aid: nib-health-funds url: https://raw.githubusercontent.com/api-evangelist/nib-health-funds/refs/heads/main/apis.yml name: nib kind: company description: >- nib holdings limited (ASX:NHF), trading as nib, is an Australian private health insurer headquartered in Newcastle, New South Wales, and one of the country's largest health funds alongside Medibank, Bupa and HCF. Its lines of business span Australian residents health insurance, New Zealand health insurance through nib nz insurance limited, international workers and overseas student health cover (OSHC), travel insurance, and nib Thrive, its National Disability Insurance Scheme plan-management arm. As a private health insurer it is regulated by APRA and the Private Health Insurance Act rather than by an open-data mandate — Australia's Consumer Data Right was designated to extend to general insurance and then deferred, and it never reached private health insurance at all, so there is no regulatory forcing function pushing nib toward public APIs. Its API posture reflects that exactly: nib publishes no public, self-serve developer portal and no downloadable OpenAPI definitions. Probes of developer.nib.com.au, developers.nib.com.au, docs.nib.com.au and api.nib.com.au do not resolve, and /developers, /api, /developer, /partners and /integrations on nib.com.au all return 404. A real AWS API Gateway host, api-gateway.nib.com.au, is referenced by nib's own web front-end Content-Security-Policy and answers anonymously with HTTP 403 {"message":"Forbidden"}, confirming a first-party, credential-gated gateway with no public documentation. Healthcare provider integration runs through the login-walled nib HCP portal and through third-party claiming terminals — HICAPS and HealthPoint — plus Honeysuckle Health for medical network and MediGap registration, not through an nib-published API. Member identity is an Auth0-backed OpenID Connect tenant at id.nib.com.au whose discovery document is publicly readable, as is an RFC 9116 security.txt at www.nib.com.au naming security@nib.com.au. nib also publishes three first-party npm scopes (@nib, @nib-styles, @nib-components) across four public GitHub organisations, but they carry frontend and DevOps tooling rather than any API client library. nib is recorded here as an honest partner-gated stub. image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg tags: - Insurance - Australia - Health Insurance - Carrier - Claims - Private Health Insurance - Travel Insurance - New Zealand - NDIS - Partner Gated created: '2026-07-25' modified: '2026-07-25' specificationVersion: '0.19' apis: - aid: nib-health-funds:identity name: nib Identity (OpenID Connect) description: >- The Auth0-backed OpenID Connect tenant behind nib member sign-in, issuer https://id.nib.com.au/. It is the only nib API surface with anonymously readable, machine-readable metadata: the OIDC discovery document, the RFC 8414 authorization-server metadata and the JWKS all return HTTP 200 without credentials, and the protected endpoints (/userinfo, /oauth/token) return 401 to anonymous callers. It supports authorization code with PKCE (S256), client credentials, device code, token exchange, JWT bearer, refresh, implicit and password grants, plus DPoP (ES256), CIBA backchannel authentication, backchannel logout and dynamic client registration. This is CONSUMER SIGN-IN identity, not a product API — it publishes only the 14 standard OIDC/Auth0 identity scopes and no policy, claims, quote, member-data or partner scopes. nib's actual product APIs sit behind api-gateway.nib.com.au, which returns 403 to every anonymous request and publishes nothing. A sibling tenant serves nib New Zealand at https://id.nib.co.nz/. humanURL: https://my.nib.com.au/login baseURL: https://id.nib.com.au tags: - Identity - OpenID Connect - OAuth 2.0 - Authentication - Auth0 - Single Sign On properties: - type: OpenIDConnectDiscovery url: https://id.nib.com.au/.well-known/openid-configuration - type: Authentication url: authentication/nib-health-funds-authentication.yml - type: OAuthScopes url: scopes/nib-health-funds-scopes.yml - type: WellKnown url: well-known/nib-health-funds-well-known.yml common: - type: Authentication url: authentication/nib-health-funds-authentication.yml - type: OAuthScopes url: scopes/nib-health-funds-scopes.yml - type: WellKnown url: well-known/nib-health-funds-well-known.yml - type: SecurityTxt url: well-known/nib-health-funds-security.txt - type: Security url: https://www.nib.com.au/.well-known/security.txt - type: Conformance url: conformance/nib-health-funds-conformance.yml - type: Packages url: packages/nib-health-funds-packages.yml - type: LLMsTxt url: llms/nib-health-funds-llms.txt - type: TermsOfService url: https://www.nib.com.au/docs/online-terms - type: VulnerabilityDisclosure url: security/nib-health-funds-vulnerability-disclosure.yml - type: DomainSecurity url: security/nib-health-funds-domain-security.yml - type: Website url: https://www.nib.com.au/ - type: GitHubOrganization url: https://github.com/nib-health-funds - type: LinkedIn url: https://www.linkedin.com/company/nib-health - type: Blog url: https://www.nib.com.au/the-checkup - type: Press url: https://www.nib.com.au/media - type: Login url: https://my.nib.com.au/login - type: PartnerPortal url: https://www.nib.com.au/providers/hcp-portal/user/login - type: Providers url: https://www.nib.com.au/providers - type: Support url: https://www.nib.com.au/help - type: Contact url: https://www.nib.com.au/contact-us - type: PrivacyPolicy url: https://www.nib.com.au/legal/privacy-policy - type: OpenIDConnectDiscovery url: https://id.nib.com.au/.well-known/openid-configuration maintainers: - FN: Kin Lane email: kin@apievangelist.com