Nib Health Funds Authentication

generated: '2026-07-25'
method: searched
source: https://id.nib.com.au/.well-known/openid-configuration
docs: https://id.nib.com.au/.well-known/openid-configuration
note: |
  nib publishes no OpenAPI, so this profile is not derived from a spec. It is
  read verbatim from the anonymously-readable OpenID Connect discovery
  documents of nib's Auth0 member identity tenants (Australia and New Zealand),
  plus live probes of the first-party API gateway.

  Scope: this is CONSUMER SIGN-IN identity, not a partner/product API
  authorization surface. No product, policy, claims, or partner scopes are
  published anywhere. Provider-side (healthcare practitioner) access to nib is
  a username/password portal login at the nib HCP portal, and electronic
  claiming runs over third-party HICAPS and HealthPoint terminals.
summary:
  types: [oauth2, openIdConnect]
  api_key_in: []
  oauth2_flows: [authorizationCode, clientCredentials, implicit, password, deviceCode,
    tokenExchange, jwtBearer]
  product_api_auth: undocumented
schemes:
- name: nib Australia member identity (Auth0 OIDC)
  type: openIdConnect
  issuer: https://id.nib.com.au/
  openIdConnectUrl: https://id.nib.com.au/.well-known/openid-configuration
  discovery_status: 200
  sources: [well-known/nib-health-funds-openid-configuration.json]
  endpoints:
    authorization: https://id.nib.com.au/authorize
    token: https://id.nib.com.au/oauth/token
    userinfo: https://id.nib.com.au/userinfo
    revocation: https://id.nib.com.au/oauth/revoke
    registration: https://id.nib.com.au/oidc/register
    device_authorization: https://id.nib.com.au/oauth/device/code
    backchannel_authentication: https://id.nib.com.au/bc-authorize
    mfa_challenge: https://id.nib.com.au/mfa/challenge
    jwks: https://id.nib.com.au/.well-known/jwks.json
    global_token_revocation: https://id.nib.com.au/oauth/global-token-revocation/connection/{connectionName}
  grant_types_supported:
  - client_credentials
  - authorization_code
  - refresh_token
  - password
  - implicit
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  - http://auth0.com/oauth/grant-type/password-realm
  - http://auth0.com/oauth/grant-type/passwordless/otp
  - http://auth0.com/oauth/grant-type/mfa-oob
  - http://auth0.com/oauth/grant-type/mfa-otp
  - http://auth0.com/oauth/grant-type/mfa-recovery-code
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  response_types_supported: [code, token, id_token, code token, code id_token, token
      id_token, code token id_token]
  response_modes_supported: [query, fragment, form_post]
  token_endpoint_auth_methods_supported: [client_secret_basic, client_secret_post,
    private_key_jwt, none]
  token_endpoint_auth_signing_alg_values_supported: [RS256, RS384, PS256]
  id_token_signing_alg_values_supported: [HS256, RS256, PS256]
  code_challenge_methods_supported: [S256, plain]
  dpop_signing_alg_values_supported: [ES256]
  subject_types_supported: [public]
  backchannel_logout_supported: true
  backchannel_token_delivery_modes_supported: [poll]
  request_parameter_supported: false
  request_uri_parameter_supported: false
  claims_supported: [aud, auth_time, created_at, email, email_verified, exp, family_name,
    given_name, iat, identities, iss, name, nickname, phone_number, picture, sub]
  jwks:
    file: well-known/nib-health-funds-jwks.json
    keys: 2
    algs: [RS256]
- name: nib New Zealand member identity (Auth0 OIDC)
  type: openIdConnect
  issuer: https://id.nib.co.nz/
  openIdConnectUrl: https://id.nib.co.nz/.well-known/openid-configuration
  discovery_status: 200
  sources: [well-known/nib-health-funds-nz-openid-configuration.json]
  note: Same Auth0 shape and same identity-only scope set as the Australian tenant.
- name: nib API gateway (undocumented)
  type: unknown
  host: https://api-gateway.nib.com.au
  sources: [review.yml]
  note: |
    Real first-party AWS API Gateway named in nib's own Content-Security-Policy.
    Anonymous requests to /, /openapi.json, /swagger.json, /docs, /graphql and
    every /.well-known/ path return HTTP 403 {"message":"Forbidden"}. No
    WWW-Authenticate challenge, no auth metadata, no public documentation, so
    the credential model cannot be determined without a partner agreement.
probes:
- url: https://id.nib.com.au/.well-known/openid-configuration
  status: 200
- url: https://id.nib.com.au/.well-known/oauth-authorization-server
  status: 200
- url: https://id.nib.com.au/.well-known/jwks.json
  status: 200
- url: https://id.nib.com.au/userinfo
  status: 401
  note: Anonymous request rejected — confirms a live protected resource.
- url: https://id.nib.com.au/oauth/token
  status: 401
  note: Anonymous POST rejected.
- url: https://id.nib.co.nz/.well-known/openid-configuration
  status: 200
- url: https://api-gateway.nib.com.au/.well-known/oauth-protected-resource
  status: 403
related:
  scopes: scopes/nib-health-funds-scopes.yml
  well_known: well-known/nib-health-funds-well-known.yml
  conformance: conformance/nib-health-funds-conformance.yml