Steadfast Group Address API

openapi: 3.2.0
info:
  title: Steadfast Flood Risk Tracker Address API
  version: '1.0'
  summary: Anonymous Australian address lookup and Swiss Re natural-catastrophe flood risk scoring.
  description: 'The read-only JSON API behind Steadfast Group''s public Flood Risk Tracker web tool (https://floodrisktracker.steadfast.com.au/). It resolves a free-text Australian street address against the G-NAF (Geocoded National Address File) identifier set, then returns natural-catastrophe flood risk layers for that address, sourced from Swiss Re hazard models (river/fluvial flood and coastal storm surge).


    PROVENANCE AND STATUS - this document is NOT published by Steadfast Group. Steadfast Group publishes no developer portal and no API specification of any kind. This OpenAPI was DERIVED by API Evangelist from the tool''s own client JavaScript (/Scripts/FloodRiskTracker/custom.js, which calls both operations via jQuery $.ajax) and from live, anonymous, unauthenticated probes of the two endpoints on 2026-07-25. Every path, parameter name, field name, status code, media type and example in this document was OBSERVED in a real response - nothing is invented. It is nonetheless an undocumented, unsupported, unversioned-in-public surface that Steadfast may change or close without notice, and it should be treated as observational intelligence rather than as a contract Steadfast offers.


    OBSERVED RUNTIME NOTES - the API is fronted by Cloudflare and served by ASP.NET Core (`x-powered-by: ASP.NET`). Responses carry `api-supported-versions: 1.0`, and each risk layer object carries its own `version` field (observed value `/v1/`). Validation errors are returned as RFC 9457 `application/problem+json` (ASP.NET Core ValidationProblemDetails) with a W3C Trace Context `traceId`. CORS is restricted - the observed `access-control-allow-origin` is `https://steadfastinsurance.wufoo.com`, so browser-based cross-origin use from other origins is not permitted. No authentication of any kind is required or accepted; no rate limits are documented.'
  contact:
    name: Steadfast Group Limited
    url: https://www.steadfast.com.au/contact-us/
  x-apievangelist-provenance:
    method: derived
    derived_from:
    - https://floodrisktracker.steadfast.com.au/Scripts/FloodRiskTracker/custom.js
    - live anonymous probes of both operations on 2026-07-25
    published_by_provider: false
    supported_contract: false
servers:
- url: https://floodrisktracker.steadfast.com.au
  description: Production host for the public Flood Risk Tracker web tool and its JSON API.
tags:
- name: Address
  description: Australian address resolution against G-NAF identifiers.
paths:
  /api/risk/find_address:
    get:
      operationId: findAddress
      tags:
      - Address
      summary: Search Australian addresses
      description: Resolves a free-text address fragment to a list of candidate Australian addresses, each carrying the G-NAF identifier required by `getFloodRisk`. Observed to return an empty array for addresses outside Australia (a New Zealand query returned `[]`), and to return more candidates than the tool's UI displays - the client slices the first five. Observed `latitude` and `longitude` were `null` on every candidate returned.
      parameters:
      - name: searchText
        in: query
        required: true
        description: Free-text Australian address fragment, e.g. `1 Market Street`.
        schema:
          type: string
          minLength: 1
        example: 1 Market Street
      responses:
        '200':
          description: Candidate addresses. An empty array means no match was found.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AddressCandidate'
              examples:
                observed:
                  summary: Observed response for `searchText=1 Market Street` (truncated to two of five)
                  value:
                  - id: AU|GNAF|GASA_422065999
                    fullAddress: 1 MARKET STREET, BURRA SA 5417
                    latitude: null
                    longitude: null
                  - id: AU|GNAF|GAVIC423795616
                    fullAddress: 1 MARKET STREET, NEWPORT VIC 3015
                    latitude: null
                    longitude: null
                noMatch:
                  summary: Observed response for a non-Australian address
                  value: []
        '400':
          $ref: '#/components/responses/ValidationProblem'
components:
  schemas:
    AddressCandidate:
      type: object
      title: AddressCandidate
      description: A candidate Australian address resolved from free text.
      properties:
        id:
          type: string
          description: Pipe-delimited address identifier. Observed form `AU|GNAF|<G-NAF PID>` - country code, address dataset (G-NAF, the Geocoded National Address File), and the persistent identifier. This value is the `addressId` input to `getFloodRisk`.
          examples:
          - AU|GNAF|GANSW705226154
        fullAddress:
          type: string
          description: Upper-case formatted address including state and postcode.
          examples:
          - 1 MOLESWORTH STREET, LISMORE NSW 2480
        latitude:
          type:
          - number
          - 'null'
          description: Observed `null` on every candidate returned; the tool geocodes client-side via Google Maps instead.
        longitude:
          type:
          - number
          - 'null'
          description: Observed `null` on every candidate returned.
      required:
      - id
      - fullAddress
    ValidationProblemDetails:
      type: object
      title: ValidationProblemDetails
      description: RFC 9457 problem details as emitted by ASP.NET Core model validation.
      properties:
        type:
          type: string
          format: uri
          description: Problem type URI. Observed as an RFC 9110 status-code section link.
        title:
          type: string
        status:
          type: integer
        errors:
          type: object
          description: Map of parameter name to an array of validation messages.
          additionalProperties:
            type: array
            items:
              type: string
        traceId:
          type: string
          description: W3C Trace Context `traceparent` value for the failed request.
      required:
      - type
      - title
      - status
  responses:
    ValidationProblem:
      description: The required query parameter was missing. Returned as RFC 9457 problem details (ASP.NET Core `ValidationProblemDetails`).
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ValidationProblemDetails'
          examples:
            observed:
              summary: Observed response when `addressId` is omitted
              value:
                type: https://tools.ietf.org/html/rfc9110#section-15.5.1
                title: One or more validation errors occurred.
                status: 400
                errors:
                  addressId:
                  - The addressId field is required.
                traceId: 00-ce51a3cb1302ff41a4b7b151de452c73-495f67f482a4fb3a-00