API Evangelist enhancements for EnergyAustralia CDR Energy Electricity Service Points API

overlay: 1.0.0
info:
  title: API Evangelist enhancements for EnergyAustralia CDR Energy Electricity Service Points API
  version: 1.0.0
extends: openapi/energyaustralia-electricity-service-points-api-openapi.yml
x-apievangelist:
  generated: '2026-10-21'
  method: generated
  source: Regenerated for the split contract openapi/energyaustralia-electricity-service-points-api-openapi.yml
    from the superseded overlay for the combined CDR energy contract (2026-07-27 live probes of the EnergyAustralia
    CDR brand path). Verification dates inside actions are the original probe dates; nothing was re-probed
    in this pass.
actions:
- target: $.info
  update:
    x-apievangelist-provider: energyaustralia
    x-apievangelist-provider-name: EnergyAustralia
    x-apievangelist-spec-provenance: Split by the refine step (2026-10-18) from the verbatim Data Standards
      Body contract in openapi/_original/energyaustralia-cds-energy-api-openapi.yml; not authored by EnergyAustralia.
    x-apievangelist-verified: '2026-07-27'
- target: $.servers
  update:
  - url: https://authncdr.energyaustralia.com.au/cds-au/v1
    description: EnergyAustralia's own CDR publicBaseUri as published in the ACCC CDR Register. Serves
      the authenticated consumer data operations. ACCREDITED-ONLY — requires mutual TLS with CDR Register-issued
      certificates and a FAPI 1.0 Advanced OAuth2/OIDC consent. Every standards path probed anonymously
      returned HTTP 404.
    x-access: accredited-only
    x-verified: false
  - url: https://mtls.dh.example.com/cds-au/v1
    description: MTLS (original Data Standards Body placeholder, retained for reference)
- target: $.components
  update:
    securitySchemes:
      cdrMutualTLS:
        description: Client transport certificate issued through the ACCC CDR Register PKI. Required on
          every authenticated resource and token request.
        type: mutualTLS
      cdrOAuth2:
        description: CDR Information Security profile — FAPI 1.0 Advanced authorization code flow with
          PKCE, PAR, request object signing and private_key_jwt client authentication. Not declared in
          the Data Standards Body source document, which carries authorisation per-operation as x-scopes;
          added here so the contract is machine-checkable. Authorization and token URLs are published
          only in the data holder's OIDC discovery document, which is not anonymously reachable.
        flows:
          authorizationCode:
            authorizationUrl: https://authncdr.energyaustralia.com.au/authorize
            scopes:
              energy:electricity.servicepoints.basic:read: Basic electricity service point data
              energy:electricity.servicepoints.detail:read: Detailed service point and NMI standing data
              openid: Mandatory OpenID Connect base scope
            tokenUrl: https://authncdr.energyaustralia.com.au/token
            x-note: CONVENTIONAL PATHS, NOT VERIFIED. GET https://authncdr.energyaustralia.com.au/.well-known/openid-configuration
              returned HTTP 404 anonymously on 2026-07-27. Resolve these from the live discovery document
              once accredited; do not rely on them as published.
            x-unverified: true
        type: oauth2
- target: $.tags
  update:
  - name: Electricity Service Points
    description: Accredited-only NMI data. Standing data is sourced from AEMO as designated secondary
      data holder.
    x-shortName: Service Points
    x-access: accredited-only