nib

aid: nib-health-funds
url: https://raw.githubusercontent.com/api-evangelist/nib-health-funds/refs/heads/main/apis.yml
name: nib
kind: company
description: 'nib holdings limited (ASX:NHF), trading as nib, is an Australian private health insurer headquartered in Newcastle,
  New South Wales, and one of the country''s largest health funds alongside Medibank, Bupa and HCF. Its lines of business
  span Australian residents health insurance, New Zealand health insurance through nib nz insurance limited, international
  workers and overseas student health cover (OSHC), travel insurance, and nib Thrive, its National Disability Insurance Scheme
  plan-management arm. As a private health insurer it is regulated by APRA and the Private Health Insurance Act rather than
  by an open-data mandate — Australia''s Consumer Data Right was designated to extend to general insurance and then deferred,
  and it never reached private health insurance at all, so there is no regulatory forcing function pushing nib toward public
  APIs. Its API posture reflects that exactly: nib publishes no public, self-serve developer portal and no downloadable OpenAPI
  definitions. Probes of developer.nib.com.au, developers.nib.com.au, docs.nib.com.au and api.nib.com.au do not resolve, and
  /developers, /api, /developer, /partners and /integrations on nib.com.au all return 404. A real AWS API Gateway host, api-gateway.nib.com.au,
  is referenced by nib''s own web front-end Content-Security-Policy and answers anonymously with HTTP 403 {"message":"Forbidden"},
  confirming a first-party, credential-gated gateway with no public documentation. Healthcare provider integration runs through
  the login-walled nib HCP portal and through third-party claiming terminals — HICAPS and HealthPoint — plus Honeysuckle Health
  for medical network and MediGap registration, not through an nib-published API. Member identity is an Auth0-backed OpenID
  Connect tenant at id.nib.com.au whose discovery document is publicly readable, as is an RFC 9116 security.txt at www.nib.com.au
  naming security@nib.com.au. nib also publishes three first-party npm scopes (@nib, @nib-styles, @nib-components) across
  four public GitHub organisations, but they carry frontend and DevOps tooling rather than any API client library. nib is
  recorded here as an honest partner-gated stub.'
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
tags:
- Insurance
- Australia
- Health Insurance
- Carrier
- Claims
- Private Health Insurance
- Travel Insurance
- New Zealand
- NDIS
- Partner Gated
created: '2026-07-25'
modified: '2026-07-25'
specificationVersion: '0.19'
apis:
- aid: nib-health-funds:identity
  name: nib Identity (OpenID Connect)
  description: 'The Auth0-backed OpenID Connect tenant behind nib member sign-in, issuer https://id.nib.com.au/. It is the
    only nib API surface with anonymously readable, machine-readable metadata: the OIDC discovery document, the RFC 8414 authorization-server
    metadata and the JWKS all return HTTP 200 without credentials, and the protected endpoints (/userinfo, /oauth/token) return
    401 to anonymous callers. It supports authorization code with PKCE (S256), client credentials, device code, token exchange,
    JWT bearer, refresh, implicit and password grants, plus DPoP (ES256), CIBA backchannel authentication, backchannel logout
    and dynamic client registration. This is CONSUMER SIGN-IN identity, not a product API — it publishes only the 14 standard
    OIDC/Auth0 identity scopes and no policy, claims, quote, member-data or partner scopes. nib''s actual product APIs sit
    behind api-gateway.nib.com.au, which returns 403 to every anonymous request and publishes nothing. A sibling tenant serves
    nib New Zealand at https://id.nib.co.nz/.'
  humanURL: https://my.nib.com.au/login
  baseURL: https://id.nib.com.au
  tags:
  - Identity
  - OpenID Connect
  - OAuth 2.0
  - Authentication
  - Auth0
  - Single Sign On
  properties:
  - type: OpenIDConnectDiscovery
    url: https://id.nib.com.au/.well-known/openid-configuration
  - type: Authentication
    url: authentication/nib-health-funds-authentication.yml
  - type: OAuthScopes
    url: scopes/nib-health-funds-scopes.yml
  - type: WellKnown
    url: well-known/nib-health-funds-well-known.yml
common:
- type: Authentication
  url: authentication/nib-health-funds-authentication.yml
- type: OAuthScopes
  url: scopes/nib-health-funds-scopes.yml
- type: WellKnown
  url: well-known/nib-health-funds-well-known.yml
- type: SecurityTxt
  url: well-known/nib-health-funds-security.txt
- type: Security
  url: https://www.nib.com.au/.well-known/security.txt
- type: Conformance
  url: conformance/nib-health-funds-conformance.yml
- type: Packages
  url: packages/nib-health-funds-packages.yml
- type: LLMsTxt
  url: llms/nib-health-funds-llms.txt
- type: TermsOfService
  url: https://www.nib.com.au/docs/online-terms
- type: VulnerabilityDisclosure
  url: security/nib-health-funds-vulnerability-disclosure.yml
- type: DomainSecurity
  url: security/nib-health-funds-domain-security.yml
- type: Website
  url: https://www.nib.com.au/
- type: GitHubOrganization
  url: https://github.com/nib-health-funds
- type: LinkedIn
  url: https://www.linkedin.com/company/nib-health
- type: Blog
  url: https://www.nib.com.au/the-checkup
- type: Press
  url: https://www.nib.com.au/media
- type: Login
  url: https://my.nib.com.au/login
- type: PartnerPortal
  url: https://www.nib.com.au/providers/hcp-portal/user/login
- type: Providers
  url: https://www.nib.com.au/providers
- type: Support
  url: https://www.nib.com.au/help
- type: Contact
  url: https://www.nib.com.au/contact-us
- type: PrivacyPolicy
  url: https://www.nib.com.au/legal/privacy-policy
- type: OpenIDConnectDiscovery
  url: https://id.nib.com.au/.well-known/openid-configuration
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com