NAV Navbar

Introduction

These standards have been developed as part of the Australian Government's introduction of the Consumer Data Right legislation to give Australians greater control over their data.

The Consumer Data Right (CDR) is intended to be applied sector by sector across the whole economy, beginning in the banking, energy and telecommunications sectors. These standards have been developed to facilitate the Consumer Data Right by acting as a specific baseline for implementation.

These standards are maintained by the Data Standards Body (DSB), with the Data Standards Chair as the decision maker. The DSB is part of the Treasury. The work of standards development is conducted in consultation with the Australian Competition and Consumer Commission (ACCC) as co-regulator of the Consumer Data Right, along with the Office of the Australian Information Commissioner (OAIC).

The standards are required to be published. The obligations on CDR participants to apply the published standards commence on the commencement of the Consumer Data Right rules:

Version

These standards represent version 1.14.0 of the high level standards. See the versioning section for more information on how versions are managed in the standard.

Interpretation

Note that, in these standards, the key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL are to be interpreted as described in RFC2119.

Future Dated Obligations

The standards, as published from time to time, may include specific statements indicating that a specific section of the standards will not take effect until a future date or may cease to have effect on some future date.

The table below highlights these areas of the standards.

Section Description Applicable Date
Get Product Detail V2 Data holders may obsolete version 2 of this end point from May 31st 2021. Data recipients must upgrade their implementations to use version 3 by this time May 31st 2021
Get Products V2 Data holders may obsolete version 2 of this end point from May 31st 2021. Data recipients must upgrade their implementations to use version 3 by this time May 31st 2021
Get Metrics V1 Data holders may obsolete version 1 of this end point from October 31st 2021. Data Holders who go live with consumer data sharing from July 1st 2021 MAY go live with only Get Metrics v2 support. The CDR Register must upgrade their implementation to use version 2 by this time October 31st 2021
Get Metrics V2 Version 2 of this end point must be made available by affected data holders by the end of July 2021 July 31st 2021
Get Customer V1 Data Holders providing valid ANZSIC and ANZSCO codes whose version is not ANZSIC_1292.0_2006_V2.0 and ANZSCO_1220.0_2013_V1.2 respectively must supply the appropriate version enumeration no later than July 1st 2021. The version codes allow data holders to reference the applicable document versions for the codes they hold. July 1st 2021
Banking Term Deposit Account Types Data Holders who support maturity instructions for term deposits whereby funds are held in a facility or similar mechanism upon maturity must update relevant product data no later than July 1st 2021 July 1st 2021
Amending Consent Data Holders MUST implement the following standards from November 1st 2021 when a CDR consumer is invited to amend a current authorisation as per rule 4.22A and the ADR has supplied a cdr_arrangement_id November 1st 2021
Standard Error Codes Data Recipients and Data Holders MAY implement the standard error codes from July 1st 2021 July 1st 2021
Standard Error Codes Data Recipients and Data Holders MUST implement the standard error codes from February 1st 2022 February 1st 2022
Standard Error Codes Data Holders MAY retire application-specific error codes in favour of standard error codes from November 1st 2022 November 1st 2022
CX Standards: Unavailable Accounts Data Holders MAY implement the following data standards effective from 1 November 2021:
  • Unavailable Accounts: No accounts can be shown
  • Unavailable Accounts: Authorisation not permitted
  • Unavailable Accounts: Request sharing rights
November 1st 2021
Get Metrics V3 Version 3 of this end point must be made available by affected data holders by October 1st 2022 October 1st 2022
Get Metrics V2 Data holders may obsolete version 2 of this end point from December 5th 2022. Data Holders in the energy sector MAY go live with only Get Metrics v3 support. The CDR Register must upgrade their implementation to use version 3 by this time December 5th 2022
CX Standards: Withdrawals Data Holders MUST implement the following data standards effective from 1 February 2022:
  • Withdrawal: Secondary User Instruction
February 1st 2022

Endpoint Version Schedule

A table-view of all endpoint versioning is available here.

High Level Standards

This section contains components of the standards that are foundational and generally applicable.

Principles

The following principles, classified as Outcome Principles and Technical Principles, are the basis for the development of the standards for the Consumer Data Right.

Outcome Principles

These principles articulate qualitative outcomes that the API definitions should seek to deliver.

Outcome Principle 1: APIs are secure

The API definitions will consider and incorporate the need for a high degree of security to protect customer data. This includes the risk of technical breach but also additional concerns of inadvertent data leakage through overly broad data payloads and scopes. The security of customer data is a first order outcome that the API standards must seek to deliver.

Outcome Principle 2: APIs use open standards

In order to promote widespread adoption, open standards that are robust and widely used in the industry will be used wherever possible.

Outcome Principle 3: Data sharing provides a positive consumer experience

The standards will ensure that CDR consumers have simple, informed, and trustworthy data sharing experiences that provide them with positive outcomes over the short and long term.

Outcome Principle 4: APIs provide a good developer experience

To ensure that the entry hurdle for new developers is low the experience of the developers that are building clients using the APIs will be considered. The ability for a developer to easily understand and write code using the APIs in modern development environments should be facilitated by the API standards.

Outcome Principle 5: Standards are consistent across sectors

The standards will strive for consistency in patterns, structure, security mechanisms and user experience across sectors to facilitate the development of customer experiences and services that are able to integrate data from multiple sectors seamlessly and to reduce the cost of customer education for new sectors.

Technical Principles

These principles articulate specific technical outcomes that the API definitions should seek to deliver.

Technical Principle 1: APIs are RESTful

The API standards will adhere to RESTful API concepts where possible and sensible to do so. In particular the concepts of statelessness and resource orientation will be followed.

Technical Principle 2: APIs are implementation agnostic

The underlying implementation of the APIs should not be constrained or driven by the API definitions and standards. Conversely, the underlying implementation choices should not be visible or derivable to the client applications using the APIs.

Technical Principle 3: APIs are simple

As complexity will increase implementation costs for both holders and clients as well as reduce the utility of the APIs, API definitions should seek to be as simple as possible but no simpler.

Technical Principle 4: APIs are rich in capability

As the APIs are defined care should be taken to ensure that the data payloads defined represent rich data sets that can be used in many scenarios, including scenarios not necessarily front of mind during the design process.

Technical Principle 5: APIs are performant

The API definitions should consider and incorporate performance implications during design ensuring that repeated calls are not necessary for simple use cases and that payload sizes do not introduce performance issues.

Technical Principle 6: APIs are consistent

The API definitions across the full suite of APIs should be consistent with each other as much as possible. Where possible common data structures and patterns should be defined and reused.

Technical Principle 7: APIs are version controlled and backwards compatible

As the API definitions evolve care will be taken to ensure the operation of existing clients are protected when breaking changes occur. Breaking changes will be protected by a well-defined version control model and by a policy of maintaining previous versions for a period of time to allow for backwards compatibility.

Technical Principle 8: APIs are extensible

The API definitions and standards should be built for extensibility. This extensibility should accommodate future API categories and industry sectors but it should also allow for extension by data holders to create unique, value add offerings to the ecosystem.

Consumer Experience Principles

These principles articulate qualitative outcomes for consumer experience that the standards should seek to deliver.

CX Principle 1: The CDR is Consumer-centric

The CDR consumer experience is intuitive and is centred on consumer attitudes, needs, behaviours, and expectations – noting that these may change over time.

CX Principle 2: The CDR is Accessible and Inclusive

A diverse range of people are able to access, use, and comprehend the CDR ecosystem regardless of their background, situation, experience, or personal characteristics.

CX Principle 3: The CDR is Comprehensible

When interacting with the CDR, consumers are able to understand the following:

CX Principle 4: The CDR is Simple and Empowering

Consumer interactions with the CDR are as simple as possible, but not at the expense of informed consent, consumer control, transparency, privacy, or comprehension. Consumers should be encouraged to be privacy conscious without experiencing cognitive loads that lead to disengagement. Consumers should also be empowered by the CDR without interactive burdens being placed on them.

Consent is granted at a point in time and is only as current as the consumer’s original intent. Consumer attitudes and behaviours may change over time and be impacted by external events such as the expansion of the CDR or consumer awareness. Consent terms should always align to current consumer preferences.

Versioning

The standards have adopted a two level versioning strategy. The high level standards (including principles, Uniform Resource Identifier structure, payload naming conventions, etc) be versioned and each API end point will have an additional version specific to that end point.

Documentation Versioning

Sample versioning of the standards documentation is as follows: 1.12.2 - meaning major version 1, minor version 12 and bugfix version 2

The standards documentation will be versioned using three version parts <major>.<minor>.<bug fix>. This version will be used to describe updates in the Change Log.

Each of the three components will be independently incrementing integers and are described as follows:

Uniform Resource Identifier (URI) Versioning

The base path structure containing the "version" for this standard is:
https://<holder-path>/cds-au/v<major version>/<industry>

The high level standard will be versioned as described above. The major component of this version will be embedded in the URI Structure for the APIs. This allows for a data holder to support multiple major versions of the standards in production even if the significant breaking changes occur between major versions.

End Point Versioning

Each end point will have multiple versions independent of other end points. A specific end point version will be requested by a client using a HTTP header. This header will be supported by all end points under the API standards. See the section on HTTP Headers for more information on how versions are requested and supplied under the standards.

URI Structure

Some example URIs that meet this standard are:

1. https://www.bank.com.au/api/cds-au/v1/banking/accounts  
2. https://www.bank.com.au/api/cds-au/v1/banking/accounts/abc123/transactions/?x=y#bar  
3. https://www.bank.com.au/complex/uri/taxonomy/cds-au/v1/banking/products?page=2  
4. https://www.energyretailer.com.au/api/cds-au/v1/energy/usage  
5. https://www.energyretailer.com.au/api/cds-au/v1/ACME/apply  

The holder path for each example is:

1. www.bank.com.au/api  
2. www.bank.com.au/api   
3. www.bank.com.au/complex/uri/taxonomy  
4. www.energyretailer.com.au/api  
5. www.energyretailer.com.au/api

The base path for each example is:

1. https://www.bank.com.au/api/cds-au/v1/banking  
2. https://www.bank.com.au/api/cds-au/v1/banking   
3. https://www.bank.com.au/complex/uri/taxonomy/cds-au/v1/banking  
4. https://www.energyretailer.com.au/api/cds-au/v1/energy  
5. https://www.energyretailer.com.au/api/cds-au/v1/ACME

The resource path for each example is:

1. https://www.bank.com.au/api/cds-au/v1/banking/accounts
2. https://www.bank.com.au/api/cds-au/v1/banking/accounts/abc123/transactions
3. https://www.bank.com.au/complex/uri/taxonomy/cds-au/v1/banking/products
4. https://www.energyretailer.com.au/api/cds-au/v1/energy/usage
5. https://www.energyretailer.com.au/api/cds-au/v1/ACME/apply

The URI structure for API end points in the standards MUST be implemented as follows:

uri-string =  "https://" <holder-path> "/" cds-au "/" <version> "/" ( <industry> | <HID> ) "/" <resource>

The components of this URI structure are described as follows:

  • <holder-path> = string. The holder path is a path set by the data holder. It can be any URI desired by the holder. While all authenticated end points must be accessible under the same holder path the data holder may stipulate a different holder path for unauthenticated end points.
  • cds-au = "cds-au" string. This is a static string representing the end points defined by the Consumer Data Standards for Australia. This static string allows for separation from other APIs available at the same base holder path and also allows for extension if the standards are adopted by another jurisdiction in whole or in part.
  • <version> = "v1" string. The major version of the high level standards. This is not the version of the endpoint or the payload being requested but the version of the overall standards being applied. This version number will be “v” followed by the major version of the standards as a positive integer (e.g. v1, v12 or v76).
  • <industry> = banking / energy / telco / common A static string used to separate APIs for a specific industry. As standards for new industries are defined the list of industry strings will be extended. Note that the currently accepted values for the industry component of the base path are:
    • banking = "banking" string. For APIs related to banking and potentially wider financial services data,
    • energy = "energy" string. For APIs related to the energy distribution industry,
    • telco = "telco" string. For APIs related to telecommunications,
    • common = "common" string. For APIs that potentially span industries.
  • <HID> = string. The Holder Identifier used to denote extension API categories for a specific holder.
  • <resource> = string. The URI for the specific resource requested. This end point URI will be defined as part of the end point definitions for each API group.

Base Path
Base path is intended to be the portion of the URL up to but not including the endpoint resource. In other words, the base path is the portion of the URL up to and including the <industry> or <HID> component. The base path string is defined as follows:

https:// <holder-path> / cds-au / <version> / ( <industry> | <HID> )

Resource Path
The resource path is intended to be the portion of the URL including the base path and resource location. The resource path string is defined as: <base-path> / <resource>.

Resource URIs

Resources that are collections, and members of collections, will follow the JSONAPI.org recommendation.

Under this model, collections, individual members and collection sub-resources would be accessed as follows:

GET …/accounts Returns an array of accounts
GET …/accounts/{id} Returns the detail of a specific account
GET …/accounts/transactions Returns the transactions of multiple accounts
GET …/accounts/{id}/transactions Returns the transactions of a specific account
POST …/accounts Create a new account
POST …/accounts/search Returns an array of accounts based on a complex query

The final example above represents a complex query accessed via a POST request. In this situation the POST URI should be applied to a sub-resource of the collection. A POST to a collection is reserved for the creation of a new collection member.

If no valid sub-resource exists then a dedicated sub-resource should be created, such as the “search” URI listed in the example above.

HTTP Headers

Supported HTTP headers, and their usage, for the standards are as laid out in the following sections.

