Corelogic Au Authentication

generated: '2026-07-26'
method: searched
source: >-
  https://developer.corelogic.asia/guides/api-authentication (guide text compiled into the portal
  bundle main.aefa4bad.js), https://auth.corelogic.asia/.well-known/openid-configuration,
  collections/corelogic-au-sample-sandbox.postman_collection.json,
  collections/corelogic-au-rp-inside-auth-example.postman_collection.json
docs: https://developer.corelogic.asia/guides/api-authentication
summary:
  types: [oauth2, openIdConnect, http]
  api_key_in: []
  oauth2_flows: [clientCredentials, authorizationCode, refreshToken]
  transport: HTTPS only, TLSv1.2 minimum
  token_format: JWT
  authorization_model: >-
    Claim-based, not scope-based. The client_credentials tokens the vendor publishes in its own
    sample collection carry scope "openid" only; entitlement is carried in JWT claims (roles,
    geo_codes, authorities) provisioned against the commercial licence, so there is no data-product
    scope surface to request.
verbatim:
- >-
  "Our APIs use the OAuth 2.0 protocol to enable applications to request our client credential token
  using Client ID and Client Secret."
- >-
  "The Access Token response is a JSON Web Token (JWT) and may be decoded to obtain expiry time (a
  Unix epoch timestamp) so that you know when to refresh the access token. Each grant_type token
  expiry is subject to change without notice."
- '"All API requests must be made over HTTPS, with TLSv1.2 minimum."'
- '"API requests without a valid Authorization header will fail."'
- '"OAuth2 supported grant types: client_credentials, authorization_code, refresh_token."'
schemes:
- name: CotalityOAuth2ClientCredentials
  type: oauth2
  flow: clientCredentials
  client_authentication: HTTP Basic — base64(client_id:client_secret) in the Authorization header
  token_urls:
  - https://access.api.cotality.com.au/as/token.oauth2
  - https://access.api.cotality.com.au/oauth/token
  sandbox_token_url: https://api-sbox.corelogic.asia/access/as/token.oauth2
  legacy_token_url: https://api.corelogic.asia/access/oauth/token
  uat_token_url: https://access.api-uat.cotality.com.au
  token_format: JWT
  scopes_requested: [openid]
  applies_to: every Cotality Australia / New Zealand data API
  sources:
  - collections/corelogic-au-sample-sandbox.postman_collection.json
  - https://developer.corelogic.asia/guides/api-authentication
- name: CotalityOAuth2AuthorizationCode
  type: oauth2
  flow: authorizationCode
  purpose: >-
    RP.Inside silent login / deep linking — obtains a USER token so an integrating platform can
    redirect a subscriber into RP Data or Property Guru without a second login. The portal is
    explicit that this is "not an authentication method for APIs. It is designed for user-level
    access and redirection, not for backend API integration."
  endpoints:
    authorize: https://access-uat-api.corelogic.asia/access/oauth/authorize
    login: https://access-uat-api.corelogic.asia/access/login
    token: https://access-uat-api.corelogic.asia/access/oauth/token
    userinfo: https://access-uat-api.corelogic.asia/access/userinfo
    logout: https://access-uat-api.corelogic.asia/access/logout
  sources:
  - collections/corelogic-au-rp-inside-auth-example.postman_collection.json
  - https://developer.corelogic.asia/guides/application-silent-login
- name: CotalityOAuth2RefreshToken
  type: oauth2
  flow: refreshToken
  note: >-
    The portal recommends securely caching the token and refreshing prior to expiry, decoding the
    JWT exp claim rather than assuming a fixed lifetime.
  sources: [https://developer.corelogic.asia/guides/api-authentication]
- name: CotalityDeveloperPortalOIDC
  type: openIdConnect
  openIdConnectUrl: https://auth.corelogic.asia/.well-known/openid-configuration
  issuer: https://auth.corelogic.asia
  vendor: PingFederate (Ping Identity)
  purpose: >-
    Human login to the Cotality Developer Portal — NOT the data-API auth path. Scopes here are
    portal identity scopes only.
  endpoints:
    authorization: https://auth.corelogic.asia/as/authorization.oauth2
    token: https://auth.corelogic.asia/as/token.oauth2
    userinfo: https://auth.corelogic.asia/idp/userinfo.openid
    jwks: https://auth.corelogic.asia/pf/JWKS
    registration: https://auth.corelogic.asia/as/clients.oauth2
    revocation: https://auth.corelogic.asia/as/revoke_token.oauth2
    introspection: https://auth.corelogic.asia/as/introspect.oauth2
    end_session: https://auth.corelogic.asia/idp/init_logout.openid
    device_authorization: https://auth.corelogic.asia/as/device_authz.oauth2
    backchannel_authentication: https://auth.corelogic.asia/as/bc-auth.ciba
  pkce_methods: [plain, S256]
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  - client_secret_jwt
  - private_key_jwt
  - tls_client_auth
  - none
  claims_supported:
  - email
  - family_name
  - fax_number
  - given_name
  - mobile_number
  - personal_email
  - phone_number
  - sub
  - title
  - user_roles
  - username
  sources: [well-known/corelogic-au-openid-configuration.json]
- name: SSO (SAML)
  type: saml2
  purpose: >-
    Application single sign-on for Cotality end-user products. The portal states plainly: "SSO is
    not an authentication method for APIs. It is intended for user login flows and session
    management." Not all applications support it yet.
  sources: [https://developer.corelogic.asia/guides/application-silent-login]
credential_lifecycle:
  self_serve_sandbox_client: https://developer.corelogic.asia/apps/create
  rotate_secret: Portal "Reset Client Secret" action on the sandbox client
  revoke_client: Portal "Remove Client" action
  support: api.support@corelogic.com
  production_credentials: >-
    Not self-serve. Production and UAT credentials are provisioned only after a Cotality commercial
    data licence is signed; the portal FAQ says an integration representative contacts the signup
    to discuss pricing and provisioning a full-access paid service plan.
environment_binding: >-
  Tokens are environment-bound. The portal FAQ documents the error "Invalid token provided." with
  the explanation that a token generated in UAT can only be used to make subsequent calls in UAT.
  A sandbox client calling UAT or production returns 401 "Restricted environment access denied."