Aemo Authentication
AEMO fronts its participant APIs with Azure API Management (dev.aemo.com.au / api.aemo.com.au). Every published OpenAPI declares an APIM subscription key as an apiKey security scheme, in a header (Ocp-Apim-Subscription-Key, x-apikey, x-eHub-APIKey, x-aemo-api-key, X-DC-DEVKEY, client_id) or in the subscription-key / clientId query parameter. The subscription key is only the gateway credential: most operations additionally require an AEMO-signed TLS client certificate (mutual TLS to the e-Hub gateway) and a caller identity - either URM (User Rights Management) username/password sent as HTTP Basic in the Authorization header, or an OAuth 2.0 client_credentials bearer token issued by api.aemo.com.au. The DER Register consumer registration API uses an Azure AD B2C OpenID Connect provider instead.
AEMO secures its APIs with apiKey across 8 declared security schemes, as derived from its OpenAPI definitions.
Security Schemes
Source
Authentication Profile
generated: '2026-07-27'
method: searched
source: openapi/aemo-attributes-report-external-v1-openapi.yml, openapi/aemo-b2bmessaging-async-v1-openapi.yml,
openapi/aemo-b2bmessaging-pull-v1-openapi.yml, openapi/aemo-b2bmessaging-sync-v1-openapi.yml, openapi/aemo-b2mmessaging-async-v1-openapi.yml,
openapi/aemo-b2mmessaging-pull-v1-openapi.yml, openapi/aemo-b2mmessaging-sync-v1-openapi.yml, openapi/aemo-balancing-reports-v2-1-openapi.yml,
openapi/aemo-balancing-reports-v2-2-openapi.yml, openapi/aemo-balancing-reports-v2-3-openapi.yml, openapi/aemo-balancing-reports-v2-4-openapi.yml,
openapi/aemo-balancing-reports-v2-5-openapi.yml ...
summary:
types:
- apiKey
api_key_in:
- header
- query
schemes:
- name: apiKeyHeader
type: apiKey
in: header
parameter: Ocp-Apim-Subscription-Key
sources:
- openapi/aemo-attributes-report-external-v1-openapi.yml
- openapi/aemo-b2mmessaging-async-v1-openapi.yml
- openapi/aemo-b2mmessaging-pull-v1-openapi.yml
- openapi/aemo-balancing-reports-v2-1-openapi.yml
- openapi/aemo-balancing-reports-v2-2-openapi.yml
- openapi/aemo-balancing-reports-v2-3-openapi.yml
- openapi/aemo-balancing-reports-v2-4-openapi.yml
- openapi/aemo-balancing-reports-v2-5-openapi.yml
- openapi/aemo-balancing-reports-v2-openapi.yml
- openapi/aemo-balancing-submission-v2-openapi.yml
- openapi/aemo-bilateral-stem-submission-v1-openapi.yml
- openapi/aemo-blindupdate-v1-openapi.yml
- openapi/aemo-capacity-v1-openapi.yml
- openapi/aemo-capacityAuction-v1-openapi.yml
- openapi/aemo-cdr-common-openapi.yml
- openapi/aemo-cdr-openapi.yml
- openapi/aemo-ee-simulation-status-update-v1-openapi.yml
- openapi/aemo-enablementinstruction-v1-openapi.yml
- openapi/aemo-generatorRecall-v1-openapi.yml
- openapi/aemo-identityService-v2-openapi.yml
- openapi/aemo-lfas-reports-v2-openapi.yml
- openapi/aemo-lfas-submission-v2-openapi.yml
- openapi/aemo-market-reports-v2-openapi.yml
- openapi/aemo-meterexemption-external-v1-openapi.yml
- openapi/aemo-mtpasaoffers-v1-openapi.yml
- openapi/aemo-oip-external-v1-openapi.yml
- openapi/aemo-opsforecasting-intermittentgen-v1-openapi.yml
- openapi/aemo-outage-management-external-v1-openapi.yml
- openapi/aemo-pre-balancing-reports-v6-openapi.yml
- openapi/aemo-pre-balancing-reports-v7-1-openapi.yml
- openapi/aemo-pre-balancing-reports-v7-openapi.yml
- openapi/aemo-pre-balancing-reports-v8-openapi.yml
- openapi/aemo-prudentials-v1-openapi.yml
- openapi/aemo-rcm-ops-external-v1-openapi.yml
