generated: '2026-07-21'
method: searched
source: >-
  https://www.peoplefirstbank.com.au/help-and-support/open-banking/open-banking-for-developers
  + DSB Consumer Data Standards InfoSec profile + live probes (2026-07-21)
# Two-tier authentication posture for the People First Bank CDR surface. The harvested DSB CDS
# Banking OpenAPI (v1.36.0) declares no components.securitySchemes, so this profile is authored
# from the bank's open-banking documentation, the DSB Consumer Data Standards InfoSec profile, and
# confirmed live behaviour (public GET /banking/products => 200; unauthenticated GET
# /banking/accounts => 403). No bank-proprietary OAuth endpoints are published; consumer data
# sharing is brokered through the CDR Register, not a general-purpose developer OAuth server.
summary:
  types: [none, oauth2, openIdConnect, mutualTLS]
  api_key_in: []
  oauth2_flows: [authorizationCode]
  tiers:
    - Product Reference Data (public, unauthenticated)
    - Consumer data sharing (FAPI OAuth2/OIDC via the CDR accredited-data-recipient model)
tiers:
  - name: product-reference-data
    surface: >-
      /cds-au/v1/banking/products and /banking/products/{productId}
    style: none
    evidence: >-
      Public and unauthenticated. Live GET https://public.openbanking.peoplefirstbank.com.au/cds-au/v1/banking/products
      returns HTTP 200 (x-v 5) with a data.products array and no credential required.
  - name: consumer-data-sharing
    surface: >-
      accounts, balances, transactions, direct-debits, scheduled-payments, payees
    style: oauth2-oidc-fapi
    evidence: >-
      Unauthenticated GET https://public.openbanking.peoplefirstbank.com.au/cds-au/v1/banking/accounts
      returns HTTP 403, confirming the surface is gated. Access is granted only to CDR-accredited
      data recipients (ADRs) holding a consumer authorisation, per the DSB Consumer Data Standards.
    profile:
      standard: FAPI 1.0 Advanced (AU CDR InfoSec profile)
      register: https://www.cdr.gov.au/  # CDR Register brokers ADR<->data-holder trust
      client_authentication: private_key_jwt
      request_object: pushed-authorization-requests (PAR) + JARM
      token_binding: mutual-TLS sender-constrained access tokens
      id_token: OpenID Connect (Hybrid / Authorization Code)
schemes:
  - name: none
    type: none
    applies_to: product-reference-data
    sources: [documentation]
  - name: cdr-oauth2-oidc
    type: oauth2
    scheme: authorizationCode
    note: >-
      FAPI-secured OAuth2/OIDC brokered by the CDR Register; not a self-service developer OAuth
      server. People First Bank publishes no client_id issuance flow outside CDR accreditation.
    sources: [documentation, dsb-infosec-profile]
  - name: cdr-mtls
    type: mutualTLS
    note: mTLS sender-constrained tokens and the MTLS data-holder base URL (mtls.dh host).
    sources: [openapi/people-first-bank-cds-banking-products-openapi.yml, dsb-infosec-profile]
docs:
  - https://www.peoplefirstbank.com.au/help-and-support/open-banking/open-banking-for-developers
  - https://consumerdatastandardsaustralia.github.io/standards/#security-profile
developer_contact: OpenBankingSupport@peopleschoice.com.au