorization-code flow hardened to the FAPI profile: Pushed
    Authorization Requests (PAR, RFC 9126), OIDC hybrid/JARM authorization
    responses, private_key_jwt client authentication, PKCE, and request-object
    signing. Tokens are sender-constrained.
  flows:
  - flow: authorizationCode
    detail: >-
      Consent is captured in the data holder's authorisation UI; the ADR receives
      an authorization code exchanged for an access/refresh token scoped to the
      consented data clusters (e.g. bank:accounts.basic:read,
      bank:accounts.detail:read, bank:transactions:read, bank:payees:read,
      bank:regular_payments:read).
- name: Mutual TLS
  type: mutualTLS
  scheme_notes: >-
    All token and resource calls are made over mutually-authenticated TLS
    (RFC 8705) using CDR-issued transport certificates; access tokens are
    certificate-bound (sender-constrained).
related:
  scopes_note: >-
    CDR data-cluster scopes are defined by the Consumer Data Standards, not by a
    bank-proprietary OpenAPI oauth2 flow, so no scopes/ artifact is derived; the
    consented clusters are listed above.
  conventions: conventions/mystate-bank-conventions.yml
  conformance: conformance/mystate-bank-conformance.yml