Bank of Melbourne CDR Accounts & Balances API

# Harvested VERBATIM from the official DSB Consumer Data Standards (Australia)
# Source: https://raw.githubusercontent.com/ConsumerDataStandardsAustralia/standards/master/slate/source/includes/swagger/cds_banking.json
# Provenance: shared DSB CDR Banking API standard (NOT a Bank of Melbourne-proprietary contract).
# Bank of Melbourne (a St.George / Westpac Group brand) implements this shared standard.
# Its public, unauthenticated PRD surface is confirmed live at
# https://digital-api.bankofmelbourne.com.au/cds-au/v1/banking/products (HTTP 200, x-v: 5).
# Converted from JSON to YAML without content changes. Public PRD endpoints: /banking/products and /banking/products/{productId}.
info:
  contact:
    email: contact@dsb.gov.au
    name: Data Standards Body
    url: https://dsb.gov.au/
  description: Specifications for resource endpoints applicable to data holders in the Banking sector.
  license:
    name: MIT License
    url: https://opensource.org/licenses/MIT
  title: CDR Banking API
  version: 1.36.0
servers:
- description: MTLS
  url: https://mtls.dh.example.com/cds-au/v1
tags:
- description: Banking Product endpoints
  name: Banking Products
  x-shortName: Products
- description: Banking Account endpoints
  name: Banking Accounts
  x-shortName: Accounts
- description: Banking Account Balance endpoints
  name: Banking Account Balances
  x-shortName: Account Balances
- description: Banking Account Transaction endpoints
  name: Banking Account Transactions
  x-shortName: Transactions
- description: Banking Account Direct Debit endpoints
  name: Banking Account Direct Debits
  x-shortName: Direct Debits
- description: Banking Account Scheduled Payment endpoints
  name: Banking Account Scheduled Payments
  x-shortName: Scheduled Payments
- description: Banking Payee endpoints
  name: Banking Payees
  x-shortName: Payees
paths:
  /banking/accounts:
    get:
      description: 'Obtain a list of accounts.


        Obsolete versions: [v1](includes/obsolete/get-accounts-v1.html), [v2](includes/obsolete/get-accounts-v2.html).'
      operationId: listBankingAccounts
      parameters:
      - description: Used to filter results on the _productCategory_ field applicable to accounts. Any one of the valid values
          for this field can be supplied. If absent then all accounts returned.
        explode: true
        in: query
        name: product-category
        required: false
        schema:
          $ref: '#/components/schemas/BankingProductCategoryV2'
        style: form
      - description: Used to filter results according to open/closed status. Values can be `OPEN`, `CLOSED` or `ALL`. If absent
          then `ALL` is assumed.
        explode: true
        in: query
        name: open-status
        required: false
        schema:
          default: ALL
          enum:
          - ALL
          - CLOSED
          - OPEN
          type: string
        style: form
      - description: Filters accounts based on whether they are owned by the authorised customer. `true` for owned accounts,
          `false` for unowned accounts and absent for all accounts.
        explode: true
        in: query
        name: is-owned
        required: false
        schema:
          type: boolean
        style: form
      - description: Page of results to request (standard pagination).
        explode: true
        in: query
        name: page
        required: false
        schema:
          default: 1
          type: integer
        style: form
        x-cds-type: PositiveInteger
      - description: Page size to request. Default is 25 (standard pagination).
        explode: true
        in: query
        name: page-size
        required: false
        schema:
          default: 25
          type: integer
        style: form
        x-cds-type: PositiveInteger
      - description: Version of the API endpoint requested by the client. Must be set to a positive integer. The endpoint
          should respond with the highest supported version between [_x-min-v_](#request-headers) and [_x-v_](#request-headers).
          If the value of [_x-min-v_](#request-headers) is equal to or higher than the value of [_x-v_](#request-headers)
          then the [_x-min-v_](#request-headers) header should be treated as absent. If all versions requested are not supported
          then the endpoint **MUST** respond with a `406 Not Acceptable`. See [HTTP Headers](#request-headers).
        explode: false
        in: header
        name: x-v
        required: true
        schema:
          type: string
        style: simple
      - description: Minimum version of the API endpoint requested by the client. Must be set to a positive integer if provided.