- openapi/aemo-reallocations-v1-openapi.yml
- openapi/aemo-report-v1-openapi.yml
- openapi/aemo-rtms-external-v1-openapi.yml
- openapi/aemo-selfForecast-v1-openapi.yml
- openapi/aemo-settlementDirect-v1-openapi.yml
- openapi/aemo-submission-v1-openapi.yml
- openapi/aemo-system-management-reports-v2-1-openapi.yml
- openapi/aemo-system-management-reports-v2-2-openapi.yml
- openapi/aemo-system-management-reports-v2-3-openapi.yml
- openapi/aemo-system-management-reports-v2-4-openapi.yml
- openapi/aemo-system-management-reports-v2-5-openapi.yml
- openapi/aemo-system-management-reports-v2-6-openapi.yml
- openapi/aemo-system-management-reports-v2-openapi.yml
- openapi/aemo-variableparameter-v1-openapi.yml
- openapi/aemo-wemde-dispatchcase-external-v1-openapi.yml
- openapi/aemo-wemde-dispatchcase-external-v2-openapi.yml
- openapi/aemo-wemde-dispatchinstruction-external-v1-openapi.yml
- openapi/aemo-wemde-dispatchsolution-external-v1-openapi.yml
- openapi/aemo-wemde-dispatchsolution-external-v2-openapi.yml
- openapi/aemo-wemde-dispatchsummary-external-v1-openapi.yml
- openapi/aemo-wemde-dspdispatchinstruction-external-v1-openapi.yml
- openapi/aemo-wemde-ncess-external-v1-openapi.yml
- openapi/aemo-wemde-notinservicecapacity-external-v1-openapi.yml
- openapi/aemo-wemde-referencetradingprice-external-v1-openapi.yml
- openapi/aemo-wemde-tradingdayreport-external-v1-openapi.yml
- name: apiKeyQuery
type: apiKey
in: query
parameter: subscription-key
sources:
- openapi/aemo-attributes-report-external-v1-openapi.yml
- openapi/aemo-b2bmessaging-async-v1-openapi.yml
- openapi/aemo-b2bmessaging-pull-v1-openapi.yml
- openapi/aemo-b2bmessaging-sync-v1-openapi.yml
- openapi/aemo-b2mmessaging-async-v1-openapi.yml
- openapi/aemo-b2mmessaging-pull-v1-openapi.yml
- openapi/aemo-b2mmessaging-sync-v1-openapi.yml
- openapi/aemo-balancing-reports-v2-1-openapi.yml
- openapi/aemo-balancing-reports-v2-2-openapi.yml
- openapi/aemo-balancing-reports-v2-3-openapi.yml
- openapi/aemo-balancing-reports-v2-4-openapi.yml
- openapi/aemo-balancing-reports-v2-5-openapi.yml
- openapi/aemo-balancing-reports-v2-openapi.yml
- openapi/aemo-balancing-submission-v2-openapi.yml
- openapi/aemo-bidding-v1-openapi.yml
- openapi/aemo-bilateral-stem-submission-v1-openapi.yml
- openapi/aemo-blindupdate-v1-openapi.yml
- openapi/aemo-capacity-v1-openapi.yml
- openapi/aemo-capacityAuction-v1-openapi.yml
- openapi/aemo-cdr-common-openapi.yml
- openapi/aemo-cdr-openapi.yml
- openapi/aemo-der-business-registration-v1-openapi.yml
- openapi/aemo-der-register-installation-v2-openapi.yml
- openapi/aemo-der-register-nmi-v1-openapi.yml
- openapi/aemo-ee-simulation-status-update-v1-openapi.yml
- openapi/aemo-enablementinstruction-v1-openapi.yml
- openapi/aemo-gasbb-reporting-public-data-openapi.yml
- openapi/aemo-generatorRecall-v1-openapi.yml
- openapi/aemo-hubmsgmgt-v1-openapi.yml
- openapi/aemo-hubmsgmgt-v2-openapi.yml
- openapi/aemo-identityService-v2-openapi.yml
- openapi/aemo-lfas-reports-v2-openapi.yml
- openapi/aemo-lfas-submission-v2-openapi.yml
- openapi/aemo-market-reports-v2-openapi.yml
- openapi/aemo-meterexemption-external-v1-openapi.yml
- openapi/aemo-mtpasaoffers-v1-openapi.yml
- openapi/aemo-oauth-v1-openapi.yml
- openapi/aemo-oip-external-v1-openapi.yml
- openapi/aemo-opsforecasting-intermittentgen-v1-openapi.yml
- openapi/aemo-outage-management-external-v1-openapi.yml