Request Headers

A sample set of headers requesting version 3 to 5:

Content-Type : application/json;charset=UTF-8
Accept : application/json;charset=UTF-8
x-v : 5
x-min-v : 3
x-fapi-interaction-id : 6ba7b814-9dad-11d1-80b4-00c04fd430c8
x-fapi-auth-date : Thu, 16 Jan 2020 16:50:15 GMT
x-fapi-customer-ip-address : 2001:0db8:85a3:0000:0000:8a2e:0370:7334
x-cds-client-headers : TW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNzkuMC4zOTQ1Ljg4IFNhZmFyaS81MzcuMzY=

A Data Holder must be able to process Content-Type headers in accordance with [RFC7231]. The following would be valid:

Content-Type: application/json;charset=UTF-8
Content-Type: application/json
Content-Type: AppliCAtion/JSon;Charset=uTf-8

A Data Holder must be able to process Accept headers in accordance with [RFC7231]. The following would be valid:

Accept: */*
Accept: application/json;charset=UTF-8
Accept: application/json
Accept-Encoding: charset=UTF-8
Accept: AppliCAtion/JSon;Charset=uTf-8

Header Field Description Mandatory?
Content-Type Standard HTTP Header. Represents the format of the payload provided in the request. The media type must be set to application/json. Mandatory for PUT and POST calls. Conditional
Accept If specified, the media type must be set to application/json, unless otherwise specified in the resource end point standard.

If set to an unacceptable value the holder must respond with a 406 Not Acceptable. If not specified, or a wildcard (*/*) is provided, the default media type is application/json.
Optional
x-v Version of the API end point requested by the client. Must be set to a positive integer. The holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent.
If all versions requested are not supported then the holder must respond with a 406 Not Acceptable.
Mandatory
x-min-v Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent.
If all versions requested are not supported then the holder must respond with a 406 Not Acceptable.
Optional
x-<HID>-v A holder specific version of extension fields. Should not be used in conjunction with x-min-v. Optional
x-fapi-interaction-id An optional [RFC4122] UUID used as a correlation id. If provided, the data holder must "play back" this value in the x-fapi-interaction-id response header. Optional
x-fapi-auth-date The time when the customer last logged in to the Data Recipient Software Product as described in [FAPI-R]. Required for all resource calls (customer present and unattended). Not required for unauthenticated calls. Conditional
x-fapi-customer-ip-address The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls. Conditional
x-cds-client-headers The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.
This header is not required to include:
  • Headers containing security information
  • Custom or proprietary headers used to facilitate the client application
Conditional

Response headers

Header Field Description Mandatory?
Content-Type Standard HTTP Header. Represents the format of the payload returned in the response.
Must be application/json unless otherwise specified in the resource end point standard.
Mandatory
Retry-After Header indicating the time (in seconds) that the client should wait before retrying an operation. The holder should include this header along with responses with the HTTP status code of 429 Too many requests. Optional
x-v The version of the API end point that the holder has responded with. Mandatory
x-fapi-interaction-id An [RFC4122] UUID used as a correlation id. The data holder must set the response header x-fapi-interaction-id to the value received from the corresponding request header or to a new [RFC4122] UUID value if the request header was not provided. This header MUST be responded for success and error responses for authenticated APIs. Mandatory

Additional Headers

Generally understood headers used in HTTP transactions to provide caching guidance and the use of the compression are not specified but are considered acceptable. It is at the discretion of the data holder if these headers are used for a specific implementation. Data holders should not require these headers for successful API access, however.

HTTP Response Codes

The handling and usage of HTTP response codes for the standards will be according to the following table.

Situation HTTP Status Notes POST GET DELETE
Query completed successfully 200 OK Yes Yes No
Normal execution. The request has succeeded. 201 Created The operation results in the creation of a new resource. Yes No No
Delete operation completed successfully 204 No Content No No Yes
The response is not modified since last call 304 Not Modified May be returned if standard caching headers such as ETag or If-modified-since are utilised Yes Yes No
Request has malformed, missing or non-compliant JSON body or URL parameters 400 Bad Request The requested operation will not be carried out. Yes Yes Yes
Authorization header missing or invalid token 401 Unauthorized The operation was refused access. Re-authenticating may result in an appropriate token that may be used. Yes Yes Yes
Token has incorrect scope or a security policy was violated. 403 Forbidden The operation was refused access. Re-authenticating is unlikely to remediate the situation. It is expected that this error will result in an error payload Yes Yes Yes
The resource matching the request URI is not known or is unable to be processed due to business logic specific to the resource being requested 404 Not Found No indication is given of whether the condition is temporary or permanent. This response code MUST NOT be used for resources presented in the body of the request. Yes Yes Yes
The consumer tried to access the resource with a method that is not supported. 405 Method Not Allowed Yes Yes Yes
The request contained an Accept header other than permitted media types, a character set other than UTF-8 or a version that was not supported 406 Not Acceptable Yes Yes Yes
The operation was refused because the payload is in a format not supported by this method on the target resource. 415 Unsupported Media Type Yes No No
The request was well formed but was unable to be processed due to business logic specific to the request 422 Unprocessable Entity If applicable to the HTTP method it is expected that this error will result in an error payload Yes Yes No
The operation was refused as too many requests have been made within a certain timeframe. 429 Too Many Requests Throttling is a NFR. The data holder should include a Retry-After header in the response indicating how long the data consumer must wait before retrying the operation. Yes Yes Yes
Something went wrong on the API gateway or micro-service 500 Internal Server Error The operation failed. Yes Yes Yes
Service is currently unavailable 503 Service Unavailable Yes Yes Yes
The server was unable to respond in a timely manner 504 Gateway Timeout Returned if a timeout has occurred but a resend of the original request is viable (otherwise use 500 instead) Yes Yes Yes

Payload Conventions

This section of the standard outlines the request and response payload structures for all API end points as well as the naming conventions for fields.

Request Payload Structure

A sample request would be structured as follows:

{
  “data”: {
    ...
  },
  “meta”: {
    ...
  }
}

Each API request payload MUST have a JSON object at the root level known as the root object. This object MUST contain a data object to hold the primary data for the request.

The root object will contain a meta object if, and only if, it is specifically REQUIRED by the end point. The meta object is used to provide additional information such as second factor authorisation data, traffic management, pagination counts or other purposes that are complementary to the workings of the API.

The definition of the contents for the data object and meta object will be defined separately for each end point.

Response Payload Structure

A sample successful response:

{
  “data”: {
    ...
  },
  “links”: {
    “self”: “...”
  },
  “meta”: {
    ...
  }
}

A sample unsuccessful response:

{
  “errors”: [
    {
      “code”: “...”,
      “title”: “...”,
      “detail”: “...”
    }, {
      “code”: “...”,
      “title”: “...”,
      “detail”: “...”,
      “meta”: {
        ...
      }
    }
  ]
}

Each API request payload MUST have a JSON object at the root level known as the root object.

The contents of the root object are as follows:

The definition of the contents for the data object and meta object will be defined separately for each end point.

The links object will contain links to related API end points. This will include links to support pagination.

The links object MUST contain a field named self that will have the fully qualified URI to the current request as a value.

The errors object is defined in the Error Codes section.

Field Naming Conventions

Valid Characters In Field Names

All field names defined in either a request or response payload MUST be treated as case sensitive by clients and servers, and they MUST meet all of the following conditions:

Any other character MUST NOT be used in field names.

Field Naming Style

Field names MUST be meaningful names with defined semantics.

Fields representing the same data in different payloads or different parts of a payload MUST have the same name.

Array types SHOULD have plural field names. All other field names SHOULD be singular.

Field names MUST be defined using camel case with the following clarifications:

Fields MUST NOT be named using reserved javascript tokens.

Maps

For JSON maps (i.e. key/value pairs) any Unicode character MAY be used as a field name and stylistic requirements do not apply.

Field Property Conventions

Field Data Types

Each field defined for the payloads of an end point MUST have an assigned data type.

The list of valid data types are set out in the common field types section. If a custom data type is required for a field then the field SHOULD be classified as a string with a clear description of how the property value is to be interpreted or defined.

Mandatory/Optional Fields

Each field defined for the payloads of an end point MUST have an assigned status of mandatory, optional or conditional.

Mandatory fields MUST be present and have a non-null value in a request or response payload for the payload to be considered valid.

Optional fields MAY be present but this is not guaranteed. It is also valid for these fields to be present but have a null value. Note that optional fields indicate that data may sometimes not be held by a Data Holder and this is an expected scenario.

Conditional fields MUST have an associated conditional statement. If the conditional statement is true in a specific request or response the field is considered mandatory. If the conditional statement is false then the field is considered optional.

Empty/Null Fields

An empty field (ie. a field that is not present in a payload) will be considered equivalent with a field that is present with a null value.

An empty string (“”) is not considered to be equivalent to null.

A Boolean value of false is not considered to be equivalent to null. Optional Boolean fields, by implication, have three possible values: true, false and indeterminate (ie. null).

Object conventions

Sample union object structure:

“data”: {
    [
        {
            “shapeUType”: “circle”,
            “circle”: {
            }
        },
        {
            “shapeUType”: “square”,
            “square”: {
            }
        }
    ]
}

A specific convention will apply to union objects.

In the standards a union object is used in a situation where a set of data can be represented with different sets of fields depending on the context. To maintain strong typing of the fields one of a series of known object structures will be used. An example where this technique is used in the standard is in the definition of account balances where balance information can be represented differently, but unambiguously, for different account types.

For union objects an additional field, with a known suffix, is used to identify the object type that has been provided specifically.

As the name of this field is constant it can be used to perform an indirect lookup on the object type that has actually been provided removing the need to scan for which object is present.

A field of this type will always be specified with the suffix UType meaning Union Type.

Array Conventions

Samples for providing array values:

## Many-values:
"middleNames": ["Geoff", "John"],
"errors": [
    {
      "code": "...",
      "title": "...",
      "detail": "..."
    }, {
      "code": "...",
      "title": "...",
      "detail": "..."
    }
]

## Single-value:
"middleNames": ["Geoff"],
"errors": [
    {
      "code": "...",
      "title": "...",
      "detail": "..."
    }
]

## Empty array:
"middleNames": [ ],
"errors": [ ]

Unless otherwise stated within the data standards, arrays are explicitly expressed in response payloads.

Mandatory fields

In objects where an array field is defined as having 0..n values, the array field must be explicitly expressed as an array in the payload, even if it only contains one item or is empty.

This applies equally for object arrays. Where a field is defined as an array value, the response should be: * an array of objects, * an array of values, or * an empty array ([]).

An empty array is the representation for an array equivalent to an empty string.

Optional fields

If the field is optional a null value or omission of the field in the response is accepted.

Normative references

The only exception to this, unless explicitly stated, is normative standards. The requirements for expressing arrays within those normative standards apply per the normative references.

Common Field Types

The following table outlines the common data types for fields used in the standard.

Type Description Valid Examples
String Standard UTF-8 string but unrestricted in content. Any valid Unicode character can be used.
ASCIIString Standard UTF-8 string but limited to the ASCII character set.
Boolean Standard JSON boolean true
false
Enum String representing an option from a defined list of values
- All possible values should be provided
- Values should be in all caps
- Spaces should be replaced with under bars '_'
- Values should be limited to the ASCII character set
“OPTION1”
“ANOTHER_OPTION”
“VAL_ABC_123”
NaturalNumber A natural number (ie. a positive integer inclusive of zero) 0
1
10000
PositiveInteger A positive integer (zero excluded) 1
10000
NegativeInteger A negative integer inclusive of zero 0
-1
-10000
Integer Any positive or negative integer inclusive of zero 1
0
-1
Number A standard floating point number. Can be positive, negative or zero 0.1
-100.09
10
90.09
Base64 Base64 encoded string as per RFC 4648 Q29uc3VtZXIgRGF0YSBSaWdodA==
DateTimeString Combined Date and Time string as per RFC- 3339 (labelled date-time in the RFC). As specified in RFC-3339 times should be offset relative to UTC “2007-05-01T15:43:00.12345Z”
“2012-12-25T15:43:00-08:00”
“1997-01-12T15:43:00.121Z”
DateString Date string as per RFC-3339 (labelled full-date in the RFC) “2007-05-01”
“2012-12-25”
TimeString Time string as per RFC-3339 (labelled full-time in the RFC). As specified in RFC-3339 times should be offset relative to UTC “15:43:00.12345Z”
“15:43:00-12:00”
CurrencyString Standard 3 character currency codes as per ISO-4217 “AUD”
“USD”
“GBP”
RateString A string representing an interest rate. A rate of 100% would be represented by the value 1.0 and a rate of -100% by -1.0
- At least 1 and up to a total of 16 significant digits before decimal point
- Up to 16 digits following the decimal point
- No formatting, eg thousand separating commas
“0.05”
“-0.05”
“12.3456789”
“-99.123456789123”
AmountString A string representing an amount of currency.
- A positive, zero or negative number
- Negative numbers identified with a ‘-‘
- No currency symbols should be supplied
- At least 1 and up to a total of 16 significant digits before decimal point
- Minimum 2 digits following a decimal point (more digits allowable but only if required)
- No additional formatting, eg thousand separating commas
“0.01”
“10.00”
“1234567.89”
“-1001.23”
“1.999”
MaskedPANString Masked credit card number. Lower case ‘x’ should be used to mask numbers and only the last four digits should be exposed to facilitate identification. This type is expected to be used for display so the format should be logical for this context "xxxx xxxx xxxx 1234"
MaskedAccountString Masked bank account number genericised for a variety of account types. Should be represented as the full account number would normally be represented for display (including formatting) but with all digits except the last four replaced with a lowercase x. This type is expected to be used for display so the format should be logical for this context "xxxx xxxx xxxx 1234"
"xxx-xxx xxxxx1234"
URIString A valid URI "http://www.google.com"
ExternalRef The format is defined by an external reference such as ISO standard or an RFC Swift bank codes using ISO 9362

Pagination

Each API end point that can return multiple records will stipulate whether pagination is supported for the end point or not. For end points that will return less than a reasonably sized page of results in the majority of circumstances support for paging may not be included.

