Defence Bank · Authentication Profile

Defence Bank Authentication

Authentication

The Consumer Data Standards banking spec published for Defence Bank declares no inline OpenAPI securitySchemes, because authentication in the CDR is split by endpoint class. This profile is captured from the CDS security profile and the provider's open banking documentation.

Defence Bank secures its APIs with none, oauth2, openIdConnect, and mutualTLS across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode-hybrid flow(s).

FinancialBanksOpen BankingCDRConsumer BankingAustraliaMutual BankProduct Reference Data
Methods: none, oauth2, openIdConnect, mutualTLS Schemes: 2 OAuth flows: authorizationCode-hybrid API key in:

Security Schemes

CDR-FAPI-OAuth2 oauth2
scheme: authorizationCode
MTLS mutualTLS

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-20'
method: searched
source: openapi/defence-bank-cds-banking-products-openapi.yml
docs: https://consumerdatastandardsaustralia.github.io/standards/#security-profile
description: >-
  The Consumer Data Standards banking spec published for Defence Bank declares no
  inline OpenAPI securitySchemes, because authentication in the CDR is split by
  endpoint class. This profile is captured from the CDS security profile and the
  provider's open banking documentation.
summary:
  types: [none, oauth2, openIdConnect, mutualTLS]
  api_key_in: []
  oauth2_flows: [authorizationCode-hybrid]
tiers:
- tier: product-reference-data
  auth: none
  description: >-
    The Product Reference Data (PRD) endpoints (/banking/products and
    /banking/products/{productId}) are public and unauthenticated. Confirmed live:
    GET https://product.defencebank.com.au/cds-au/v1/banking/products with header
    x-v: 4 returns HTTP 200. No credentials, API key, or token are required.
  operations: [listBankingProducts, getBankingProductDetail]
- tier: consumer-data-sharing
  auth: cdr-fapi
  description: >-
    All account/transaction/balance/direct-debit/scheduled-payment/payee endpoints
    require the CDR FAPI security profile: OAuth2 authorization-code (OIDC hybrid)
    with the consumer's consent, mutual-TLS-bound access tokens, request-object
    signing, and the x-fapi-interaction-id / x-fapi-auth-date headers. Only
    Accredited Data Recipients (ADRs) registered on the CDR Register can obtain
    tokens. Access is scoped by CDR authorization scopes (see scopes/).
  scopes: [bank:accounts.basic:read, bank:accounts.detail:read, bank:transactions:read, bank:regular_payments:read, bank:payees:read]
schemes:
- name: CDR-FAPI-OAuth2
  type: oauth2
  scheme: authorizationCode
  profile: FAPI (MTLS-bound tokens, OIDC hybrid, PAR)
  applies_to: consumer-data-sharing endpoints
  sources: [Consumer Data Standards security profile]
- name: MTLS
  type: mutualTLS
  applies_to: consumer-data-sharing endpoints (token binding + holder-of-key)
  sources: [Consumer Data Standards security profile]

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/defence-bank-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.