Steadfast Group Risk API

openapi: 3.2.0
info:
  title: Steadfast Flood Tracker Risk API
  version: '1.0'
  summary: Anonymous Australian address lookup and Swiss Re natural-catastrophe flood risk scoring.
  description: 'The read-only JSON API behind Steadfast Group''s public Flood Risk Tracker web tool (https://floodrisktracker.steadfast.com.au/). It resolves a free-text Australian street address against the G-NAF (Geocoded National Address File) identifier set, then returns natural-catastrophe flood risk layers for that address, sourced from Swiss Re hazard models (river/fluvial flood and coastal storm surge).


    PROVENANCE AND STATUS - this document is NOT published by Steadfast Group. Steadfast Group publishes no developer portal and no API specification of any kind. This OpenAPI was DERIVED by API Evangelist from the tool''s own client JavaScript (/Scripts/FloodRiskTracker/custom.js, which calls both operations via jQuery $.ajax) and from live, anonymous, unauthenticated probes of the two endpoints on 2026-07-25. Every path, parameter name, field name, status code, media type and example in this document was OBSERVED in a real response - nothing is invented. It is nonetheless an undocumented, unsupported, unversioned-in-public surface that Steadfast may change or close without notice, and it should be treated as observational intelligence rather than as a contract Steadfast offers.