Note that the use of paging for an end point does not require or preclude the use of filtering query parameters. It is expected that filtering and paging will be applied independently of each other.

Query Parameters

The consumer will stipulate pagination requirements on the request using query parameters. When paging is supported the consumer MAY provide the following query parameters:

If the query parameters are not provided the following defaults will be assumed:

Response Fields

In addition to the data requested a holder MUST provide the following additional information in the response payload:

For each of these fields the page size specified in the request should be assumed when calculating values.

Additional Pagination Rules

Cursor Support

For performance reasons data holders may wish to support other pagination patterns such as cursors or continuation tokens. While the standard does not explicitly support these additional mechanisms it is considered allowable to implement these patterns and expose them via the pagination links.

In this scenario the URIs included in the links for other pages may not be compliant with the standard and may, instead, include other query parameters that support another pagination pattern. It is expected that all other pagination requirements such as link fields and meta fields will still be supported if other patterns are implemented.

To allow for a more performant implementation data consumers are encouraged to utilise pagination links wherever possible and only use constructed URIs for the first page or if random access to a specific set of records is required.

ID Permanence

Within these standards resource IDs are REQUIRED to comply with the following:

Error Codes

These standards define a standard list of error codes that Data Recipient Software Products and Data Holders SHOULD or MUST conform to. Further,

Error Response Structure

Non-Normative Example

{
  "errors": [
    {
      "code": "urn:au-cds:error:cds-banking:Authorisation/UnavailableBankingAccount",
      "title": "Unavailable Banking Account",
      "detail": "808b5b1d-0798-4bdf-a3c8-f9cce2904eb2"
    }
  ]
}

The errors object will be an array of zero or more unnamed objects. The fields in each of these objects will be as follows:

If a Data Recipient Software Product or Data Holder responds with an application-specific error code, the standard CDR URN error code MUST be provided in the MetaError object.

URN Structure

When responding with a standard CDR error code, the URN structure is defined as follows:

urn-string = "urn:" NID ":" metatype ":" sub-type ":" error-category "/" error-code

  • NID = "au-cds" string.
  • metatype = "error" string.
  • sub-type = cds-all / cds-register / cds-banking / cds-energy
    • cds-all = "cds-all" string. An error code common to all API responses,
    • cds-register = "cds-register" string. Reserved for CDR Register issued error codes only,
    • cds-banking = "cds-banking" string. An error code specific to the CDR banking APIs only,
    • cds-energy = "cds-energy" string. An error code specific to the CDR energy APIs only.
  • error-category = string. The high-level category code for the error defined in the Consumer Data Standards
  • error-code = string. The specific error encountered, defined in the Consumer Data Standards

Standard Error Codes

A list of standard error codes to help categorise an error response. The applicable HTTP response code is also given.

General Errors

Non-Normative Example

# A request to a Data Holder extension API is made where an application-specific error is returned
#
# Request
POST https://data.acme.com.au/cds-au/v1/banking/ACME-new-loan-application HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-ACME-v : 7

# Response
HTTP/1.1 400 Bad Request
Content-Type: application/json
{
  "errors": [
    {
      "code": "ACME-APPLY-017",
      "title": "Application Is Missing Product ID",
      "detail": "A new loan application was requested but the product ID was not provided",
      "meta": {
         "urn": "urn:au-cds:error:cds-all:GeneralError/Expected"
      }
    }
  ]
}
Error Title Error Code HTTP Status Category Description
Expected Error Encountered urn:au-cds:error:cds-all:
GeneralError/Expected
4xx An error code that can be used, when an expected error occurs that is otherwise not covered by a more specific error.

The error detail SHOULD be populated with a meaningful error description, without revealing sensitive information.

An application specific error code MAY be provided. The MetaError » urn MUST be populated with the standard CDR error code.
Unexpected Error Encountered urn:au-cds:error:cds-all:
GeneralError/Unexpected
5xx An error code that can be used, when an unexpected error occurs.

The error detail SHOULD be populated with a meaningful error description, without revealing sensitive information.

An application specific error code MAY be provided. The MetaError » urn MUST be populated with the standard CDR error code.
Service Unavailable urn:au-cds:error:cds-all:
Service/Unavailable
503 (Service Unavailable) A request is made but the API unavailable as due to an outage.

The error detail MAY describe whether the outage is scheduled or unexpected and whether it is fully unavailable or partially unavailable.

400 Bad Request Errors

Non-Normative Example

# A request to Get Accounts is made however
# the value of is-owned is not a Boolean value
#
# Request
GET https://data.holder.com.au/cds-au/v1/banking/accounts?is-owned=2007-05-01 HTTP/1.1
Host: data.holder.com.au
Accept: application/json

# Response
HTTP/1.1 400 Bad Request
Content-Type: application/json
{
  "errors": [
    {
      "code": "urn:au-cds:error:cds-all:Field/Invalid",
      "title": "Invalid Field",
      "detail": "is-owned"
    }
  ]
}
Error Title Error Code Description
Missing Required Field urn:au-cds:error:cds-all:
Field/Missing
The request is missing a mandatory field required for the API. It MAY be a missing query parameter or missing field in the request payload. This error code can be used, where a more specific validation error is not applicable.

The error detail SHOULD be the parameter name of the missing field.

This error code MUST be supported for unauthenticated and authenticated APIs.
Missing Required Header urn:au-cds:error:cds-all:
Header/Missing
A required HTTP header has not been provided.

The error detail SHOULD be the HTTP header name.

This error code SHOULD be supported for unauthenticated and authenticated APIs.
Invalid Field urn:au-cds:error:cds-all:
Field/Invalid
Applies when the value of the URL parameter or request body parameter is an invalid type or the value violates the field's constraints as defined by the interface contract.
For example, is-owned is a Boolean but a DateString value is provided.

The error detail SHOULD be the parameter name of the invalid field. The error detail MAY include further details explaining the valid format.

This error code MUST be supported for unauthenticated and authenticated APIs.
Invalid Header urn:au-cds:error:cds-all:
Header/Invalid
Applies when a HTTP Header is provided but the value provided is an invalid type or violates the field type constraints as defined in the Consumer Data Standards.

The error detail SHOULD be the HTTP header name. The error detail MAY include further details explaining the valid format.

This error code SHOULD be supported for unauthenticated and authenticated APIs.
Invalid Date urn:au-cds:error:cds-all:
Field/InvalidDateTime
An invalid date is provided. For example, a future date value is expected, but a date in past or current date is supplied. Applies to DateTimeString, DateString, and TimeString field types.

The error detail SHOULD be the parameter name of the invalid date field. The error detail MAY include further details explaining the expected date value.

This error code MUST be supported for unauthenticated and authenticated APIs.
Invalid Page Size urn:au-cds:error:cds-all:
Field/InvalidPageSize
The value provided in the page-size pagination field is greater than the maximum allowed by the Consumer Data Standards (page_size > 1000).

This error code MUST be supported for unauthenticated and authenticated APIs.
Invalid Version urn:au-cds:error:cds-all:
Header/InvalidVersion
A request is made for a version that is not a PositiveInteger.
For example:
  • x-min-v, x-v or x-<HID>-v are not Integers (e.g. x-min-v=foo, x-v=bar, x-ACME-v=cheese)
  • x-min-v, x-v or x-<HID>-v are not positive-value integers (they are an Integer but <= 0)

This error code MUST be supported for unauthenticated and authenticated APIs.

If the version header is a PositiveInteger but is not a version supported by the Data Holder, the Unsupported Version code applies.

403 (Forbidden) Errors

Error Title Error Code Description
ADR Status Is Not Active urn:au-cds:error:cds-all:
Authorisation/AdrStatusNotActive
The ADR or the ADR's software product is not "active".

The error detail SHOULD contain the current status of the ADR software product.
Consent Is Revoked urn:au-cds:error:cds-all:
Authorisation/RevokedConsent
The consumer's consent is no longer authorised (for example revoked or expired) and the requested resource will not be provided.

This error code SHOULD be supported for authenticated APIs.
Consent Is Invalid urn:au-cds:error:cds-all:
Authorisation/InvalidConsent
The authorised consumer's consent is not associated to the resource requested, is insufficient to execute the resource or is in a status that prevents the resource being executed.

For example, if consent is awaiting authorisation of a secondary account holder.

The error detail SHOULD be a description of the status of consent without revealing sensitive information.

This error code SHOULD be supported for authenticated APIs.

404 (Not Found) Errors

Non-Normative Examples

# A request to a resource endpoint that does not exist
#
# Request
GET https://data.holder.com.au/cds-au/v1/banking/payments/294819e6-7ae0-4e20-900a-6a733fd97854/location HTTP/1.1
Host: data.holder.com.au
Accept: application/json

# Response
HTTP/1.1 404 Not Found
Content-Type: application/json
{
  "errors": [
    {
      "code": "urn:au-cds:error:cds-all:Resource/NotFound",
      "title": "Resource Not Found"
    }
  ]
}

# A request to a resource endpoint that exists in the data standards,
# but is not currently implemented
#
# Request
POST https://data.holder.com.au/cds-au/v1/admin/register/metadata HTTP/1.1
Host: data.holder.com.au
Accept: application/json

# Response
HTTP/1.1 404 Not Found
Content-Type: application/json
{
  "errors": [
    {
      "code": "urn:au-cds:error:cds-all:Resource/NotImplemented",
      "title": "Resource Not Implemented"
    }
  ]
}

#
# A request to a resource that is temporarily unavailable
#
# Request
GET https://data.holder.com.au/cds-au/v1/banking/accounts/b3f0c9d0/transactions/52e443ae13c5 HTTP/1.1
Host: data.holder.com.au
Accept: application/json

# Response
HTTP/1.1 404 Not Found
Content-Type: application/json
{
  "errors": [
    {
      "code": "urn:au-cds:error:cds-all:Resource/Unavailable",
      "title": "Unavailable Resource",
      "detail": "52e443ae13c5"
    }
  ]
}

#
# A request to a get a banking account that is invalid
#
# Request
GET https://data.holder.com.au/cds-au/v1/banking/accounts/invalid-id/ HTTP/1.1
Host: data.holder.com.au
Accept: application/json

# Response
HTTP/1.1 404 Not Found
Content-Type: application/json
{
  "errors": [
    {
      "code": "urn:au-cds:error:cds-banking:Authorisation/InvalidBankingAccount",
      "title": "Invalid Banking Account",
      "detail": "invalid-id"
    }
  ]
}

Error Title Error Code Description
Resource Not Implemented urn:au-cds:error:cds-all:
Resource/NotImplemented
The requested resource URL is a valid API endpoint defined by the Consumer Data Standards, but it is not implemented or not currently supported.

This error code SHOULD be supported for unimplemented APIs.
Resource Not Found urn:au-cds:error:cds-all:
Resource/NotFound
The requested resource URL is not an API endpoint defined by the Consumer Data Standards and it is not a URL recognised by the Data Holder or Data Recipient Software Product.
Invalid Resource urn:au-cds:error:cds-all:
Resource/Invalid
The requested resource identifier is permanently unavailable. No subsequent request for the resource will be successful. Applies when the resource ID is provided in the URI.

The error detail is the resource ID of the resource being requested.

This error code MUST be supported for unauthenticated and authenticated APIs.
Unavailable Resource urn:au-cds:error:cds-all:
Resource/Unavailable
The requested resource identifier is temporarily unavailable. Subsequent requests for the resource may be successful. Applies when the resource ID is provided in the URI.

The error detail is the resource ID of the resource being requested.

This error code MUST be supported for unauthenticated and authenticated APIs.
Invalid Banking Account urn:au-cds:error:cds-banking:
Authorisation/InvalidBankingAccount
The requested bank account is permanently unavailable. No subsequent request for the account will be successful. Applies when the account ID is provided in the URI.

The error detail is the account ID of the resource being requested.

This error code MUST be supported for authenticated APIs.
Unavailable Banking Account urn:au-cds:error:cds-banking:
Authorisation/UnavailableBankingAccount
The requested bank account is temporarily unavailable. Subsequent requests for the account may be successful. Applies when the account ID is provided in the URI.

The error detail is the account ID of the resource being requested.

This error code MUST be supported for authenticated APIs.

406 (Not Acceptable) Errors

Error Title Error Code Description
Unsupported Version urn:au-cds:error:cds-all:
Header/UnsupportedVersion
A request is made for a version that is lower than the minimum version or greater than maximum version the Data Holder supports for the requested endpoint.

The error detail MAY include the minimum and maximum versions the Data Holder supports.

This error code MUST be supported for unauthenticated and authenticated APIs.

422 (Unprocessable Entity) Errors

Non-Normative Example

#
# A bulk request to a get a banking account that is unavailable
#
# Request
POST https://data.holder.com.au/cds-au/v1/banking/accounts/balances HTTP/1.1
Host: data.holder.com.au
Accept: application/json

{
  "data": {
    "accountIds": [
      "b3f0c9d0-457d-4578-b0cd-52e443ae13c5",
      "b1bccd84-d29a-4233-8e44-be01c74eb85b"
    ]
  },
  "meta": {}
}

# Response
HTTP/1.1 422 Unprocessable Entity
Content-Type: application/json
{
  "errors": [
    {
      "code": "urn:au-cds:error:cds-all:Authorisation/UnavailableBankingAccount",
      "title": "Unavailable Banking Account",
      "detail": "b3f0c9d0-457d-4578-b0cd-52e443ae13c5"
    }
  ]
}

Error Title Error Code Description
Invalid Resource urn:au-cds:error:cds-all:
Resource/Invalid
The requested resource identifier is permanently unavailable. No subsequent request for the resource will be successful. Applies when the resource ID is provided in the request body.