          The endpoint should respond with the highest supported version between [_x-min-v_](#request-headers) and [_x-v_](#request-headers).
          If all versions requested are not supported then the endpoint **MUST** respond with a `406 Not Acceptable`.
        explode: false
        in: header
        name: x-min-v
        required: false
        schema:
          type: string
        style: simple
      - description: An **[[RFC4122]](#nref-RFC4122)** UUID used as a correlation id. If provided, the data holder **MUST**
          play back this value in the _x-fapi-interaction-id_ response header. If not provided a **[[RFC4122]](#nref-RFC4122)**
          UUID value is required to be provided in the response header to track the interaction.
        explode: false
        in: header
        name: x-fapi-interaction-id
        required: false
        schema:
          type: string
        style: simple
      - description: The time when the customer last logged in to the Data Recipient Software Product as described in **[[FAPI-1.0-Baseline]](#nref-FAPI-1-0-Baseline)**.
          Required for all resource calls (customer present and unattended). Not required for unauthenticated calls.
        explode: false
        in: header
        name: x-fapi-auth-date
        required: false
        schema:
          type: string
        style: simple
        x-conditional: true
      - description: The customer's original IP address if the customer is currently logged in to the Data Recipient Software
          Product. The presence of this header indicates that the API is being called in a customer present context. Not to
          be included for unauthenticated calls.
        explode: false
        in: header
        name: x-fapi-customer-ip-address
        required: false
        schema:
          type: string
        style: simple
      - description: The customer's original standard http headers [Base64](#common-field-types) encoded, including the original
          User-Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for
          customer present calls. Not required for unattended or unauthenticated calls.
        explode: false
        in: header
        name: x-cds-client-headers
        required: false
        schema:
          type: string
        style: simple
        x-conditional: true
        x-cds-type: Base64
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseBankingAccountListV3'
          description: Successful response
          headers:
            x-v:
              $ref: '#/components/headers/XV'
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseErrorListV2'
          description: The following error codes **MUST** be supported:<br/><ul class="error-code-list"><li>[400 - Invalid
            Field](#error-400-field-invalid)</li><li>[400 - Missing Required Field](#error-400-field-missing)</li><li>[400
            - Missing Required Header](#error-400-header-missing)</li><li>[400 - Invalid Version](#error-400-header-invalid-version)</li><li>[400
            - Invalid Page Size](#error-400-field-invalid-page-size)</li></ul>
          headers:
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
        '406':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseErrorListV2'
          description: The following error codes **MUST** be supported:<br/><ul class="error-code-list"><li>[406 - Unsupported
            Version](#error-406-header-unsupported-version)</li></ul>
          headers:
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseErrorListV2'
          description: The following error codes **MUST** be supported:<br/><ul class="error-code-list"><li>[422 - Invalid
            Page](#error-422-field-invalid-page)</li></ul>
          headers:
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
      summary: Get Accounts
      tags:
      - Banking Accounts
      x-scopes:
      - bank:accounts.basic:read
      x-version: '3'
  /banking/accounts/balances:
    get:
      description: 'Obtain balances for multiple, filtered accounts.


        Obsolete versions: [v1](includes/obsolete/get-bulk-balances-v1.html).'
      operationId: listBankingBalancesBulk
      parameters:
      - description: Used to filter results on the _productCategory_ field applicable to accounts. Any one of the valid values
          for this field can be supplied. If absent then all accounts returned.
        explode: true
        in: query
        name: product-category
        required: false
        schema:
          $ref: '#/components/schemas/BankingProductCategoryV2'
        style: form
      - description: Used to filter results according to open/closed status. Values can be `OPEN`, `CLOSED` or `ALL`. If absent
          then `ALL` is assumed.
        explode: true
        in: query
        name: open-status
        required: false
        schema:
          default: ALL
          enum:
          - ALL
          - CLOSED
          - OPEN
          type: string
        style: form
      - description: Filters accounts based on whether they are owned by the authorised customer. `true` for owned accounts,
          `false` for unowned accounts and absent for all accounts.
