MOVE Bank · OAuth Scopes

MOVE Bank OAuth Scopes

OAuth 2.0 searched

MOVE Bank publishes 9 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the MOVE Bank API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

FinancialBanksOpen BankingCDRConsumer BankingMutual BankAustraliaProduct Reference Data

Scopes: 9 Flows: Method: searched

Scopes (9)

Scope	Description	Flows
openid	OpenID Connect authentication; required to establish the CDR authorisation.
profile	Standard OIDC profile claims within the CDR identity assertion.
bank:accounts.basic:read	Read account name, type, and balance. Grants the bulk/specific balance operations and the account list without full account numbers.
bank:accounts.detail:read	Read full account detail including account/BSB numbers and product features.
bank:transactions:read	Read transaction history and individual transaction detail for consented accounts.
bank:payees:read	Read the consumer's saved payees and payee detail.
bank:regular_payments:read	Read direct debit authorisations and scheduled/recurring payment arrangements.
common:customer.basic:read	Read the consumer's basic customer profile (name, occupation).
common:customer.detail:read	Read the consumer's detailed contact information (address, phone, email).

📄 Provider scope reference: https://consumerdatastandardsaustralia.github.io/standards/#authorisation-scopes

Source

OAuth Scopes

generated: '2026-07-21'
method: searched
docs: https://consumerdatastandardsaustralia.github.io/standards/#authorisation-scopes
source: >
  Consumer Data Standards (Data Standards Body) authorisation-scopes registry +
  CDR Security Profile. The harvested OpenAPI (shared DSB CDR Banking API v1.36.0)
  declares no oauth2 securitySchemes, so derive-oauth-scopes.py yields nothing;
  the scopes below are the standardised CDR data-cluster scopes that govern
  MOVE Bank's consumer-data-sharing surface, mapped to the operations in
  openapi/move-bank-cds-banking-products-openapi.yml. These are shared,
  ecosystem-wide CDR scopes, not MOVE Bank-proprietary values.
model: cdr-security-profile
flow: >
  OpenID Connect Hybrid flow under the CDR Security Profile (FAPI 1.0 Advanced-based)
  with PAR, PKCE, private_key_jwt and mutual-TLS holder-of-key. Consent is captured
  by data cluster; the resulting access token carries the scopes below. The public
  Product Reference Data operations (listBankingProducts, getBankingProductDetail)
  require NO scope and NO token.
scopes:
- scope: openid
  cluster: identity
  description: OpenID Connect authentication; required to establish the CDR authorisation.
  operations: []
- scope: profile
  cluster: identity
  description: Standard OIDC profile claims within the CDR identity assertion.
  operations: []
- scope: bank:accounts.basic:read
  cluster: Account balance and details (basic)
  description: >
    Read account name, type, and balance. Grants the bulk/specific balance
    operations and the account list without full account numbers.
  operations: [listBankingAccounts, listBankingBalancesBulk, listBankingBalancesSpecificAccounts, getBankingBalance]
- scope: bank:accounts.detail:read
  cluster: Account balance and details
  description: >
    Read full account detail including account/BSB numbers and product features.
  operations: [getBankingAccountDetail]
- scope: bank:transactions:read
  cluster: Transaction details
  description: Read transaction history and individual transaction detail for consented accounts.
  operations: [listBankingTransactions, getBankingTransactionDetail]
- scope: bank:payees:read
  cluster: Saved payees
  description: Read the consumer's saved payees and payee detail.
  operations: [listBankingPayees, getBankingPayeeDetail]
- scope: bank:regular_payments:read
  cluster: Direct debits and scheduled payments
  description: >
    Read direct debit authorisations and scheduled/recurring payment arrangements.
  operations: [listDirectDebits, listDirectDebitsBulk, listDirectDebitsSpecificAccounts, listScheduledPayments, listScheduledPaymentsBulk, listScheduledPaymentsSpecificAccounts]
- scope: common:customer.basic:read
  cluster: Name and occupation
  description: Read the consumer's basic customer profile (name, occupation).
  operations: []
- scope: common:customer.detail:read
  cluster: Contact details
  description: Read the consumer's detailed contact information (address, phone, email).
  operations: []
notes: >
  Product Reference Data (PRD) is public and scope-free. All scoped operations
  require ACCC accreditation as a Data Recipient plus explicit consumer consent
  under the CDR consent model; scope grants are bounded by the consent duration
  and the data clusters the consumer selected. Instalment-plan operations
  (listInstalmentPlans*) sit within the accounts data clusters. See
  authentication/move-bank-authentication.yml for the transport/token profile.