The error detail is the resource ID of the resource being requested.

This error code MUST be supported for authenticated APIs.
Unavailable Resource urn:au-cds:error:cds-all:
Resource/Unavailable
The requested resource identifier is temporarily unavailable. Subsequent requests for the resource may be successful. Applies when the resource ID is provided in the request body.

The error detail is the resource ID of the resource being requested.

This error code MUST be supported for authenticated APIs.
Invalid Banking Account urn:au-cds:error:cds-banking:
Authorisation/InvalidBankingAccount
The requested bank account is permanently unavailable. No subsequent request for the account will be successful. Applies when the account ID is provided in the request body.

The error detail is the account ID of the resource being requested.

This error code MUST be supported for authenticated APIs.
Unavailable Banking Account urn:au-cds:error:cds-banking:
Authorisation/UnavailableBankingAccount
The requested bank account is temporarily unavailable. Subsequent requests for the account may be successful. Applies when the account ID is provided in the request body.

The error detail is the account ID of the resource being requested.

This error code MUST be supported for authenticated APIs.
Invalid Service Point urn:au-cds:error:cds-energy:
Authorisation/InvalidServicePoint
The requested service point is permanently unavailable. No subsequent request for the service point will be successful. Applies when the service point is provided in the request body.

The error detail is the service point ID of the resource being requested.

This error code MUST be supported for authenticated APIs.
Unavailable Service Point urn:au-cds:error:cds-energy:
Authorisation/UnavailableServicePoint
The requested service point is temporarily unavailable. Subsequent requests for the service point may be successful. Applies when the service point ID is provided in the request body.

The error detail is the service point ID of the resource being requested.

This error code MUST be supported for authenticated APIs.
Invalid Energy Account urn:au-cds:error:cds-energy:
Authorisation/InvalidEnergyAccount
The requested energy account is permanently unavailable. No subsequent request for the account will be successful. Applies when the account ID is provided in the request body.

The error detail is the account ID of the resource being requested.

This error code MUST be supported for authenticated APIs.
Unavailable Energy Account urn:au-cds:error:cds-energy:
Authorisation/UnavailableEnergyAccount
The requested energy account is temporarily unavailable. Subsequent requests for the account may be successful. Applies when the account ID is provided in the request body.

The error detail is the account ID of the resource being requested.

This error code MUST be supported for authenticated APIs.
Invalid Consent Arrangement urn:au-cds:error:cds-all:
Authorisation/InvalidArrangement
The arrangement being executed has previously been revoked and no further action will be taken.

The error detail is the CDR Arrangement ID of the being executed.

This error code MUST be supported for the Data Recipient Software Product and Data Holder CDR Arrangement Revocation endpoint.
Invalid Page urn:au-cds:error:cds-all:
Field/InvalidPage
The page being requested it out of of range. For example, the valid pagination range is 5 pages and the client requested page=10).

The error detail SHOULD be the maximum number of pages that are available.

This error code MUST be supported for unauthenticated and authenticated APIs.

CDR Register Errors

The following error codes apply to responses from the CDR Register. Data Recipient Software Product and Data Holder clients requesting data from the CDR Register MAY expect the following standard CDR error codes to be encountered:

Error Title Error Code HTTP Status Category Description
Invalid Brand urn:au-cds:error:cds-register:
Field/InvalidBrand
404 (Not Found) The brand provided to get the Data Recipient Software Product software statement assertion is invalid. Applies to the dataRecipientBrandId path parameter for CDR Register APIs.
Invalid Industry urn:au-cds:error:cds-register:
Field/InvalidIndustry
404 (Not Found) The industry requested in the path to get Data Recipient Software Product or Data Holder metadata is invalid / does not exist and cannot be found. Applies to the industry path parameter for CDR Register APIs.
Invalid Software Product urn:au-cds:error:cds-register:
Field/InvalidSoftwareProduct
404 (Not Found) The software product requested to get the Data Recipient Software Product software statement assertion is invalid or cannot be found. Applies to the softwareProductId path parameter.

Processing Errors

When a server encounters multiple problems for a single request, the most generally applicable HTTP error code SHOULD be used in the response. For instance, 400 Bad Request might be appropriate for multiple 4xx errors or 500 Internal Server Error might be appropriate for multiple 5xx errors.

A server MAY choose to stop processing as soon as a problem is encountered, or it MAY continue processing and encounter multiple problems. For instance, a server might process multiple attributes and then return multiple validation problems in a single response.

Extensibility And Application Specific Errors

Error handling has been designed with extensibility in mind. Where an application supports error codes specific to that implementation, it is intended that implementations can extend the standard CDR error codes with application-specific error responses whilst maintaining interoperability for clients.

Non-Normative Example

# Application-specific error code extends a standard CDR error code with
# details specific to the Data Holder
{
  "errors": [
    {
      "code": "acme-bank:JointAccountElectionRemoved",
      "title": "Joint Account Consent Election Is Removed",
      "detail": "Description of the specific error encountered",
      "meta": {
        "urn": "urn:au-cds:error:cds-banking:Authorisation/UnavailableBankingAccount"
      }
    }
  ]
}

To assist clients, the Data Recipient Software Product or Data Holder MUST provide the application-specific error code in the ResponseErrorListV2 » code and the standard CDR error code in the ResponseErrorListV2 » MetaError » urn field denoting the standard error code the implementation extends.

Transition arrangements

Non-Normative Examples

# Application-specific error code before transition

{ "errors": [
  {
    "code": "old error code",
    "title": "error message",
    "detail": "Description of the specific error encountered"
  }
] }

# Application-specific error code during transition

{ "errors": [
  {
    "code": "old error code",
    "title": "error message",
    "detail": "Description of the specific error encountered",
    "meta": {
      "urn": "urn:au-cds:error:cdr-all:Header/UnsupportedVersion"
    }
  }
] }

# Standardised-error code after retirement of application-specific error code

{ "errors": [
  {
    "code": "urn:au-cds:error:cdr-all:Header/UnsupportedVersion",    
    "title": "Unsupported Version",
    "detail": "'x-v' **MUST** be greater than or equal to '2'"
  }
] }

If Data Recipient Software Products or Data Holders support custom error codes prior to February 1st 2022, the following transition arrangements apply:

Extensibility

The Consumer Data Right standards will not cover all possible data sets or APIs that participants may wish to expose. Participants may also wish to innovate on top of the API standards by offering additional data to meet specific market opportunities. It is desirable that the standards not only allow for this to occur but actively encourage it with specific additions to the standards to enable such extension.

At the same time, it is important that a participant seeking to provide extensions does not hinder a data consumer that is only built for the published standards.

To accommodate these concerns the standards incorporate the following considerations specifically related to extension by data holders.

The three types of extension that the standards address are:

  1. Data holder offering entirely new API categories that are not covered by the API Standards
  2. Data holder offering additional end points to an API category that is already covered by the standards
  3. Data holder offering additional fields to the response payloads for an end point defined in the standards

Holder Identifier

For example, the prefixes for the four major Banks included in the first phases of implementation would be:

  • CBA – Commonwealth Bank
  • WBC – Westpac Banking Corporation
  • ANZ – ANZ Banking Group
  • NAB – National Australia Bank

Data holders seeking to extend the standards MUST nominate a prefix to identify all extensions. Extended fields and end points and would use this prefix consistently. This prefix would be, by preference, the ASX symbol for the holder. Care should be taken not to use a prefix already adopted by another holder in the regime.

In these standards, where a Holder Identifier would be included, the term <HID> will be used.

New API Categories

When extending by adding new API categories a holder MUST add these to the overall URI structure by substituting the industry element with the Holder (Provider) ID.

For instance, the standard URI base path is structured as:
https:// <holder-path> / cds-au / <version> / <industry> / <resource>

For the extension API categories for a specific holder they would be structured as:
https:// <holder-path> / cds-au / <version> / <HID> / <resource>

The end points defined under this structure, including the payloads of these end points do not need to be prefixed in any way. The fact that they are underneath the holder section implies that they are additional to the standard.

Note that:

New End Points In Existing API Categories

When creating new end points that are in parallel to existing API categories in the standard the Holder Identifier MUST be used to prefix the highest URI element where divergence occurs.

For example, assume an existing balance end point is defined as follows:
<base-path>/accounts/{account ID}/transactions

and the holder wishes to add an end point that summarises balance movement for a specific time period then they may define the end point as:
<base-path>/account/{account ID}/<HID>-balance-movement

Note that:

Additional Fields In An Existing Response Payload

When adding a new field in an existing payload the field can be added to the JSON by prefixing the string <HID>-.

If an object is being added as an extension only the highest level object name needs to be prefixed. Any fields inside the extended object can be named normally.

Note that:

Additional Query Parameters

When adding support for a new query parameter to an existing end point that a data consumer is expected to supply, the new parameter should be prefixed by the string <HID>- to avoid potential collision with extension by another data holder.

Extension Versioning

As described previously in the versioning section the standard provides for multiple versions of each API end point. This implies the need for extensions to also be versioned.

An optional header x-<HID>-v will be supported for all end points that can be used by the data consumer to request a specific version of extension fields to include in the response. See the section on HTTP Headers for more information on the use of this header.

Consumer Experience

The Consumer Experience (CX) Standards contain requirements for the creation of implementations by both Data Recipients and Data Holders. The full list of CX Standards can be found below.

The CX Guidelines provide examples and recommendations for how to implement key rules and standards that relate to the consumer experience. They can be found along with additional CX commentary at:

Data Language Standards: Common


Example of data language standards presented in a consumer-facing interaction, where [1] refers to Data cluster language, and [2] refers to Data permission language.

In accordance with CDR Rule 8.11 (1)(d), a data standard must be made to provide descriptions of the types of data to be used by CDR participants in making and responding to requests. Adherence to this language will help ensure there is a consistent interpretation and description of the consumer data that will be shared across different CDR implementations.

Area CX Standard
Data Language Standards: Language to be used

Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the Banking Language section for language to be used when requesting banking data; and the Energy Language section for language to be used when requesting energy data.

Data language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.

Data Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.

Data Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.

Additional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.

Examples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.

Data Language Standards: Detailed scope requests

If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.

Data Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the Banking Language section for banking data and the Energy Language section for energy data.

Example: A Data Recipient presents the Detailed data cluster in a data request to a consumer, but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.


Banking Language

Individual Consumer

Data cluster language Permission language Authorisation Scopes
Name and occupation Name
Occupation
common:customer.basic:read
Contact Details Phone;
Email address;
Mail address;
Residential address;
common:customer.detail:read
Name, occupation, contact details ‡ Name;
Occupation;
Phone;
Email address;
Mail address;
Residential address;
common:customer.detail:read

Business consumer

Data cluster language Permission language Authorisation Scopes
Organisation profile * Agent name and role;
Organisation name;
Organisation numbers (ABN or ACN);†
Charity status;
Establishment date;
Industry;
Organisation type
Country of registration;
common:customer.basic:read
Organisation contact details * Organisation address;
Mail address;
Phone number;
common:customer.detail:read
Organisation profile and contact details *‡ Agent name and role;
Organisation name;
Organisation numbers (ABN or ACN),†
Charity status;
Establishment date;
Industry;
Organisation type;
Country of registration;
Organisation address;
Mail address;
Phone number;
common:customer.detail:read

Banking Accounts

See below for the data language standards for the banking account scopes:

Data cluster language
Permission language
Authorisation Scopes
Account name, type and balance Name of account;
Type of account;
Account balance;
bank:accounts.basic:read
Account numbers and features Account number;
Interest rates;
Fees;
Discounts;
Account terms;
Account mail address;
bank:accounts.detail:read
Account balance and details‡ Name of account;
Type of account;
Account balance;
Account number;
Interest rates;
Fees;
Discounts;
Account terms;
Account mail address;
bank:accounts.detail:read

Transactions

See below for the data language standards for the banking transactions scope:

Data cluster language Permission language Authorisation Scopes
Transaction details Incoming and outgoing transactions;
Amounts;
Dates;
Descriptions of transactions;
Who you have sent money to and received money from; (e.g. their name)†
bank:transactions:read

Regular Payments

See below for the data language standards for the regular payments scope:

Data cluster language
Permission language
Authorisation Scopes
Direct debits and scheduled payments Direct debits;
Scheduled payments;
bank:regular_payments:read

Payees

See below for the data language standards for the payees scope:

Data cluster language Permission language Authorisation Scopes
Saved payees Names and details of accounts you have saved; (e.g. their BSB and Account Number, BPay CRN and Biller code, or NPP PayID)† bank:payees:read


Energy Language

Individual Consumer

Data cluster language Permission language Authorisation Scopes
Name Name common:customer.basic:read
Contact Details Phone;
Email address;
Mail address;
Residential address;
common:customer.detail:read
Name and contact details ‡ Name;
Phone;
Email address;
Mail address;
Residential address;
common:customer.detail:read

Business consumer

Data cluster language Permission language Authorisation Scopes
Organisation profile * Agent name and role;
Organisation name;
Organisation numbers (ABN or ACN);†
common:customer.basic:read
Organisation contact details * Organisation address;
Mail address;
Phone number;
common:customer.detail:read
Organisation profile and contact details *‡ Agent name and role;
Organisation name;
Organisation numbers (ABN or ACN);†
Organisation address;
Mail address;
Phone number;
common:customer.detail:read

Energy Accounts

See below for the data language standards for the energy accounts scopes:

Data cluster language Permission language Authorisation Scopes
Accounts and plans Account and plan information;
National Meter Identifier (NMI);
energy:accounts.basic:read
Account and plan details Account type;
Fees, features, rates, and discounts;
Additional account users;
energy:accounts.detail:read
Account and plan details Account and plan information;
National Meter Identifier (NMI);
Account type;
Fees, features, rates, and discounts;
Additional account users;
energy:accounts.detail:read

Concessions

See below for the data language standards for the concession scope:

Data cluster language Permission language Authorisation Scopes
Concessions and assistance Concession type;
Concession information;
energy:accounts.concessions:read

Payments

See below for the data language standards for the payments schedule scope:

Data cluster language Permission language Authorisation Scopes
Stored payment information Payment details;
Scheduled payment amount;
energy:accounts.paymentschedule:read

Billing

See below for the data language standards for the billing scope:

Data cluster language Permission language Authorisation Scopes
Billing payments and history Account balance;
National Meter Identifier (NMI);
Payment method;
Payment status;
Charges, discounts, credits;
Billing date;
Usage for billing period;
Payment date;
Invoice number;
energy:billing:read

NMI Standing Data

See below for the data language standards for the NMI standing data scopes:

Data cluster language
Permission language
Authorisation Scopes
Electricity connection National Meter Identifier (NMI);
Customer type;
Connection point details;
energy:electricity.servicepoints.basic:read
Electricity meter Supply address;
Meter details;
Associated service providers;
energy:electricity.servicepoints.detail:read
Electricity connection and meter National Meter Identifier (NMI);
Supply address;
Customer type;
Connection point details;
Meter details;
Associated service providers;
energy:electricity.servicepoints.detail:read

Distributed Energy Resources (DER)

See below for the data language standards for the Distributed Energy Resources (DER) scope:

Data cluster language Permission language Authorisation Scopes
Energy generation and storage Generation information;
Generation or storage device type;
Device characteristics;
Devices that can operate without the grid;
Energy conversion information;
energy:electricity.der:read

Electricity Usage

See below for the data language standards for the electricity usage scope:

Data cluster language Permission language Authorisation Scopes
Electricity usage Usage;
Meter details;
energy:electricity.usage:read

Accessibility Standards

Area CX Standard
Accessibility

At a minimum, all CDR participants MUST seek to comply with the following accessibility guidelines throughout the Consent Model.