- openapi/aemo-p2pmessaging-sync-v1-openapi.yml
- openapi/aemo-pre-balancing-reports-v6-openapi.yml
- openapi/aemo-pre-balancing-reports-v7-1-openapi.yml
- openapi/aemo-pre-balancing-reports-v7-openapi.yml
- openapi/aemo-pre-balancing-reports-v8-openapi.yml
- openapi/aemo-prudentials-v1-openapi.yml
- openapi/aemo-rcm-ops-external-v1-openapi.yml
- openapi/aemo-reallocations-v1-openapi.yml
- openapi/aemo-report-v1-openapi.yml
- openapi/aemo-rtms-external-v1-openapi.yml
- openapi/aemo-selfForecast-v1-openapi.yml
- openapi/aemo-settlementDirect-v1-openapi.yml
- openapi/aemo-submission-v1-openapi.yml
- openapi/aemo-system-management-reports-v2-1-openapi.yml
- openapi/aemo-system-management-reports-v2-2-openapi.yml
- openapi/aemo-system-management-reports-v2-3-openapi.yml
- openapi/aemo-system-management-reports-v2-4-openapi.yml
- openapi/aemo-system-management-reports-v2-5-openapi.yml
- openapi/aemo-system-management-reports-v2-6-openapi.yml
- openapi/aemo-system-management-reports-v2-openapi.yml
- openapi/aemo-tls-certificate-mgmt-v1-openapi.yml
- openapi/aemo-variableparameter-v1-openapi.yml
- openapi/aemo-wemde-dispatchcase-external-v1-openapi.yml
- openapi/aemo-wemde-dispatchcase-external-v2-openapi.yml
- openapi/aemo-wemde-dispatchinstruction-external-v1-openapi.yml
- openapi/aemo-wemde-dispatchsolution-external-v1-openapi.yml
- openapi/aemo-wemde-dispatchsolution-external-v2-openapi.yml
- openapi/aemo-wemde-dispatchsummary-external-v1-openapi.yml
- openapi/aemo-wemde-dspdispatchinstruction-external-v1-openapi.yml
- openapi/aemo-wemde-ncess-external-v1-openapi.yml
- openapi/aemo-wemde-notinservicecapacity-external-v1-openapi.yml
- openapi/aemo-wemde-referencetradingprice-external-v1-openapi.yml
- openapi/aemo-wemde-tradingdayreport-external-v1-openapi.yml
- name: apiKeyHeader
type: apiKey
in: header
parameter: x-eHub-APIKey
sources:
- openapi/aemo-b2bmessaging-async-v1-openapi.yml
- openapi/aemo-b2bmessaging-pull-v1-openapi.yml
- openapi/aemo-b2bmessaging-sync-v1-openapi.yml
- openapi/aemo-hubmsgmgt-v1-openapi.yml
- openapi/aemo-p2pmessaging-sync-v1-openapi.yml
- name: apiKeyHeader
type: apiKey
in: header
parameter: x-apikey
sources:
- openapi/aemo-b2mmessaging-sync-v1-openapi.yml
- openapi/aemo-bidding-v1-openapi.yml
- openapi/aemo-der-business-registration-v1-openapi.yml
- openapi/aemo-der-register-installation-v2-openapi.yml
- openapi/aemo-der-register-nmi-v1-openapi.yml
- openapi/aemo-hubmsgmgt-v2-openapi.yml
- openapi/aemo-oauth-v1-openapi.yml
- name: apiKeyHeader
type: apiKey
in: header
parameter: client_id
sources:
- openapi/aemo-der-consumer-registration-v1-openapi.yml
- name: apiKeyQuery
type: apiKey
in: query
parameter: clientId
sources:
- openapi/aemo-der-consumer-registration-v1-openapi.yml
- name: apiKeyHeader
type: apiKey
in: header
parameter: X-DC-DEVKEY
sources:
- openapi/aemo-gasbb-reporting-public-data-openapi.yml
- name: apiKeyHeader
type: apiKey
in: header
parameter: x-aemo-api-key
sources:
- openapi/aemo-tls-certificate-mgmt-v1-openapi.yml
docs: https://dev.aemo.com.au/working-with-aemo-apis
description: 'AEMO fronts its participant APIs with Azure API Management (dev.aemo.com.au / api.aemo.com.au). Every
published OpenAPI declares an APIM subscription key as an apiKey security scheme, in a header (Ocp-Apim-Subscription-Key,
x-apikey, x-eHub-APIKey, x-aemo-api-key, X-DC-DEVKEY, client_id) or in the subscription-key / clientId query parameter.
