Defence Bank · Authentication Profile

Defence Bank Authentication

Authentication

The Consumer Data Standards banking spec published for Defence Bank declares no inline OpenAPI securitySchemes, because authentication in the CDR is split by endpoint class. This profile is captured from the CDS security profile and the provider's open banking documentation.

Defence Bank secures its APIs with none, oauth2, openIdConnect, and mutualTLS across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode-hybrid flow(s).

FinancialBanksOpen BankingCDRConsumer BankingAustraliaMutual BankProduct Reference Data
Methods: none, oauth2, openIdConnect, mutualTLS Schemes: 2 OAuth flows: authorizationCode-hybrid API key in:

Security Schemes

CDR-FAPI-OAuth2 oauth2
scheme: authorizationCode
MTLS mutualTLS

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-20'
method: searched
source: openapi/defence-bank-cds-banking-products-openapi.yml
docs: https://consumerdatastandardsaustralia.github.io/standards/#security-profile
description: >-
  The Consumer Data Standards banking spec published for Defence Bank declares no
  inline OpenAPI securitySchemes, because authentication in the CDR is split by
  endpoint class. This profile is captured from the CDS security profile and the
  provider's open banking documentation.
summary:
  types: [none, oauth2, openIdConnect, mutualTLS]
  api_key_in: []
  oauth2_flows: [authorizationCode-hybrid]
tiers:
- tier: product-reference-data
  auth: none
  description: >-
    The Product Reference Data (PRD) endpoints (/banking/products and
    /banking/products/{productId}) are public and unauthenticated. Confirmed live:
    GET https://product.defencebank.com.au/cds-au/v1/banking/products with header
    x-v: 4 returns HTTP 200. No credentials, API key, or token are required.
  operations: [listBankingProducts, getBankingProductDetail]
- tier: consumer-data-sharing
  auth: cdr-fapi
  description: >-
    All account/transaction/balance/direct-debit/scheduled-payment/payee endpoints
    require the CDR FAPI security profile: OAuth2 authorization-code (OIDC hybrid)
    with the consumer's consent, mutual-TLS-bound access tokens, request-object
    signing, and the x-fapi-interaction-id / x-fapi-auth-date headers. Only
    Accredited Data Recipients (ADRs) registered on the CDR Register can obtain
    tokens. Access is scoped by CDR authorization scopes (see scopes/).
  scopes: [bank:accounts.basic:read, bank:accounts.detail:read, bank:transactions:read, bank:regular_payments:read, bank:payees:read]
schemes:
- name: CDR-FAPI-OAuth2
  type: oauth2
  scheme: authorizationCode
  profile: FAPI (MTLS-bound tokens, OIDC hybrid, PAR)
  applies_to: consumer-data-sharing endpoints
  sources: [Consumer Data Standards security profile]
- name: MTLS
  type: mutualTLS
  applies_to: consumer-data-sharing endpoints (token binding + holder-of-key)
  sources: [Consumer Data Standards security profile]