These standards SHOULD be assessed, tested, and refined further by accessibility consultants directly involved in implementation.

Accessibility
Content distinction
Data Recipients and Data Holders MUST seek to have all aspects of the Consent Model comply with WCAG 1.4. This will make it easier to see and hear content, including separate foreground information from the background.
Accessibility
Keyboard functionality
Data Recipients and Data Holders MUST seek to have all aspects of the Consent Model comply with WCAG 2.1. This will make all functionality available from a keyboard.
Accessibility
Pointer interactions
Data Recipients and Data Holders MUST seek to have all aspects of the Consent Model comply with WCAG 2.5. This will make it easier to operate functionality using various input devices
Accessibility
Reading experiences
Data Recipients and Data Holders MUST seek to have all aspects of the Consent Model comply with WCAG 3.1. This will make text content readable and understandable
Accessibility
Input assistance
Data Recipients and Data Holders MUST seek to have all aspects of the Consent Model comply with WCAG 3.3. This will help users avoid and correct mistakes.
Area CX Standard
Disclosure consent:
Collection source
In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:
  1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from
  2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with
Note:
  • Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s)
  • This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data
  • Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified
Disclosure Consent: Descriptions of Data to be Collected and Disclosed If:
  1. An accredited person is seeking a collection consent to collect CDR data from a particular accredited data recipient; or
  2. An accredited data recipient is seeking a disclosure consent from a consumer to disclose CDR data;
and the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.
Consent:
Redirection
Data recipients MUST notify consumers of redirection prior to authentication.

Authentication Standards

Area CX Standard
Authentication:
'One Time Password' (OTP)

Data Holders and Data Recipients MUST clearly refer to a "One Time Password" in consumer-facing interactions and communications.

The use of the term "One Time Password" MAY be presented alongside an existing term used by a data holder (e.g. Netcode, one time pin etc.).

Authentication:
Passwords
Data Holders and Data Recipients MUST state in consumer-facing interactions and communications that services utilising the CDR do not need access to consumer passwords for the purposes of sharing data. The exact phrasing of this is at the discretion of the Data Holder and Data Recipient.
Authentication:
Password link
Data Holders MUST NOT include forgotten details links in redirect screens. The inclusion of such links is considered to increase the likelihood of phishing attacks.
Authentication:
OTP expiry
Data Holders MUST communicate the expiry period of the OTP to the consumer in the authentication flow.

Authorisation Standards

Area CX Standard
Authorisation:
Account selection
Data holders MUST allow the consumer to select which of their accounts to share data from if the data request includes account-specific data and if there are multiple accounts available. The Data holder MAY omit this step if none of the data being requested is specific to an account (e.g. Saved Payees).
Authorisation:
Profile selection

Data holders MAY add a 'profile selection' step or equivalent prior to the account selection step if a single identifier provides access to different customer accounts. For example, one customer ID may give access to business customer and individual customer accounts.

The 'profile selection' step SHOULD only be considered if it is an existing customer experience, and SHOULD be as minimal as possible to avoid introducing unwarranted friction (having regard to CDR Rule 4.24).

Unavailable Accounts:
Displaying accounts

If certain accounts are unavailable to share, data holders SHOULD show these unavailable accounts in the account-selection step.

Data holders SHOULD communicate why these accounts cannot be selected, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.

Data holders MAY provide instructions on how to make these accounts available to share, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.

Note: Unavailable accounts are to be interpreted in accordance with the rules on eligible consumers and required consumer data.

Unavailable Accounts:
No accounts can be shown
If unavailable accounts cannot be shown in the account selection step, data holders MAY display a generic explanation and instructions.
Unavailable Accounts:
Authorisation not permitted
If a successfully authenticated user cannot proceed to establish an authorisation in accordance with the rules on eligible consumers and required consumer data, data holders MAY provide the option of concluding the authorisation process.
Unavailable Accounts:
Request sharing rights
If a user does not have sharing rights for a particular account or set of accounts, data holders MAY invite the user to request sharing rights from the authorisation flow. The presentation of this mechanism MUST NOT introduce unwarranted friction as defined in rule 4.24 on restrictions.
Authorisation:
Account confirm
Data holders MUST show which accounts the data is being shared from prior to confirming authorisation if the data request includes account-specific data. The data holder MAY omit this information if none of the data being requested is specific to an account (e.g. Saved Payees).

Amending Authorisation Standards

Area CX Standard
Authorisation:
Amending consent
Effective from November 2021:
The following standards apply when a Data Holder invites a CDR consumer to amend a current authorisation as per rule 4.22A and the ADR has supplied a cdr_arrangement_id:
Customer Profile Where customer profile selection applies, Data Holders SHOULD omit the profile selection step and assume the customer profile associated with the existing authorisation. Data Holders MAY indicate which profile the authorisation relates to during the authorisation process.
Account Selection Where account selection applies, Data Holders MUST pre-select accounts that were associated with the previous authorisation provided these accounts remain eligible and available to share. Data Holders MAY allow these accounts to be amended, and MAY provide information regarding the pre-selection of accounts.
Changing Attributes Data Holders MUST indicate where a dataset is being added to an authorisation or a disclosure duration is being amended. Data Holders MAY apply this standard to other changing attributes, but this MUST ONLY apply where the attribute in the new authorisation differs to that of the previous authorisation. How a changed attributed is signified is at the Data Holder’s discretion.


Refer also to Future Dated obligations

Withdrawal Standards

Area CX Standard
Withdrawing consent If a Data Recipient does not have a general policy to delete redundant data, and the consumer has not already requested that their redundant data be deleted:
  • Data Recipients MUST allow consumers to elect to have their redundant data deleted as part of the withdrawal process prior to the final withdrawal step.
  • Data Recipients SHOULD consider prompting consumers to exercise this right at appropriate times (e.g. when inaction on the part of the consumer may cause them to lose the opportunity to exercise the right to delete their redundant data).
Withdrawing authorisation:
Consequences
As part of the withdrawal process, the data holder MUST advise the consumer to review the consequences of withdrawal with the Data Recipient before they stop sharing their data.
The data holder MAY consider using or paraphrasing the following message(s):
  • 'You should check with [Data Recipient] before you stop sharing to understand the consequences.'
  • 'You should check with [Data Recipient] to see if your service will be impacted before you stop sharing.'
Withdrawing authorisation:
Redundant data
As part of the withdrawal process, the data holder MUST inform the consumer about the handling of redundant data and the right to delete. The Data Holder MAY consider using or paraphrasing the following message(s):
  • 'CDR data is either deleted or de-identified when it is no longer required.'
  • '[Data Recipient] will have specific policies on how to handle your data once it's no longer required.'
Withdrawal: Disclosure consent As part of the disclosure consent withdrawal process, Data Recipients MUST advise the consumer to review, with the recipient that the data was disclosed to:
  1. How their data will be handled; and
  2. The consequences of withdrawing the disclosure consent
Note: The precise wording of the withdrawal message is at the discretion of the ADR
Withdrawal:
Secondary User Instruction
As part of the secondary user instruction withdrawal process, data holders MUST advise the consumer:
  1. That removing a secondary user instruction will stop all current and future data sharing for the secondary user(s)
  2. To review the consequences of withdrawal with the secondary user(s) before removing the secondary user instruction
Note: The exact phrasing of this message is at the discretion of the data holder.

Security Profile

Overview

This information security profile builds upon the foundations of the Financial-grade API Read Write Profile [FAPI-RW] and other standards relating to Open ID Connect 1.0 [OIDC].

For information on the specific normative references that underpin this profile refer to the Normative References section.

Symbols and Abbreviated terms

CDR Federation

The CDR Federation will facilitate the secure exchange of consumer data and federation metadata between multiple system entities which will assume one or more of the following roles:

Data Holder

The Data Holder (DH) is a system entity that authenticates a Customer (resource owner or user), as part of an authorisation process initiated by a Data Recipient, and issues an authorisation for that Data Recipient to access the Customer's data via published APIs.

A Data Holder assumes the role of an [OIDC] OpenID Provider.

For the purposes of this standard a single designated organisation may be represented via the Register as multiple separate Data Holders to support multiple brands or market identities.

Secondary Data Holder

A Secondary Data Holder (SDH) is a system entity that is designated to provide CDR data but does so via a standard Data Holder acting as a gateway. A Secondary Data Holder does not interact directly with Data Recipients and is not registered with the Register.

A request for data from a Secondary Data Holder by a standard Data Holder is known as a Secondary Responsibility Request.

See the Secondary Responsibility section contains standards related to Secondary Data Holders and Secondary Responsibility Requests.

Data Recipient

A Data Recipient (DR) is a system entity that is accredited to collect CDR data from Data Holders or other DRs through authorised Software Products.

A Data Recipient MUST be accredited in order to participate in the CDR Federation. Accreditation rules for Data Recipients are beyond the scope of this artefact. The process of accreditation is managed by the CDR Registrar.

For the purposes of this standard a single accredited organisation is represented via the Register as a single Data Recipient and may be represented by multiple separate Software Products to support multiple applications or services.

Software Product

A Data Recipient Software Product (DRSP) is a system entity that is authorised by a Data Holder to access consumer resources (APIs). A Software Product MUST capture consumer consent prior to commencing an authorisation process with a Data Holder.

A Software Product MUST be registered with the Registrar and approved for use in order to participate in the CDR Federation.

A Software Product MAY be registered for use across one or more sectors (e.g. banking and energy).

A Software Product assumes the role of an [OIDC] Relying Party (Client).

Register

The Register is a central point of discovery for both Data Holders and Data Recipients. Data Holders and Data Recipients must be created as entities in the Register in order for them to participate as members of the CDR Federation. The functionality of the Register will include but will not be limited to:

Customer

For the purposes of this standard a single person or individual may be represented as multiple Customers according to the practice of the Data Holder according to their existing digital channels.

Authentication Flows

This profile supports the authentication flows specified by OpenID Connect [OIDC] as constrained further by FAPI [FAPI].

Specifically the Hybrid Flow outlined at section 3.3 of [OIDC].

No other flows are currently supported.

OIDC Hybrid Flow

The [OIDC] Hybrid Flow is a type of redirection flow where the consumer's user agent is redirected from a Data Recipient Software Product’s (Relying Party) web site to a Data Holder’s Authorisation end point in the context of an [OIDC] authentication request. The Hybrid flow incorporates aspects of the both the implicit flow and authorisation code flow detailed under [OIDC].

Only a response_type (see section 3 of [OIDC]) of code id_token SHALL be allowed.

The request_uri parameter is only supported if the Data Holder supports PAR.

In addition, the following statements are applicable for this flow:

In line with CDR Rule 4.24 on restrictions when asking CDR consumers to authorise disclosure of CDR data, unwarranted friction for OTP delivery is considered to include:

Additional requirements and guidelines for this flow are contained in the Consumer Experience section.

Client Authentication

This section outlines how participants in the CDR regime will authenticate clients seeking access to end points.

Note that, while [MTLS] is utilised for transaction security and as a Holder of Key mechanism, the PKI Mutual TLS OAuth Client Authentication Method SHALL NOT be supported as the mechanism for client authentication.

The following authentication methods are supported:

Private Key JWT Client Authentication

Private Key JWT Client Authentication Non-Normative Example - CDR Register calls the Data Holder's token end point to obtain an Access Token for the purposes of calling the Data Holder's Get Metrics endpoint.

POST /token HTTP/1.1
Host: www.holder.com.au
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
  client_id=5ntwEOpMdPxxy49Gt28SXWY6j3afl2CP2&
  scope=admin%3Ametrics.basic%3Aread&
  client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&
  client_assertion=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyNDU2In0.ey ...

