Suncorp Bank · Authentication Profile

Suncorp Bank Authentication

Authentication

Suncorp Bank secures its APIs with none, oauth2, openIdConnect, and mutualTLS across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, and refreshToken flow(s).

FinancialBanksOpen BankingCDRConsumer BankingAustraliaProduct Reference DataConsumer Data Right
Methods: none, oauth2, openIdConnect, mutualTLS Schemes: 2 OAuth flows: authorizationCode, clientCredentials, refreshToken API key in:

Security Schemes

CDR OpenID Connect openIdConnect
mutualTLS mutualTLS

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-20'
method: searched
source: >-
  https://id-ob.suncorpbank.com.au/.well-known/openid-configuration (live OIDC
  discovery, fetched 2026-07-20) + Suncorp Bank open-banking docs
docs: https://www.suncorpbank.com.au/help-support/open-banking.html
summary:
  model: two-tier CDR (Consumer Data Right)
  types: [none, oauth2, openIdConnect, mutualTLS]
  oauth2_flows: [authorizationCode, clientCredentials, refreshToken]
  api_key_in: []
  notes: >-
    The public Product Reference Data (PRD) API is UNAUTHENTICATED (no API key,
    no token). All consumer-data endpoints require CDR-accredited access under a
    FAPI 2.0 security profile.
tiers:
- name: Public Product Reference Data (PRD)
  auth: none
  scope: unauthenticated
  hosts: [https://id-ob.suncorpbank.com.au/cds-au/v1]
  operations: [listBankingProducts, getBankingProductDetail]
  evidence: openapi/suncorp-bank-cds-banking-products-openapi.yml (product paths declare no security)
- name: CDR consumer data sharing (accredited)
  auth: oauth2 + openIdConnect + mutualTLS
  scope: CDR Accredited Data Recipient (ADR) only — not openly consumable
  profile: FAPI 2.0 / CDR security profile
  issuer: https://id-ob.suncorpbank.com.au
schemes:
- name: CDR OpenID Connect
  type: openIdConnect
  openIdConnectUrl: https://id-ob.suncorpbank.com.au/.well-known/openid-configuration
  issuer: https://id-ob.suncorpbank.com.au
  authorization_endpoint: https://id-ob.suncorpbank.com.au/authorize
  token_endpoint: https://secure-id-ob.suncorpbank.com.au/token
  pushed_authorization_request_endpoint: https://secure-id-ob.suncorpbank.com.au/par
  registration_endpoint: https://secure-id-ob.suncorpbank.com.au/register
  jwks_uri: https://id-ob.suncorpbank.com.au/jwks
  grant_types_supported: [authorization_code, client_credentials, refresh_token]
  response_types_supported: ["code id_token", "code"]
  token_endpoint_auth_methods_supported: [private_key_jwt]
  require_pushed_authorization_requests: true
  code_challenge_methods_supported: [S256]
  id_token_signing_alg_values_supported: [PS256]
  tls_client_certificate_bound_access_tokens: true
  acr_values_supported: ["urn:cds.au:cdr:2", "urn:cds.au:cdr:3"]
  subject_types_supported: [pairwise]
  cdr_arrangement_revocation_endpoint: https://secure-id-ob.suncorpbank.com.au/arrangements/revoke
  sources: [well-known/suncorp-bank-openid-configuration.json]
- name: mutualTLS
  type: mutualTLS
  note: Access tokens are TLS client-certificate bound (holder-of-key), per CDR/FAPI.
  sources: [well-known/suncorp-bank-openid-configuration.json]
contact: openbanking@suncorpbank.com.au
scopes_ref: scopes/suncorp-bank-scopes.yml

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/suncorp-bank-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.