        explode: true
        in: query
        name: is-owned
        required: false
        schema:
          type: boolean
        style: form
      - description: Page of results to request (standard pagination).
        explode: true
        in: query
        name: page
        required: false
        schema:
          default: 1
          type: integer
        style: form
        x-cds-type: PositiveInteger
      - description: Page size to request. Default is 25 (standard pagination).
        explode: true
        in: query
        name: page-size
        required: false
        schema:
          default: 25
          type: integer
        style: form
        x-cds-type: PositiveInteger
      - description: Version of the API endpoint requested by the client. Must be set to a positive integer. The endpoint
          should respond with the highest supported version between [_x-min-v_](#request-headers) and [_x-v_](#request-headers).
          If the value of [_x-min-v_](#request-headers) is equal to or higher than the value of [_x-v_](#request-headers)
          then the [_x-min-v_](#request-headers) header should be treated as absent. If all versions requested are not supported
          then the endpoint **MUST** respond with a `406 Not Acceptable`. See [HTTP Headers](#request-headers).
        explode: false
        in: header
        name: x-v
        required: true
        schema:
          type: string
        style: simple
      - description: Minimum version of the API endpoint requested by the client. Must be set to a positive integer if provided.
          The endpoint should respond with the highest supported version between [_x-min-v_](#request-headers) and [_x-v_](#request-headers).
          If all versions requested are not supported then the endpoint **MUST** respond with a `406 Not Acceptable`.
        explode: false
        in: header
        name: x-min-v
        required: false
        schema:
          type: string
        style: simple
      - description: An **[[RFC4122]](#nref-RFC4122)** UUID used as a correlation id. If provided, the data holder **MUST**
          play back this value in the _x-fapi-interaction-id_ response header. If not provided a **[[RFC4122]](#nref-RFC4122)**
          UUID value is required to be provided in the response header to track the interaction.
        explode: false
        in: header
        name: x-fapi-interaction-id
        required: false
        schema:
          type: string
        style: simple
      - description: The time when the customer last logged in to the Data Recipient Software Product as described in **[[FAPI-1.0-Baseline]](#nref-FAPI-1-0-Baseline)**.
          Required for all resource calls (customer present and unattended). Not required for unauthenticated calls.
        explode: false
        in: header
        name: x-fapi-auth-date
        required: false
        schema:
          type: string
        style: simple
        x-conditional: true
      - description: The customer's original IP address if the customer is currently logged in to the Data Recipient Software
          Product. The presence of this header indicates that the API is being called in a customer present context. Not to
          be included for unauthenticated calls.
        explode: false
        in: header
        name: x-fapi-customer-ip-address
        required: false
        schema:
          type: string
        style: simple
      - description: The customer's original standard http headers [Base64](#common-field-types) encoded, including the original
          User-Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for
          customer present calls. Not required for unattended or unauthenticated calls.
        explode: false
        in: header
        name: x-cds-client-headers
        required: false
        schema:
          type: string
        style: simple
        x-conditional: true
        x-cds-type: Base64
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseBankingAccountsBalanceList'
          description: Successful response
          headers:
            x-v:
              $ref: '#/components/headers/XV'
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseErrorListV2'
          description: The following error codes **MUST** be supported:<br/><ul class="error-code-list"><li>[400 - Invalid
            Field](#error-400-field-invalid)</li><li>[400 - Missing Required Field](#error-400-field-missing)</li><li>[400
            - Missing Required Header](#error-400-header-missing)</li><li>[400 - Invalid Version](#error-400-header-invalid-version)</li><li>[400
            - Invalid Page Size](#error-400-field-invalid-page-size)</li></ul>
          headers:
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
        '406':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseErrorListV2'
          description: The following error codes **MUST** be supported:<br/><ul class="error-code-list"><li>[406 - Unsupported
            Version](#error-406-header-unsupported-version)</li></ul>
          headers:
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseErrorListV2'
          description: The following error codes **MUST** be supported:<br/><ul class="error-code-list"><li>[422 - Invalid
            Page](#error-422-field-invalid-page)</li></ul>
          headers:
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
      summary: Get Bulk Balances
      tags:
      - Banking Account Balances
      x-scopes:
      - bank:accounts.basic:read
      x-version: '2'
    post:
      description: Obtain balances for a specified list of accounts.