## Decoded client assertion JWT
{
  "alg": "PS256",
  "typ": "JWT",
  "kid": "12456"
}
{
  "iss": "5ntwEOpMdPxxy49Gt28SXWY6j3afl2CP2",
  "sub": "5ntwEOpMdPxxy49Gt28SXWY6j3aflCP2",
  "iat": 1516239022,
  "exp": 1516239322,
  "aud": "https://www.holder.com.au/token",
  "jti": "37747cd1-c105-4569-9f75-4adf28b73e31"
}

Authorisation Servers supporting private_key_jwt Client Authentication of clients MUST support the following requirements:

Self-signed JWT Client Authentication

Self-signed JWT Client Authentication Non-Normative Example - CDR Register calls the Data holder's Get Metrics end point using self-signed JWT Client Authentication (note that the “aud” claim represents the AdminBaseUri as defined in CDR Register Participant Endpoints).

GET https://admin.data.holder.com.au/cds-au/v1/admin/metrics HTTP:/1.1
Host: admin.data.holder.com.au
x-v: string
x-min-v: string
Authorization: Bearer eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyNDU2In0.ey ...

## Decoded Bearer token JWT
{
   "alg":"PS256",
   "typ":"JWT",
   "kid":"12456"
}
{
   "iss":"cdr-register",
   "sub":"cdr-register",
   "aud":"https://admin.data.holder.com.au",
   "iat":1516239022,
   "exp":1516239322,
   "jti":"32358102-a44f-43cc-ad7c-42443d01507a"
}

Data Recipient Software Products and Data Holders supporting the self-signed JWT authentication of clients using a signed JWT MUST do so according to the following requirements:

CDR Register calling Data Holders

Data Holders MUST support either Private Key JWT Client Authentication or Self-signed JWT Client Authentication of the CDR Register.

Data Holders SHOULD support Private Key JWT Client Authentication but MAY support Self-signed JWT Client Authentication.

This method MAY be changed by updating Data Holder registration details with the CDR Register.

Private Key JWT authentication

If the Data Holder supports the Private Key JWT Client Authentication method for authenticating the CDR Register, it MUST also support the following requirements:

Self-signed JWT authentication

If the Data Holder supports the Self-signed JWT Client Authentication method for authenticating the CDR Register, the client ID MUST be set to a value of cdr-register.

Data Holders calling Data Recipients

Non-Normative Example - Data Holder calls the Data Recipient Software Product's revocation end point (note that the "aud" claim is "resource path" to the revocation end point).

POST https://data.recipient.com.au/revocation HTTP/1.1
Host: data.recipient.com.au
Content-Type: application/x-www-form-urlencoded
Authorization: Bearer eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyNDU2In0.ey …

token=45ghiukldjahdnhzdauz&token_type_hint=refresh_token

## Decoded Bearer token JWT
{
   "alg":"PS256",
   "typ":"JWT",
   "kid":"67890"
}
{
   "iss":"dataholderbrand-123",
   "sub":"dataholderbrand-123",
   "aud":"https://data.recipient.com.au/revocation",
   "iat":1516239022,
   "exp":1516239322,
   "jti":"dba86502-7cf5-4719-9638-c5339a0ddb06"
}

If the Data Holder supports the Self-signed JWT Client Authentication method for authenticating the CDR Register, the client ID MUST be set to a value of ‘cdr-register’.

Data Holders calling Data Recipients

Non-Normative Example - Data Recipient Software Product calls Data Holder's token end point.

POST /token HTTP/1.1
Host: www.holder.com.au
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
  code=i1WsRn1uB1&
  client_id=s6BhdRkqt3&
  client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&
  client_assertion=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyNDU2In0.ey ...

## Decoded client assertion JWT
{
  "alg": "PS256",
  "typ": "JWT",
  "kid": "12456"
}
{
  "iss": "s6BhdRkqt3",
  "sub": "s6BhdRkqt3",
  "iat": 1516239022,
  "exp": 1516239322,
  "aud": "https://www.holder.com.au/token",
  "jti": "37747cd1-c105-4569-9f75-4adf28b73e31"
}

In addition to the requirements for Self-signed JWT Client Authentication, the client_id is the Data Holder Brand ID as issued by CDR Register.

Data Recipients calling Data Holders

In addition to the requirements for Private Key JWT Client Authentication the following requirements MUST be supported:

Data Recipients calling the CDR Register

Non-Normative Example - Data Recipient Software Product requests CDR Register Access Token

POST /token HTTP/1.1
Host: cdr.register
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
  client_id=<brand id> OR <software product id> &
  client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&
  client_assertion=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyNDU2In0.ey ...&
  scope=cdr-register%3Abank%3Aread

## Decoded client assertion JWT
{
  "alg": "PS256",
  "typ": "JWT",
  "kid": "b50641343f8f4717a4865d238b6297b8"
}
{
  "iss": "<brand id> OR <software product id>",
  "sub": "<brand id> OR <software product id>",
  "exp": 1516239322,
  "aud": "https://cdr.register/idp/connect/token",
  "jti": "37747cd1-c105-4569-9f75-4adf28b73e31"
}


## Response
{
    "access_token": "eyJhbGciOiJQUz...",
    "expires_in": 7200,
    "token_type": "Bearer",
    "scope": "cdr-register:bank:read openid"
}

In addition to the requirements for Private Key JWT Client Authentication the following requirements MUST be supported:

Client Registration

Dynamic Client Registration

Data Recipients register with Data Holders according to [DCR] to obtain client credentials used to retrieve consumer data on behalf of a consumer.

Software Statement Assertion (SSA)

As per [DCR], a Software Statement is defined in as: A digitally signed JSON Web Token (JWT) created in accordance with [JWT] that asserts metadata values about the client software

An SSA is a digitally signed JSON Web Token (JWT) created in accordance with [JWT] that asserts metadata values about the client software.

Such that:

Refer to the Register APIs section for the endpoint definitions that will be used to retrieve and validate SSAs.

SSA Definition

Example SSA:

eyJhbGciOiJQUzI1NiIsImtpZCI6ImI4ZmFjZjJmZjM5NDQ0Zjc4MWUwYmU1ZGI0YjE0ZjE2IiwidHlwIjoiSldUIn0.ew0KICAiaXNzIjogImNkci1yZWdpc3RlciIsDQogICJpYXQiOiAxNTcxODA4MTY3LA0KICAiZXhwIjogMjE0NzQ4MzY0NiwNCiAgImp0aSI6ICIzYmMyMDVhMWViYzk0M2ZiYjYyNGIxNGZjYjI0MTE5NiIsDQogICJvcmdfaWQiOiAiM0IwQjBBN0ItM0U3Qi00QTJDLTk0OTctRTM1N0E3MUQwN0M4IiwNCiAgIm9yZ19uYW1lIjogIk1vY2sgQ29tcGFueSBJbmMuIiwNCiAgImNsaWVudF9uYW1lIjogIk1vY2sgU29mdHdhcmUiLA0KICAiY2xpZW50X2Rlc2NyaXB0aW9uIjogIkEgbW9jayBzb2Z0d2FyZSBwcm9kdWN0IGZvciB0ZXN0aW5nIFNTQSIsDQogICJjbGllbnRfdXJpIjogImh0dHBzOi8vd3d3Lm1vY2tjb21wYW55LmNvbS5hdSIsDQogICJyZWRpcmVjdF91cmlzIjogWw0KICAgICJodHRwczovL3d3dy5tb2NrY29tcGFueS5jb20uYXUvcmVkaXJlY3RzL3JlZGlyZWN0MSIsDQogICAgImh0dHBzOi8vd3d3Lm1vY2tjb21wYW55LmNvbS5hdS9yZWRpcmVjdHMvcmVkaXJlY3QyIg0KICBdLA0KICAibG9nb191cmkiOiAiaHR0cHM6Ly93d3cubW9ja2NvbXBhbnkuY29tLmF1L2xvZ29zL2xvZ28xLnBuZyIsDQogICJ0b3NfdXJpIjogImh0dHBzOi8vd3d3Lm1vY2tjb21wYW55LmNvbS5hdS90b3MuaHRtbCIsDQogICJwb2xpY3lfdXJpIjogImh0dHBzOi8vd3d3Lm1vY2tjb21wYW55LmNvbS5hdS9wb2xpY3kuaHRtbCIsDQogICJqd2tzX3VyaSI6ICJodHRwczovL3d3dy5tb2NrY29tcGFueS5jb20uYXUvandrcyIsDQogICJyZXZvY2F0aW9uX3VyaSI6ICJodHRwczovL3d3dy5tb2NrY29tcGFueS5jb20uYXUvcmV2b2NhdGlvbiIsDQogICJzb2Z0d2FyZV9pZCI6ICI3NDBDMzY4Ri1FQ0Y5LTREMjktQTJFQS0wNTE0QTY2QjBDREUiLA0KICAic29mdHdhcmVfcm9sZXMiOiAiZGF0YS1yZWNpcGllbnQtc29mdHdhcmUtcHJvZHVjdCIsDQogICJzY29wZSI6ICJiYW5rOmFjY291bnRzLmJhc2ljOnJlYWQgYmFuazphY2NvdW50cy5kZXRhaWw6cmVhZCBiYW5rOnRyYW5zYWN0aW9uczpyZWFkIGJhbms6cGF5ZWVzOnJlYWQgYmFuazpyZWd1bGFyX3BheW1lbnRzOnJlYWQgY29tbW9uOmN1c3RvbWVyLmJhc2ljOnJlYWQgY29tbW9uOmN1c3RvbWVyLmRldGFpbDpyZWFkIg0KfQ.ZNKe8aBHcsZ_OfdP0GvUa0AHrjcoC0Coky4jQHrPsRoG3YMcS2XG9JtyB5zq-AMOQoaib1Ijx1m7B-JOEbVcnNJcLUZeVEIwnP8hRssAnGjWwaYGUAiY-DEFUsuXqpQWgyIOFz84W-FaHFcqpOSGxjGmjICZU9S1Pl4o8b5poA_kJ2n_wdiOBUG4xl3uXqzK_vstcGXbAubFyLhjOxhc_rqONO2NCtpyCwj83Zqi7Ve_A27-ty5N0AQa2xYWvjDt_Xh8xcxRI_ih7_sStvDTTy3gtyX5bAdXsDsweCcvN0d2vOCpm6-dnr8D1fXDTnlT3x2uQ0XAysWr6wU4mAZFVA

Associated JWKS:

{
  "keys": [
    {
      "kid": "b8facf2ff39444f781e0be5db4b14f16",
      "kty": "RSA",
      "key_ops": [
        "sign",
        "verify"
      ],
      "n": "s0zGoaOEJE8HDfHjWtO0xLXtuPcwio8BEoj0-uu9kxxDIF7jH0jb06EwoPkb83BET59x6C0TtRfc_I5ZDksQKRClWXzbazqi62M5YhCgwyB-S09PJb8P1GfQBYyK346nLKARHbFJ1t1SHARcVFJA_8NeHfQn_0fyEc55R3GGNDL3YQtjEoTb-LMR-KpcPB2BpyDuie-jk-3f1t0EfvnkVp-6co1_KTXrbwuYtH31YBZLgU4JeZEJLTnGdMKmJppZ9SnyrBB461hMmw0HJHJj6uZJSiP2onmvlrUezv1T3NM3HOE7WHxlps9MUJj3vcpea-O6n5JBX8emTduLuLuKuw",
      "e": "AQAB"
    }
  ]
}

Decoded SSA

{
  "alg": "PS256",
  "kid": "b8facf2ff39444f781e0be5db4b14f16",
  "typ": "JWT"
}

{
  "iss": "cdr-register",
  "iat": 1571808167,
  "exp": 2147483646,
  "jti": "3bc205a1ebc943fbb624b14fcb241196",
  "legal_entity_id": "3B0B0A7B-3E7B-4A2C-9497-E357A71D07C7",
  "legal_entity_name": "Mock Company Pty Ltd.",
  "org_id": "3B0B0A7B-3E7B-4A2C-9497-E357A71D07C8",
  "org_name": "Mock Company Brand",
  "client_name": "Mock Software",
  "client_description": "A mock software product for testing SSA",
  "client_uri": "https://www.mockcompany.com.au",
  "redirect_uris": [
    "https://www.mockcompany.com.au/redirects/redirect1",
    "https://www.mockcompany.com.au/redirects/redirect2"
  ],
  "sector_identifier_uri": "https://www.mockcompany.com.au/sector_identifier",
  "logo_uri": "https://www.mockcompany.com.au/logos/logo1.png",
  "tos_uri": "https://www.mockcompany.com.au/tos.html",
  "policy_uri": "https://www.mockcompany.com.au/policy.html",
  "jwks_uri": "https://www.mockcompany.com.au/jwks",
  "revocation_uri": "https://www.mockcompany.com.au/revocation",
  "recipient_base_uri": "https://www.mockcompany.com.au",
  "software_id": "740C368F-ECF9-4D29-A2EA-0514A66B0CDE",
  "software_roles": "data-recipient-software-product",
  "scope":
        "openid
         profile
         bank:accounts.basic:read
         bank:accounts.detail:read
         bank:transactions:read
         bank:payees:read
         bank:regular_payments:read
         common:customer.basic:read
         common:customer.detail:read
         cdr:registration"
}

The SSA will conform to the requirements of [DCR] with the following clarifications:

Client Metadata Required Modifiable Description
iss Required Contains the iss (issuer) claim denoting the party attesting to the claims in the software statement
value: "cdr-register"
iat Required The time at which the request was issued by the CDR Register, expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC
exp Required The time at which the SSA expires expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC
jti Required Unique identifier for the JWT, used to prevent reuse of the SSA.
legal_entity_id Optional A unique identifier string assigned by the CDR Register that identifies the Accredited Data Recipient Legal Entity
legal_entity_name Optional Human-readable string name of the Accredited Data Recipient Legal Entity
org_id Required A unique identifier string assigned by the CDR Register that identifies the Accredited Data Recipient Brand
org_name Required Human-readable string name of the Accredited Data Recipient Brand to be presented to the end user during authorization
client_name Required Human-readable string name of the software product to be presented to the end-user during authorization
client_description Required Human-readable string name of the software product description to be presented to the end user during authorization
client_uri Required URL string of a web page providing information about the client
redirect_uris Required Array of redirection URI strings for use in redirect-based flows
sector_identifier_uri Optional URL string referencing the client's sector identifier URI, used as an optional input to the Pairwise Identifier as described in described in section 8 of [OIDC]
logo_uri Required URL string that references a logo for the client software product. The server SHOULD display this image to the end-user during approval
tos_uri Optional URL string that points to a human-readable terms of service document for the Software Product
policy_uri Optional URL string that points to a human-readable policy document for the Software Product
jwks_uri Required URL string referencing the client's JSON Web Key (JWK) Set [RFC7517] document, which contains the client's public keys
revocation_uri Required URI string that references the location of the Software Product consent revocation endpoint as per Consumer Data Standards Endpoints
recipient_base_uri Required Base URI for the Consumer Data Standard Data Recipient endpoints. This should be the base to provide reference to all other Data Recipient Endpoints
software_id Required String representing a unique identifier assigned by the Register and used by registration endpoints to identify the software product to be dynamically registered.

