Qudos Bank · Authentication Profile

Qudos Bank Authentication

Authentication

Qudos Bank secures its APIs with none, oauth2, openIdConnect, and mutualTLS across 2 declared security schemes, as derived from its OpenAPI definitions.

FinancialBanksOpen BankingCDRConsumer BankingAustraliaCustomer OwnedMutual BankProduct Reference Data

Methods: none, oauth2, openIdConnect, mutualTLS Schemes: 2 OAuth flows: API key in:

Security Schemes

none-public-prd none

cdr-fapi oauth2

Source

Authentication Profile

generated: '2026-07-20'
method: searched
source: >-
  https://www.qudosbank.com.au/support/open-banking +
  https://consumerdatastandardsaustralia.github.io/standards/
docs: https://www.qudosbank.com.au/support/open-banking
summary:
  types: [none, oauth2, openIdConnect, mutualTLS]
  public_prd: unauthenticated
  data_sharing: fapi-2.0
surfaces:
- name: Product Reference Data (PRD)
  operations: [listBankingProducts, getBankingProductDetail]
  auth: none
  description: >-
    Public, unauthenticated. No API key, token, or client certificate required.
    Requests must send the x-v version header. Confirmed live returning HTTP 200
    at https://public.cdr.qudosbank.com.au/cds-au/v1/banking/products.
- name: CDR consumer data sharing
  operations: [listBankingAccounts, getBankingAccountDetail, listBankingTransactions, getBankingBalance, listDirectDebits, listScheduledPayments, listBankingPayees]
  auth: oauth2 + openIdConnect over mutualTLS (FAPI 2.0)
  description: >-
    The account/transaction/payments/payees operations require CDR consumer data
    sharing authorization: an accredited data recipient (ACCC-accredited) obtains
    the customer's consent via OAuth 2.0 authorization code flow with OpenID
    Connect, PKCE/PAR, and mutual TLS client authentication under the Data
    Standards Body FAPI security profile. Discovery and trust is brokered by the
    ACCC CDR Register, not a per-holder /.well-known/openid-configuration.
  register: https://consumerdatastandardsaustralia.github.io/register/
schemes:
- name: none-public-prd
  type: none
  applies_to: [listBankingProducts, getBankingProductDetail]
- name: cdr-fapi
  type: oauth2
  flow: authorizationCode
  profile: FAPI 2.0
  transport: mutualTLS
  applies_to: cdr-consumer-data-sharing
notes: >-
  The harvested OpenAPI declares no components.securitySchemes because the
  public PRD subset is unauthenticated by CDR mandate; the FAPI-secured data
  sharing surface is governed by the CDR Register and Data Standards rather than
  inline OpenAPI security schemes.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/qudos-bank-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.