      operationId: listBankingBalancesSpecificAccounts
      parameters:
      - description: Page of results to request (standard pagination).
        explode: true
        in: query
        name: page
        required: false
        schema:
          default: 1
          type: integer
        style: form
        x-cds-type: PositiveInteger
      - description: Page size to request. Default is 25 (standard pagination).
        explode: true
        in: query
        name: page-size
        required: false
        schema:
          default: 25
          type: integer
        style: form
        x-cds-type: PositiveInteger
      - description: Version of the API endpoint requested by the client. Must be set to a positive integer. The endpoint
          should respond with the highest supported version between [_x-min-v_](#request-headers) and [_x-v_](#request-headers).
          If the value of [_x-min-v_](#request-headers) is equal to or higher than the value of [_x-v_](#request-headers)
          then the [_x-min-v_](#request-headers) header should be treated as absent. If all versions requested are not supported
          then the endpoint **MUST** respond with a `406 Not Acceptable`. See [HTTP Headers](#request-headers).
        explode: false
        in: header
        name: x-v
        required: true
        schema:
          type: string
        style: simple
      - description: Minimum version of the API endpoint requested by the client. Must be set to a positive integer if provided.
          The endpoint should respond with the highest supported version between [_x-min-v_](#request-headers) and [_x-v_](#request-headers).
          If all versions requested are not supported then the endpoint **MUST** respond with a `406 Not Acceptable`.
        explode: false
        in: header
        name: x-min-v
        required: false
        schema:
          type: string
        style: simple
      - description: An **[[RFC4122]](#nref-RFC4122)** UUID used as a correlation id. If provided, the data holder **MUST**
          play back this value in the _x-fapi-interaction-id_ response header. If not provided a **[[RFC4122]](#nref-RFC4122)**
          UUID value is required to be provided in the response header to track the interaction.
        explode: false
        in: header
        name: x-fapi-interaction-id
        required: false
        schema:
          type: string
        style: simple
      - description: The time when the customer last logged in to the Data Recipient Software Product as described in **[[FAPI-1.0-Baseline]](#nref-FAPI-1-0-Baseline)**.
          Required for all resource calls (customer present and unattended). Not required for unauthenticated calls.
        explode: false
        in: header
        name: x-fapi-auth-date
        required: false
        schema:
          type: string
        style: simple
        x-conditional: true
      - description: The customer's original IP address if the customer is currently logged in to the Data Recipient Software
          Product. The presence of this header indicates that the API is being called in a customer present context. Not to
          be included for unauthenticated calls.
        explode: false
        in: header
        name: x-fapi-customer-ip-address
        required: false
        schema:
          type: string
        style: simple
      - description: The customer's original standard http headers [Base64](#common-field-types) encoded, including the original
          User-Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for
          customer present calls. Not required for unattended or unauthenticated calls.