The subscription key is only the gateway credential: most operations additionally require an AEMO-signed TLS client
certificate (mutual TLS to the e-Hub gateway) and a caller identity - either URM (User Rights Management) username/password
sent as HTTP Basic in the Authorization header, or an OAuth 2.0 client_credentials bearer token issued by api.aemo.com.au.
The DER Register consumer registration API uses an Azure AD B2C OpenID Connect provider instead.'
models:
- id: apim-subscription-key
name: APIM subscription key
type: apiKey
description: Azure API Management subscription key issued per participant/product after formal onboarding. Sent
in a header or the subscription-key query parameter. Required by the gateway; not sufficient on its own for
most APIs.
docs: https://dev.aemo.com.au/faqs
required: gateway
- id: tls-client-certificate
name: AEMO-signed TLS client certificate
type: mutualTLS
description: Participants present an AEMO-signed TLS client certificate to the e-Hub API gateway. Certificates
are self-managed through the TLS Certificate Management API (list, download, generate, reissue, renew, revoke).
docs: https://dev.aemo.com.au/working-with-aemo-apis
self_service_api: openapi/aemo-tls-certificate-mgmt-v1-openapi.yml
- id: urm-basic
name: URM username and password (HTTP Basic)
type: http
scheme: basic
description: AEMO User Rights Management credentials, base64 encoded and sent in the Authorization header. Operation-level
permissions are granted by the participant administrator in MSATS; an insufficiently privileged user receives
HTTP 422.
docs: https://dev.aemo.com.au/urm-username-password
- id: oauth2-client-credentials
name: OAuth 2.0 client credentials
type: oauth2
flow: clientCredentials
description: API key and secret are sent as an HTTP Basic Authorization header to the token endpoint with grant_type=client_credentials.
The response returns a JWT access_token and access_token_expires_in (3599 seconds observed in the published
example). No scopes are documented.
docs: https://dev.aemo.com.au/oauth
token_url: https://api.aemo.com.au/oauth/v1/token?grant_type=client_credentials
preproduction_token_url: https://api.preprod.wgw.aemo.com.au/oauth/v1/token?grant_type=client_credentials
token_format: JWT
token_lifetime_seconds: 3599
- id: azure-ad-b2c-oidc
name: Azure AD B2C OpenID Connect (DER Register consumer registration)
type: openIdConnect
description: The DER Register consumer/installer registration API authenticates end users through an Azure AD
B2C user flow. Discovery document harvested to well-known/aemo-derr-openid-configuration.json.
issuer: https://login.aemo.com.au/51b4c181-bc43-439c-8cd4-a3249e0c7f2b/v2.0/
discovery: https://login.aemo.com.au/login.aemo.com.au/v2.0/.well-known/openid-configuration?p=B2C_1A_DERR_SIGNUPSIGNIN
authorization_url: https://login.aemo.com.au/login.aemo.com.au/oauth2/v2.0/authorize?p=b2c_1a_derr_signupsignin
token_url: https://login.aemo.com.au/login.aemo.com.au/oauth2/v2.0/token?p=b2c_1a_derr_signupsignin
jwks_uri: https://login.aemo.com.au/login.aemo.com.au/discovery/v2.0/keys?p=b2c_1a_derr_signupsignin
scopes:
- openid
- offline_access
artifact: well-known/aemo-derr-openid-configuration.json
identity_headers:
- name: X-initiatingParticipantID
description: The AEMO participant ID initiating the request (e.g. P01). Required on most e-Hub operations.
- name: X-market
description: The market the request applies to (e.g. NEM). Required on most e-Hub operations.
- name: Authorization
description: HTTP Basic (URM username:password) or Bearer (OAuth 2.0 access token), depending on the API.
onboarding:
summary: Most AEMO APIs are restricted to authorised market participants. A developer account can be created at
any time, but subscription keys are only issued after formal onboarding to the specific API or product, confirmed
by email from AEMO Support.
registration: https://aemo.com.au/energy-systems/registration
sign_up: https://dev.aemo.com.au/signup
faq: https://dev.aemo.com.au/faqs
public_surfaces:
- name: AEMO NEM Data Dashboard API
auth: none
baseURL: https://visualisations.aemo.com.au/aemo/apps/api/report
note: Anonymous. Undocumented, and disallowed for crawlers in https://aemo.com.au/robots.txt.
- name: NEMWeb public data feed
auth: none
baseURL: https://nemweb.com.au/Reports
- name: WA market data public feed
auth: none
baseURL: https://data.wa.aemo.com.au/public