Gc Mutual Bank Authentication

generated: '2026-07-20'
method: searched
source: https://consumerdatastandardsaustralia.github.io/standards/#security-profile
docs: https://unity.bank/about-us/corporate-information/open-banking/
note: >-
  The harvested OpenAPI (shared DSB CDS CDR Banking API) declares no
  components.securitySchemes, so no profile could be derived mechanically. This
  profile is documented from the DSB Consumer Data Standards, which define the
  auth model G&C Mutual Bank implements as a CDR Data Holder.
summary:
  types: [none, oauth2, openIdConnect, mutualTLS]
  surfaces:
    public_product_reference_data: none
    consumer_data: oauth2 + openIdConnect + mutualTLS (FAPI)
schemes:
  - name: PublicProductReferenceData
    type: none
    applies_to:
      - GET /banking/products
      - GET /banking/products/{productId}
    description: >-
      Product Reference Data is public and unauthenticated per CDR rules. No API
      key, token, or client registration is required. Only the x-v version header
      is mandatory. Confirmed live returning HTTP 200.
  - name: CDRConsumerDataAccess
    type: oauth2
    profile: FAPI 1.0 Advanced
    flows:
      - flow: authorizationCode
        grant: OIDC hybrid (code id_token)
        features:
          - PAR (Pushed Authorization Requests)
          - request object (signed)
          - private_key_jwt or mutual-TLS client authentication
          - PKCE
    applies_to: consumer data (accounts, balances, transactions, direct-debits, scheduled-payments, payees)
    gating: Restricted to Accredited Data Recipients (ADRs) with active consumer consent under the CDR.
    description: >-
      Consumer data is gated to accredited data recipients via the CDR InfoSec
      profile: OAuth2 authorization-code + OIDC with holder-of-key mutual-TLS
      tokens and consumer consent. Not exercised on the public PRD surface.
  - name: MutualTLS
    type: mutualTLS
    applies_to: consumer data token and resource endpoints
    description: Holder-of-key sender-constrained access tokens over mutual TLS per CDR InfoSec.