The software_id will remain the same across multiple updates or versions of the same piece of software.
The software_id should be used as the primary external identifier for the client to prevent duplicate client registrations
software_roles Required String containing a role of the software in the CDR Regime. Initially the only value used with be “data-recipient-software-product”
scope Required String containing a space-separated list of scope values that the client can use when requesting access tokens.
These CDS scope values are defined at: Authorisation Scopes
The DCR scope value is defined at: Client Registration Management

As per the CDS Scopes and Claims, openid and profile are included in the SSA

Registration Request using JWT

Example Request

HTTP/1.1 POST /register
Content-Type: application/jwt
Accept: application/json

### Non-normative Decoded JWT
{
   "alg":"PS256",
   "typ":"JWT",
   "kid":"12456"
}
{
   "iss":"CDR Software Product ID",
   "iat":1571808167,
   "exp":2147483646,
   "jti":"37747cd1c10545699f754adf28b73e31",
   "aud":"https://secure.api.dataholder.com/issuer",
   "redirect_uris":[
      "https://www.mockcompany.com.au/redirects/redirect1",
      "https://www.mockcompany.com.au/redirects/redirect2"
   ],
   "token_endpoint_auth_signing_alg":"PS256",
   "token_endpoint_auth_method":"private_key_jwt",
   "grant_types":[
      "client_credentials",
      "authorization_code",
      "refresh_token"
   ],
   "response_types":["code id_token"],
   "application_type":"web",
   "id_token_signed_response_alg":"PS256",
   "id_token_encrypted_response_alg":"RSA-OAEP",
   "id_token_encrypted_response_enc:"A256GCM",
   "request_object_signing_alg":"PS256",
   "software_statement":…
}
{
  "signature":...
}

To register with a Data Holder, the Data Recipient sends an HTTP POST to the Data Holder registration endpoint.

The client registration request MUST contain the following claims in the JWT payload unless designated as Optional:

Claim Required Description
iss Required Contains the identifier for the Data Recipient Software Product (SoftwareProductId) as defined in the CDR Register
iat Required The time at which the request was issued by the Data Recipient expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC
exp Required The time at which the request expires expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC
jti Required Unique identifier for the JWT, used to prevent reuse of the token.
aud Required Contains the DH issuer value as described in the OIDC Discovery Document
redirect_uris Optional Array of redirection URI strings for use in redirect-based flows. If used, redirect_uris MUST match or be a subset of the redirect_uris as defined in the SSA
token_endpoint_auth_method Required The requested authentication method for the token endpoint. The only supported method will be private_key_jwt
token_endpoint_auth_signing_alg Required The algorithm used for signing the JWT
grant_types Required Array of OAuth 2.0 grant type strings that the client can use at the token endpoint. Supported values: [client_credentials, authorization_code, refresh_token]
response_types Required Array of the OAuth 2.0 response type strings that the client can use at the authorization endpoint. value: [code id_token]
application_type Optional Kind of the application. The only supported application type will be web
id_token_signed_response_alg Required Algorithm with which an id_token is to be signed

Supported values as constrained by [FAPI-RW]
id_token_encrypted_response_alg Required JWE alg algorithm with which an id_token is to be encrypted
id_token_encrypted_response_enc Required JWE enc algorithm with which an id_token is to be encrypted
request_object_signing_alg Optional Algorithm which the ADR expects to sign the request object if a request object will be part of the authorization request sent to the Data Holder

If field not present in the request, data holders are expected to respond with an appropriate default value

Supported values as constrained by [FAPI-RW]
software_statement Required Software statement assertion issued by the CDR Register

ID Token Algorithm Selection Considerations

Participants MUST support, at a minimum, the following ID Token algorithms:

Claim Values
id_token_encrypted_response_alg RSA-OAEP
RSA-OAEP-256
id_token_encrypted_response_enc A256GCM
A128CBC-HS256

Registration Validation

Validation and use of the JWT and the claims described above MUST be performed in accordance with [JWT].

SSA JWT signatures MUST be verified against the associated JWK published at the CDR Register JWKS endpoint.

Data Holders MUST NOT allow multiple active registrations for the same software_id.

Registration Response

Example Created Response

HTTP/1.1 201 Created
Content-Type: application/json

{
  "client_id": "2cfefa98-7d4a-4bcb-95da-47063b84d410",
  "client_id_issued_at": 1574398823,
  "redirect_uris": [
     "https://www.mockcompany.com.au/redirects/redirect1",
     "https://www.mockcompany.com.au/redirects/redirect2"
   ],
   "token_endpoint_auth_signing_alg":"PS256",
   "token_endpoint_auth_method":"private_key_jwt",
   "grant_types":[
      "client_credentials",
      "authorization_code",
      "refresh_token"
   ],
   "response_types":["code id_token"],
   "application_type":"web",
   "id_token_signed_response_alg":"PS256",
   "id_token_encrypted_response_alg":"RSA-OAEP",
   "id_token_encrypted_response_enc:"A256GCM",
   "request_object_signing_alg":"PS256",
   "software_statement":"…",
   "legal_entity_id": "3B0B0A7B-3E7B-4A2C-9497-E357A71D07C7",
   "legal_entity_name": "Mock Company Pty Ltd",
   "org_id": "3B0B0A7B-3E7B-4A2C-9497-E357A71D07C8",
   "org_name": "Mock Company Brand",
   "client_name": "Mock Software",
   "client_description": "A mock software product for testing SSA",
   "client_uri": "https://www.mockcompany.com.au",
   "logo_uri": "https://www.mockcompany.com.au/logos/logo1.png",
   "tos_uri": "https://www.mockcompany.com.au/tos.html",
   "policy_uri": "https://www.mockcompany.com.au/policy.html",
   "jwks_uri": "https://www.mockcompany.com.au/jwks",
   "revocation_uri": "https://www.mockcompany.com.au/revocation",
   "recipient_base_uri": "https://www.mockcompany.com.au",
   "sector_identifier_uri": "https://www.mockcompany.com.au/sector_identifier"
   "software_id": "740C368F-ECF9-4D29-A2EA-0514A66B0CDE",
   "software_roles": "data-recipient-software-product",
   "scope":
         "openid
          profile
          bank:accounts.basic:read
          bank:accounts.detail:read
          bank:transactions:read
          bank:payees:read
          bank:regular_payments:read
          common:customer.basic:read
          common:customer.detail:read
          cdr:registration"
}

On successful registration, the response MUST be returned to the Data Recipient conforming to Section 3.2.1 of [DCR].

Claim Required Description
client_id Required Contains the dynamically generated identifier for the Software Product issued by the Data Holder
client_id_issued_at Optional Time at which the client identifier was issued

As per Section 3.2.1 of [DCR], additionally, the authorisation server MUST return all registered metadata about this client, including any fields provisioned by the authorisation server itself.

The Software Statement value MUST be returned unmodified. Client metadata elements used from the software statement MUST also be returned directly as top-level client metadata values in the registration response.

Any additional claims MUST be ignored and not returned on completion of the request.

Registration Errors

Example Error Response

HTTP/1.1 400 Bad Request
Content-Type: application/json
{
 "error": "invalid_software_statement",
 "error_description": "Duplicate registrations for a given software_id are not valid"
}

When an error condition occurs during a registration request, the response MUST be returned to the Accredited Data Recipient conforming to Section 3.2.2 of [DCR].

Duplicate registrations are not permitted so attempts to create a registration which already exists MUST return an HTTP 400 error.

Registration error responses schemas are defined in the DCR APIs section.

For those Registration errors which do not map to Section 3.2.2 of [DCR], HTTP Response Codes in the Consumer Data Standards should be used.

Registration Management

Non-Normative Example for access token retrieval to perform registration management

HTTP/1.1 POST /token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
  scope=cdr%3Aregistration&
  client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&
  client_assertion=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyNDU2In0.ey ...

### Decoded client assertion JWT
{
  "alg": "PS256",
  "typ": "JWT",
  "kid": "12456"
}
{
  "iss": "12345",
  "sub": "12345",
  "iat": 1516239022,
  "exp": 1516239322,
  "aud": "https://www.holder.com.au/token",
  "jti": "37747cd1-c105-4569-9f75-4adf28b73e31"
}

Data Holders MUST expose Client Registration Management endpoints as defined in the DCR APIs

HTTP Verb MTLS HoK Client Authentication
POST /register Required N/A
GET /register/{clientID} Required Client Credentials with cdr:registration scope
PUT /register/{clientID} Required Client Credentials with cdr:registration scope
DELETE /register/{clientID} Optional Client Credentials with cdr:registration scope

PUT Operations

Registrations MUST only be updated via Registration PUT operations

PUT operations are to be used for one of two scenarios:

  1. The client has updated their registration details on the CDR Register and updates this information to the data holder
  2. A new version of the SSA has been released and the client updates this information to the data holder

Participant Statuses

Data Recipient and Software Product Statuses

The accreditation status of Data Recipients, and the status of their associated Software Products, may traverse through multiple statuses in the CDR.

The status of participants is maintained in the CDR Register by the CDR Registrar according to determination of the CDR Accreditor or the participant themselves.

CDR data may only be disclosed to active Data Recipients. Data Holders MUST cease disclosing CDR data where the accreditation of a Data Recipient or Software Package is:

  1. Suspended or revoked by the CDR Registrar.
  2. Surrendered by the Data Recipient.

The CDR Register MUST notify all Data Holders of the above changes in Data Recipient and Software Package status via the Register APIs.

The CDR Register MUST expose the statuses of data recipients and their associated software products via the Register APIs, using the following state models:

Data Recipient Status

Software Product Status

Status Mapping

When the CDR Registrar changes the accreditation status for a Data Recipient for any status other than active, the associated Software Product statuses MUST be changed accordingly.

The cascading status mappings are as follows:

Data Recipient Status Cascaded Software Product Status
Suspended Inactive
Revoked Removed
Surrendered Removed

Archiving

Dormant entries will be identified and archived automatically within the CDR Register.

Dormant entries are defined as those records that have reached and maintained an end state in the CDR Register for the past 2 years.

The table below outlines the end state for each Register entry type:

Register Entity End State
Data Holder Removed
Data Holder Brand Removed
Data Recipient Surrendered, Revoked
Data Recipient Brand Removed
Data Recipient Software Product Removed

Data Holder Responsibilities

The CDR Registrar has the ability to change the status of a Software Product independently of the Data Recipient's accreditation status. Therefore, both the Data Recipient and Software Product statuses should be referenced, to determine the Data Holder's responsibilities for data disclosure, consent and registration management.

Data Recipient
Status
Software Product
Status
Disclose of CDR Data Facilitate Consent Authorisation Facilitate Consent Withdrawal Invalidate Consents Cleanup Registration
Active Active
Active Inactive
Active Removed
Suspended Inactive
Suspended Removed
Revoked Removed
Surrendered Removed

Metadata Cache Management

Data Holders MUST react to Data Recipient and associated Software Statuses changes within 5 minutes of the change occurring on the CDR Register.

To achieve this, Data Holders will poll the GetDataRecipientsStatus, GetSoftwareProductsStatus and GetDataRecipients APIs to retrieve the current statuses and cache these for use during requests for Consumer Data.

Data Holders MUST choose a frequency of polling which ensures their systems can respond to status changes within the required timeframe.

Data Holders and Data Recipients MUST cache all other participant data they use and periodically update this cache using a slow poll. This ensures that changes to participant configuration propagates throughout the ecosystem in a predictable timeframe.

The CDR Register MAY cache the responses for public APIs hosted by the CDR Register. If caching is supported the CDR Register MUST support ETag cache validators allowing participants to detect whether the content has changed.

Cache update periods

The following are the recommended caching times for data retrieved from the Register APIs.

API Type Period
GetDataRecipientsStatus Public 2-5 minutes
GetSoftwareProductsStatus Public 2-5 minutes
GetDataRecipients (statuses) Public 2-5 minutes
GetDataRecipients (other data) Public 6 hours
GetDataHolderBrands Private 6 hours

OIDC Client Types

Only Confidential Clients SHALL be supported under this profile. Therefore, Public clients SHALL NOT be supported.

In reference to the client types referenced in section 2.1 of [OAUTH2]:

JSON Web Key Sets

Data Holder public keys MUST only be obtained from the standard OIDC end point used for that purpose.

Data Recipient Software Product public keys MUST only be obtained from the URI registered with the CDR Register.

CDR Register public keys MUST only be obtained from the end point exposed for that purpose.