        explode: false
        in: header
        name: x-cds-client-headers
        required: false
        schema:
          type: string
        style: simple
        x-conditional: true
        x-cds-type: Base64
      requestBody:
        $ref: '#/components/requestBodies/RequestAccountIds'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseBankingAccountsBalanceList'
          description: Successful response
          headers:
            x-v:
              $ref: '#/components/headers/XV'
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseErrorListV2'
          description: The following error codes **MUST** be supported:<br/><ul class="error-code-list"><li>[400 - Invalid
            Field](#error-400-field-invalid)</li><li>[400 - Missing Required Field](#error-400-field-missing)</li><li>[400
            - Missing Required Header](#error-400-header-missing)</li><li>[400 - Invalid Version](#error-400-header-invalid-version)</li><li>[400
            - Invalid Page Size](#error-400-field-invalid-page-size)</li></ul>
          headers:
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
        '406':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseErrorListV2'
          description: The following error codes **MUST** be supported:<br/><ul class="error-code-list"><li>[406 - Unsupported
            Version](#error-406-header-unsupported-version)</li></ul>
          headers:
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseErrorListV2'
          description: The following error codes **MUST** be supported:<br/><ul class="error-code-list"><li>[422 - Invalid
            Page](#error-422-field-invalid-page)</li><li>[422 - Unavailable Banking Account](#error-422-authorisation-unavailable-banking-account)</li><li>[422
            - Invalid Banking Account](#error-422-authorisation-invalid-banking-account)</li></ul>
          headers:
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
      summary: Get Balances For Specific Accounts
      tags:
      - Banking Account Balances
      x-scopes:
      - bank:accounts.basic:read
      x-version: '1'
  /banking/accounts/{accountId}/balance:
    get:
      description: Obtain the balance for a single specified account.
      operationId: getBankingBalance
      parameters:
      - description: The _accountId_ to obtain data for. _accountId_ values are returned by account list endpoints.
        explode: false
        in: path
        name: accountId
        required: true
        schema:
          $ref: '#/components/schemas/BankingAccountId'
        style: simple
      - description: Version of the API endpoint requested by the client. Must be set to a positive integer. The endpoint
          should respond with the highest supported version between [_x-min-v_](#request-headers) and [_x-v_](#request-headers).
          If the value of [_x-min-v_](#request-headers) is equal to or higher than the value of [_x-v_](#request-headers)
          then the [_x-min-v_](#request-headers) header should be treated as absent. If all versions requested are not supported
          then the endpoint **MUST** respond with a `406 Not Acceptable`. See [HTTP Headers](#request-headers).
        explode: false
        in: header
        name: x-v
        required: true
        schema:
          type: string
        style: simple
      - description: Minimum version of the API endpoint requested by the client. Must be set to a positive integer if provided.
          The endpoint should respond with the highest supported version between [_x-min-v_](#request-headers) and [_x-v_](#request-headers).
          If all versions requested are not supported then the endpoint **MUST** respond with a `406 Not Acceptable`.
        explode: false
        in: header
        name: x-min-v
        required: false
        schema:
          type: string
        style: simple
      - description: An **[[RFC4122]](#nref-RFC4122)** UUID used as a correlation id. If provided, the data holder **MUST**
          play back this value in the _x-fapi-interaction-id_ response header. If not provided a **[[RFC4122]](#nref-RFC4122)**
          UUID value is required to be provided in the response header to track the interaction.
        explode: false
        in: header
        name: x-fapi-interaction-id
        required: false
        schema:
          type: string
        style: simple
      - description: The time when the customer last logged in to the Data Recipient Software Product as described in **[[FAPI-1.0-Baseline]](#nref-FAPI-1-0-Baseline)**.
          Required for all resource calls (customer present and unattended). Not required for unauthenticated calls.
        explode: false
        in: header
        name: x-fapi-auth-date
        required: false
        schema:
          type: string
        style: simple
        x-conditional: true
      - description: The customer's original IP address if the customer is currently logged in to the Data Recipient Software
          Product. The presence of this header indicates that the API is being called in a customer present context. Not to
          be included for unauthenticated calls.
        explode: false
        in: header
        name: x-fapi-customer-ip-address
        required: false
        schema:
          type: string
        style: simple
      - description: The customer's original standard http headers [Base64](#common-field-types) encoded, including the original
          User-Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for
          customer present calls. Not required for unattended or unauthenticated calls.
