generated: '2026-07-22'
method: searched
source: https://docs.blink.six-group.com/api-reference/authentication/tls-certificates.md
docs:
- https://docs.blink.six-group.com/api-reference/authentication/tls-certificates
- https://docs.blink.six-group.com/api-reference/authentication/consent-management
- https://docs.debix.six-group.com/getting-started
- https://www.six-group.com/en/products-services/financial-information/delivery-methods/api/web.html
note: None of the published OpenAPI documents declare securitySchemes - authentication
  across the SIX API estate is transport-level mutual TLS, documented in prose, plus
  OAuth 2.0 consent flows on bLink. Four Swiss infrastructure APIs on the shared
  catalog (Swiss Bank Master, SIC Service Status, SIC Clearing Day Calendar,
  Settlement Info Reporting healthcheck surface) respond without authentication.
summary:
  types: [mutualTLS, oauth2, none]
  oauth2_flows: [authorizationCode]
schemes:
- name: mTLS client certificates (bLink)
  type: mutualTLS
  description: All bLink connections are mutually authenticated with X.509 client
    certificates over TLS 1.2+. Certificates must be OV or EV, RSA >= 3072 bits,
    sha224-512RSA signature, ~1 year validity, issued by an accepted CA (DigiCert,
    QuoVadis, SwissSign) and registered with SIX; the platform maps the certificate
    to a client_id used to match access tokens.
  docs: https://docs.blink.six-group.com/api-reference/authentication/tls-certificates
- name: OAuth 2.0 consent flows (bLink)
  type: oauth2
  description: bLink consent management uses standard OAuth 2.0 authorization-code
    consent flows (including App2App/Web2App inter-app flows), with token issuance,
    revocation, and username validation endpoints in the consent-flow base module;
    Consent 2.0 (permissions) and Consent 3.0 (grant management) blueprints are
    documented. Access tokens are bound to the mTLS-registered client_id.
  docs: https://docs.blink.six-group.com/api-reference/authentication/consent-management
- name: mTLS client certificates (debiX)
  type: mutualTLS
  description: debiX issuers provide separate client certificates for the test and
    production environments; SIX registers the certificate DN in the debiX Portal
    and issuers verify access via the /healthcheck endpoint across all verbs.
  docs: https://docs.debix.six-group.com/getting-started
- name: mTLS client certificates (SIX Web API / Bulk API)
  type: mutualTLS
  description: The sales-gated SIX Web API and Bulk API for financial information
    use MTLS certificate authentication; onboarding and certificates are handled
    through the SIX API Portal after a demo-access request.
  docs: https://www.six-group.com/en/products-services/financial-information/delivery-methods/api/web.html
- name: Unauthenticated public endpoints
  type: none
  description: Documented production endpoints of the Swiss Bank Master API and SIC
    Service Status API answered HTTP 200 without authentication (probed 2026-07-21/22).
- name: Developer-portal login OAuth (apiportal.six-group.com)
  type: oauth2
  description: The Kong developer portal itself publishes RFC 8414 metadata
    (authorization_code + PKCE S256) for portal login - captured in
    well-known/six-group-oauth-authorization-server.json; this governs portal
    access, not product API calls.
  docs: https://apiportal.six-group.com/.well-known/oauth-authorization-server