Australian Unity Bank · Authentication Profile

Australian Unity Bank Authentication

Authentication

Australian Unity Bank secures its APIs with oauth2, openIdConnect, and mutualTLS across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode and hybrid flow(s).

FinancialBanksOpen BankingCDRConsumer BankingAustraliaMutualProduct Reference Data
Methods: oauth2, openIdConnect, mutualTLS Schemes: 3 OAuth flows: authorizationCode, hybrid API key in:

Security Schemes

CDR-Security-Profile openIdConnect
mTLS mutualTLS
PublicPRD none

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-21'
method: searched
source: https://consumerdatastandardsaustralia.github.io/standards/#security-profile
docs: https://consumerdatastandardsaustralia.github.io/standards/#security-profile
notes: >-
  The harvested CDS Banking OpenAPI (v1.36.0) declares no securitySchemes because
  the CDR authorization model lives in the separate DSB InfoSec / Security Profile.
  Australian Unity Bank, as a CDR data holder, implements that shared profile.
  Product Reference Data (products) endpoints are public/unauthenticated; all
  consumer-data endpoints require the full CDR security profile.
summary:
  types: [oauth2, openIdConnect, mutualTLS]
  public_endpoints: [listBankingProducts, getBankingProductDetail]
  oauth2_flows: [authorizationCode, hybrid]
schemes:
  - name: CDR-Security-Profile
    type: openIdConnect
    profile: FAPI 1.0 Advanced
    features:
      - private_key_jwt client authentication
      - Pushed Authorization Requests (PAR)
      - PKCE
      - request objects signed (JARM/signed responses)
      - mutual TLS sender-constrained access tokens
      - CDR Register trust framework (ADR accreditation + SSA)
    authorizationServer: https://open-banking.australianunity.com.au (OIDC discovery geo/WAF-gated; HTTP 403 to non-AU probe 2026-07-21)
    scopes_ref: scopes/australian-unity-bank-scopes.yml
  - name: mTLS
    type: mutualTLS
    description: Mutual TLS is required on token and resource endpoints; access tokens are sender-constrained (holder-of-key).
  - name: PublicPRD
    type: none
    description: Product Reference Data endpoints are public and require no credentials.
    operations: [listBankingProducts, getBankingProductDetail]