    OBSERVED RUNTIME NOTES - the API is fronted by Cloudflare and served by ASP.NET Core (`x-powered-by: ASP.NET`). Responses carry `api-supported-versions: 1.0`, and each risk layer object carries its own `version` field (observed value `/v1/`). Validation errors are returned as RFC 9457 `application/problem+json` (ASP.NET Core ValidationProblemDetails) with a W3C Trace Context `traceId`. CORS is restricted - the observed `access-control-allow-origin` is `https://steadfastinsurance.wufoo.com`, so browser-based cross-origin use from other origins is not permitted. No authentication of any kind is required or accepted; no rate limits are documented.'
  contact:
    name: Steadfast Group Limited
    url: https://www.steadfast.com.au/contact-us/
  x-apievangelist-provenance:
    method: derived
    derived_from:
    - https://floodrisktracker.steadfast.com.au/Scripts/FloodRiskTracker/custom.js
    - live anonymous probes of both operations on 2026-07-25
    published_by_provider: false
    supported_contract: false
servers:
- url: https://floodrisktracker.steadfast.com.au
  description: Production host for the public Flood Risk Tracker web tool and its JSON API.
tags:
- name: Risk
  description: Natural-catastrophe flood risk layers for a resolved address.
paths:
  /api/risk/get_flood_risk:
    get:
      operationId: getFloodRisk
      tags:
      - Risk
      summary: Get flood risk layers for an address
      description: 'Returns the natural-catastrophe flood risk layers for a G-NAF address identifier obtained from `findAddress`. Two layers were observed on every successful call: `FL_Fluvial_SwissRe` (river/fluvial flood) and `FL_Surge_SwissRe` (coastal storm surge). An unknown or malformed identifier was observed to return `200` with an empty array rather than a 404.'
      parameters:
      - name: addressId
        in: query
        required: true
        description: G-NAF address identifier returned in `AddressCandidate.id`, e.g. `AU|GNAF|GANSW705226154`.
        schema:
          type: string
        example: AU|GNAF|GANSW705226154
      responses:
        '200':
          description: Risk layers for the address. An empty array means no risk data was resolved for the supplied identifier.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/RiskLayer'
              examples:
                highFluvialRisk:
                  summary: Observed response for 1 MOLESWORTH STREET, LISMORE NSW 2480
                  value:
                  - layerId: FL_Surge_SwissRe
                    valueLabel: Outside
                    intensity: '1'
                    riskIndex: 1
                    details: "{\n  \"Surge Return Period\": \"Outside\"\n}"
                    riskDescription: Low
                    version: /v1/
                  - layerId: FL_Fluvial_SwissRe
                    valueLabel: 50 years
                    intensity: '8.9'
                    riskIndex: 7
                    details: "{\n  \"FF Return Period (SR)\": \"50 years\",\n  \"FF Protection (SR)\": \"Unprotected\",\n  \"FF Schema (SR)\": \"SR_GFZ3\",\n  \"FF Code (SR)\": \"SR_GFZ3_50\",\n  \"FF Frequency (SR)\": \"Very High\"\n}"
                    riskDescription: High
                    version: /v1/
                lowRisk:
                  summary: Observed response for 1 MARKET STREET, NEWPORT VIC 3015
                  value:
                  - layerId: FL_Surge_SwissRe
                    valueLabel: Outside
                    intensity: '1'
                    riskIndex: 1
                    details: "{\n  \"Surge Return Period\": \"Outside\"\n}"
                    riskDescription: Low
                    version: /v1/
                  - layerId: FL_Fluvial_SwissRe
                    valueLabel: Outside
                    intensity: '1'
                    riskIndex: 1
                    details: "{\n  \"FF Return Period (SR)\": \"Outside\",\n  \"FF Protection (SR)\": \"Unprotected\",\n  \"FF Schema (SR)\": \"SR_GFZ3\",\n  \"FF Code (SR)\": \"Outside\",\n  \"FF Frequency (SR)\": \"Outside\"\n}"
                    riskDescription: Low
                    version: /v1/
                noData:
                  summary: Observed response for an unrecognised identifier
                  value: []
        '400':
          $ref: '#/components/responses/ValidationProblem'
components:
  responses:
    ValidationProblem:
      description: The required query parameter was missing. Returned as RFC 9457 problem details (ASP.NET Core `ValidationProblemDetails`).
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ValidationProblemDetails'
          examples:
            observed:
              summary: Observed response when `addressId` is omitted
              value:
                type: https://tools.ietf.org/html/rfc9110#section-15.5.1
                title: One or more validation errors occurred.
                status: 400
                errors:
                  addressId:
                  - The addressId field is required.
                traceId: 00-ce51a3cb1302ff41a4b7b151de452c73-495f67f482a4fb3a-00
  schemas:
    ValidationProblemDetails:
      type: object
      title: ValidationProblemDetails
      description: RFC 9457 problem details as emitted by ASP.NET Core model validation.
      properties:
        type:
          type: string
          format: uri
          description: Problem type URI. Observed as an RFC 9110 status-code section link.
        title:
          type: string
        status:
          type: integer
        errors:
          type: object
          description: Map of parameter name to an array of validation messages.
          additionalProperties:
            type: array
            items:
              type: string
        traceId:
          type: string
          description: W3C Trace Context `traceparent` value for the failed request.
      required:
      - type
      - title
      - status
    RiskLayer:
      type: object
      title: RiskLayer
      description: One natural-catastrophe hazard layer scored for an address.
      properties:
        layerId:
          type: string
          description: Hazard layer identifier. Observed values are `FL_Fluvial_SwissRe` (river flood) and `FL_Surge_SwissRe` (coastal storm surge); the `_SwissRe` suffix identifies Swiss Re as the hazard data source.
          examples:
          - FL_Fluvial_SwissRe
          - FL_Surge_SwissRe
        valueLabel:
          type: string
          description: Human-readable hazard value. Observed values include `Outside` (outside the modelled hazard zone) and return-period labels such as `50 years`.
          examples:
          - Outside
          - 50 years
        intensity:
          type: string
          description: Hazard intensity as a decimal string. Observed `1` through `8.9`.
          examples:
          - '1'
          - '8.9'
        riskIndex:
          type: integer
          description: Numeric risk band the tool maps to a CSS class (`risk-<n>`). Observed values 1 and 7; the tool renders a graduated bar from this value.
          examples:
          - 1
          - 7
        riskDescription:
          type: string
          description: Risk band label the tool renders as "<value> Risk". Observed values `Low` and `High`. When absent/empty the tool renders "No Risk Data".
          examples:
          - Low
          - High
        details:
          type: string
          description: A JSON document embedded as a string (double-encoded, CRLF-formatted) carrying the underlying Swiss Re model attributes for the layer - e.g. `FF Return Period (SR)`, `FF Protection (SR)`, `FF Schema (SR)`, `FF Code (SR)`, `FF Frequency (SR)` for fluvial flood, and `Surge Return Period` for storm surge. Consumers must parse this string as JSON.
          contentMediaType: application/json
        version:
          type: string
          description: Layer data version. Observed `/v1/` on every layer.
          examples:
          - /v1/
      required:
      - layerId