        explode: false
        in: header
        name: x-cds-client-headers
        required: false
        schema:
          type: string
        style: simple
        x-conditional: true
        x-cds-type: Base64
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseBankingAccountsBalanceById'
          description: Successful response
          headers:
            x-v:
              $ref: '#/components/headers/XV'
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseErrorListV2'
          description: The following error codes **MUST** be supported:<br/><ul class="error-code-list"><li>[400 - Invalid
            Field](#error-400-field-invalid)</li><li>[400 - Missing Required Field](#error-400-field-missing)</li><li>[400
            - Missing Required Header](#error-400-header-missing)</li><li>[400 - Invalid Version](#error-400-header-invalid-version)</li></ul>
          headers:
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseErrorListV2'
          description: The following error codes **MUST** be supported:<br/><ul class="error-code-list"><li>[404 - Unavailable
            Banking Account](#error-404-authorisation-unavailable-banking-account)</li><li>[404 - Invalid Banking Account](#error-404-authorisation-invalid-banking-account)</li></ul>
          headers:
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
        '406':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseErrorListV2'
          description: The following error codes **MUST** be supported:<br/><ul class="error-code-list"><li>[406 - Unsupported
            Version](#error-406-header-unsupported-version)</li></ul>
          headers:
            x-fapi-interaction-id:
              $ref: '#/components/headers/XFAPIInteractionId'
      summary: Get Account Balance
      tags:
      - Banking Account Balances
      x-scopes:
      - bank:accounts.basic:read
      x-version: '1'
  /banking/accounts/{accountId}:
    get:
      description: 'Obtain detailed information on a single account.


        Obsolete versions: [v1](includes/obsolete/get-account-detail-v1.html), [v2](includes/obsolete/get-account-detail-v2.html),
        [v3](includes/obsolete/get-account-detail-v3.html), [v4](includes/obsolete/get-account-detail-v4.html).'
      operationId: getBankingAccountDetail
      parameters:
      - description: The _accountId_ to obtain data for. _accountId_ values are returned by account list endpoints.
        explode: false
        in: path
        name: accountId
        required: true
        schema:
          $ref: '#/components/schemas/BankingAccountId'
        style: simple
      - description: Version of the API endpoint requested by the client. Must be set to a positive integer. The endpoint
          should respond with the highest supported version between [_x-min-v_](#request-headers) and [_x-v_](#request-headers).
          If the value of [_x-min-v_](#request-headers) is equal to or higher than the value of [_x-v_](#request-headers)
          then the [_x-min-v_](#request-headers) header should be treated as absent. If all versions requested are not supported
          then the endpoint **MUST** respond with a `406 Not Acceptable`. See [HTTP Headers](#request-headers).
        explode: false
        in: header
        name: x-v
        required: true
        schema:
          type: string
        style: simple
      - description: Minimum version of the API endpoint requested by the client. Must be set to a positive integer if provided.
          The endpoint should respond with the highest supported version between [_x-min-v_](#request-headers) and [_x-v_](#request-headers).
          If all versions requested are not supported then the endpoint **MUST** respond with a `406 Not Acceptable`.
        explode: false
        in: header
        name: x-min-v
        required: false
        schema:
          type: string
        style: simple
      - description: An **[[RFC4122]](#nref-RFC4122)** UUID used as a correlation id. If provided, the data holder **MUST**
          play back this value in the _x-fapi-interaction-id_ response header. If not provided a **[[RFC4122]](#nref-RFC4122)**
          UUID value is required to be provided in the response header to track the interaction.
        explode: false
        in: header
        name: x-fapi-interaction-id
        required: false
        schema:
          type: string
        style: simple
      - description: The time when the customer last logged in to the Data Recipient Software Product as described in **[[FAPI-1.0-Baseline]](#nref-FAPI-1-0-Baseline)**.
          Required for all resource calls (customer present and unattended). Not required for unauthenticated calls.
        explode: false
        in: header
        name: x-fapi-auth-date
        required: false
        schema:
          type: string
        style: simple
        x-conditional: true
      - description: The customer's original IP address if the customer is currently logged in to the Data Recipient Software
          Product. The presence of this header indicates that the API is being called in a customer present context. Not to
          be included for unauthenticated calls.
        explode: false
        in: header
        name: x-fapi-customer-ip-address
        required: false
        schema:
          type: string
        style: simple


# --- truncated at 32 KB (290 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/bank-of-melbourne/refs/heads/main/openapi/bank-of-melbourne-cds-banking-products-openapi.yml