Consent requirements will be communicated between the Data Recipient Software Product and Data Holder via the authorisation request object. The primary mechanism for capturing consent will be scopes and claims under [OIDC].

Other patterns for the establishment of consent may be considered in the future, including the incorporation of fine-grained consent for specific use cases.

Scopes and Claims

OIDC Scopes

In addition to CDR data scopes the following scopes MUST be supported:

Claims

The following normal [OIDC] claims MUST be supported. This list includes, but is not limited to, [OIDC] standard claims :

The following additional claims MUST be supported:

Tokens

ID Token

Non-Normative Example - acr

{
  "iss": "https://www.holder.com.au",
  "sub": "a9ebbef6-1f0b-44eb-96cf-0c5b51b37ab2",
  "aud": "12345",
  "nonce": "n-0S6_WzA2Mj",
  "exp": 1311281970,
  "iat": 1311280970,
  "nbf": 1311280970,
  "auth_time": 1311280969,
  "acr": "urn:cds.au:cdr:3",
  "refresh_token_expires_at": 1311281970,
  "sharing_expires_at": 1311281970
}

ID Tokens are specified in section 2 of the [OIDC] standard. In accordance with [FAPI-RW], ID Tokens must be signed and encrypted when returned to a Data Recipient Software Product from both the Authorisation End Point and Token End Point.

In addition to the mandatory claims specified in section 2 of the [OIDC] standard, required claims for ID Tokens as part of Hybrid Flow authentication must align to section 3.3 (Authentication using the Hybrid Flow) of the [OIDC] standards and section 5.2.2 and section 8.4.3 of the [FAPI-RW] profile.

ID Tokens MUST be signed by Data Holders as specified in section 8.6 of [FAPI-RW].

The ID Token returned from the Authorisation End Point MUST NOT contain any Personal Information (PI) claims.

Hashing value for state and authorisation code

The c_hash value MUST be generated according to section 3.3.2.11 of [OIDC].

The s_hash value MUST be generated according to section 5.1 of [FAPI-RW].

Access Token

Access Tokens MUST be used as specified in section 10.3 of [OAUTH2].

An Access Token MUST expire between 2 minutes to 10 minutes after the Data Holder issues it (at the discretion of the Data Holder).

The process for refreshing an Access Token is described in section 12.1 of [OIDC].

Refresh Token

Refresh Tokens MUST be supported by Data Holders.

The usage of Refresh Tokens is specified in section 12 of [OIDC].

The expiration time for a Refresh Token MUST be set by the Data Holder.

Refresh Token expiration MAY be any length of time greater than 28 days but MUST NOT exceed the end of the duration of sharing consented to by the Consumer.

Data Holders MAY cycle Refresh Tokens when an Access Token is issued. If Refresh Token cycling is not performed then the Refresh Token MUST NOT expire before the expiration of the sharing consented by the Customer.

Token Expiry

The expiry time for issued access tokens and refresh tokens must be deterministic for the Data Recipient Software Product.

In order to achieve this:

Identifiers and Subject Types

sub claim

The identifier for an authenticated end-user (subject) MUST be passed in the sub claim of an ID Token and UserInfo response as defined by [OIDC].

The Data Holder MUST generate the sub value as a Pairwise Pseudonymous Identifier (PPID) as described in section 8 of [OIDC]. Furthermore, the identifier MUST be unique per customer as per the definition of customer in the CDR Federation section of this profile.

The Data Holder MUST support the sector_identifier_uri in PPID generation according to [OIDC] if this field was supplied by the client during registration.

It is RECOMMENDED that the sub value is generated as a version 4 Universally Unique Identifier (UUID) [RFC4122].

CDR Arrangement ID

Non-normative example: Token Endpoint hydration

Request

POST /token HTTP/1.1
Host: https://data.holder.com.au
Content-Type: application/x-www-form-urlencoded

client_id=s6BhdRkqt3
&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer
&client_assertion=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyNDU2In0.ey ...
&grant_type=refresh_token
&refresh_token=8xLOxBtZp8
&scope=openid%20profile

Response

{
  "access_token": "2YotnFZFEjr1zCsicMWpAA",
  "expires_in": 3600,
  "refresh_token": "tGzv3JOkF0XG5Qx2TlKWIA",
  "id_token": "eyJraWQiOiIxZTlnZGs3IiwiYWxnIjoiUl...",
  "cdr_arrangement_id": "02e7c9d9-cfe7-4c3e-8f64-e91173c84ecb"
}

Decoded JWT

{
  "iss": "https://data.holder.com.au",
  "sub": "a9ebbef6-1f0b-44eb-96cf-0c5b51b37ab2",
  "aud": "12345",
  "nonce": "n-0S6_WzA2Mj",
  "exp": 1311281970,
  "iat": 1311280970,
  "nbf": 1311280970,
  "auth_time": 1311280969,
  "acr": "urn:cds.au:cdr:3",
  "refresh_token_expires_at": 1311281970,
  "sharing_expires_at": 1311281970
}

Non-normative example: Token Introspection Endpoint hydration

Request

POST /token/introspect HTTP/1.1
Host: https://data.holder.com.au
Content-Type: application/x-www-form-urlencoded

client_id=s6BhdRkqt3
&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer
&client_assertion=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyNDU2In0.ey ...
&token=tGzv3JOkF0XG5Qx2TlKWIA
&token_type_hint=refresh_token

Response

{
  "active": true,
  "exp": 1311281970,
  "scope": "openid profile bank:accounts.basic:read bank:accounts.detail:read",
  "cdr_arrangement_id": "02e7c9d9-cfe7-4c3e-8f64-e91173c84ecb"
}

The CDR Arrangement ID is a unique string representing a consent arrangement between a Data Recipient Software Product and Data Holder for a given consumer.

The identifier MUST be unique per customer according to the definition of customer in the CDR Federation section of this profile.

The Data Holder MUST provide the CDR Arrangement ID as the claim cdr_arrangement_id in the Token End Point response and Token Introspection End Point response.

A Data Holder MUST only return the cdr_arrangement_id in the Token and Token Introspection End Point responses if they also support concurrent consent. This ensures that Data Recipient Software Products have a reliable way to determine whether a given Data Holder supports concurrent consent.

Statements related to the CDR Arrangement ID:

Obtaining a CDR Arrangement ID

For any existing consents, Data Holders must retrospectively generate a cdr_arrangement_id such that Data Recipient Software Products can obtain a valid cdr_arrangement_id for all active consents they hold.

A Data Recipient Software Product can call either the Token or Token Introspection End Points at any point post-consent to obtain the CDR Arrangement ID in the response JSON as the claim cdr_arrangement_id.

Levels of Assurance (LoAs)

Levels Of Assurance (LoAs), returned after a successful authentication MUST be represented in Single Ordinal form where a single LoA value is represented.

Single Ordinal

A Single LoA value is carried in the acr claim which is described in section 2 of [OIDC].

READ operations SHALL only be allowed where at least an LoA of 2 has been achieved during the establishment of consent.

WRITE operations SHALL only be allowed where:

Transaction Security

Use of TLS

All HTTP calls MUST be made using HTTPS incorporating TLS >= 1.2.

Use of MTLS

All back-channel communication between Data Recipient Software Product and Data Holder systems MUST incorporate, unless stated otherwise, [MTLS] as part of the TLS handshake:

End points for transferring CDR Data that are classified as not requiring authentication do not require the use of [MTLS].

Holder of Key Mechanism

[MTLS] MUST be supported as a Holder of Key (HoK) Mechanism.

Note that, by implication, resource requests MUST be validated to ensure the client certificate and access token match.

OAUTB SHALL NOT be supported due to a lack industry support.

[MTLS] HoK allows issued tokens to be bound to a client certificate as specified in section 3 of [MTLS].

Ciphers

Only the following cipher suites SHALL be permitted in accordance with section 8.5 of [FAPI-RW]:

Certificate Management

Issued by the Register for Data Holders

Certificate Function Notes
Server Certificate(s) Certificate is issued to a FQDN

Secures the following endpoints:
- Resource endpoints
- InfoSec endpoints
- Admin endpoints
It will be up to the DH on how these endpoints are segregated. They may all be on the one domain (so only one certificate required) or could be separated.

Issued by the Register CA for Data Recipients

Certificate Function Notes
Client Certificate Secures the following:
- Consuming Register APIs
- Consuming Data Holder APIs
Server Certificate(s) Certificate is issued to a FQDN.
Secures the following:
- Revocation endpoint
- CDR Arrangement Management endpoint
- JWKS endpoint
ADRs may choose to secure their endpoints with an the Register CA issued certificate or a certificate issued by a public CA.

CDR Certificate Authority

DigiCert acts as the certificate authority that issues and manages certificates to CDR participants as directed by the the Register in its capacity as the CDR Registrar.

Certificate Trust Model

The CDR utilises a private certificate trust chain for all Register CA secured endpoints being hosted by Data Holders, Data Recipients and the Register.

This trust chain encompasses a set of root and intermediate CAs issued for the test and production environments.

Test Environment CA Root Test
CA Intermediate Test
Production Environment CA Root Production
CA Intermediate Production

Certificate Signing Request Profile

When requesting the Register CA certificates, certificate signing requests will need to be provided, conforming to the following profile:

CSR Field Server Client
Common Name Primary DNS Name
e.g. api1.test.entity.com
Software Product Name OR
Brand Name
SAN (Optional) Secondary DNS Name(s)
e.g. api2.test.entity.com
N/A
Organization Brand Name (Legal Entity Name) Brand Name (Legal Entity Name)
Organizational Unit Consumer Data Right Consumer Data Right
Country Country of participant
e.g. AU
Country of participant
e.g. AU
Signature Algorithm SHA256 SHA256
Key Algorithm RSA RSA
Key Size 2048 2048

Please refer to the Register onboarding guide for further information on certificate issuance.

Certificate Usage

Further details on the Register CA issued certificates can be found in the ACCC Certificate Practice Statement V1.0.

Certificate Validation

Certificate validation must check:

1. Checking for certificate validity

Verify private key signature is mathematically linked to the presented public key certificate, presented certificate identifies trusted User/Application and/or Service and certificate is both valid and not revoked.

2. Issuer‐to‐subject name chaining

Signatures from Issuing CA’s and associated CA public key certificates are trusted, valid and not revoked.

3. Policy and key use constraints

Each certificate has the applicable and appropriate x.509 certificate extensions, e.g. CA and CRL signing, Digital Signing, Client and Server Authentication, etc.

4. Revocation Status

Status is checked through Certificate Revocation Lists (CRL) or Online Certificate Status Protocol (OCSP) responders, identified in each certificate in the chain.

The Certificate Practice Statement provides details for DigiCert's certificate validation requirements and a summary has been provided in the CDR Support Portal article: Certificate Validation.

OCSP stapling

The use of OCSP Stapling within the CDR ecosystem is not recommended.

CORS

Cross-origin resource sharing (CORS) must be enabled (ie. Access-Control-Allow-Origin set to "*") for the following end points:

Request Object

Non-Normative Example - acr as an Essential Claim

#Decoded Request Object JWT

{
  "iss": "s6BhdRkqt3",
  "exp": 1516239322,
  "aud": "https://www.recipient.com.au",
  "response_type": "code id_token",
  "client_id": "s6BhdRkqt3",
  "redirect_uri": "https://www.recipient.com.au/coolstuff",
  "scope": "openid profile bank:accounts.basic:read
            bank:accounts.detail:read",
  "nonce": "n-0S6_WzA2Mj",
  "state": "af0ifjsldkj",
  "claims": {
    "sharing_duration": 7776000,
    "cdr_arrangement_id": "02e7c9d9-cfe7-4c3e-8f64-e91173c84ecb",
    "id_token": {
      "acr": {
        "essential": true,
        "values": ["urn:cds.au:cdr:3"]
      }
    },
    "userinfo": {
      "given_name": null,
      "family_name": null
    }
  }
}

The Request Object is a signed and encoded JWT specified in section 6.1 of [OIDC]. As per [FAPI-RW] section 5.2.2, the request parameter MUST be present on requests to the [OIDC] Hybrid Authorisation End Point. The Request Object enables [OIDC] requests to be passed in a single and self-contained parameter.

Request Objects MUST be signed by Data Recipient Software Products as specified in section 8.6 of [FAPI-RW].

Request Object references MUST be supported if the Data Holder supports Pushed Authorisation Requests (PAR).

Requesting Sharing Duration

To facilitate the specification of the duration for consent to share CDR data that is approved by the consumer, a mechanism for the Data Recipient Software Product to specify a sharing duration to the Data Holder is required.

To accomplish this, the Data Holder MUST support an additional claim in the authorisation request object named sharing_duration. The sharing_duration claim MUST be handled as follows:

Note that the period of one year in the above statements should be interpreted as 365, 24 hour days (or 31,536,000 seconds).

The Data Recipient Software Product is able to obtain the expiration of sharing via the sharing_expires_at claim.

Specifying an existing arrangement

Provided a Data Holder supports PAR, they MUST also support the cdr_arrangement_id claim provided in the Request Object sent to the PAR End Point. The Data Recipient Software Product MAY provide the cdr_arrangement_id claim in the Request Object sent to the PAR End Point.

If a Data Recipient Software Product provides the cdr_arrangement_id claim in the request object to the Data Holder's PAR End Point, the Data Holder MUST revoke any existing tokens related to the arrangement once the new consent is successfully established and a new set of tokens has been provided to the Data Recipient Software Product.

Security Endpoints

OpenID Provider Configuration End Point

Non-Normative Example

## Request

GET /.well-known/openid-configuration HTTP/1.1
Host: www.dh.com.au

## Response

HTTP/1.1 200 OK
Content-Type: application/json
{
  "issuer": "https://www.dh.com.au",
  "authorization_endpoint": "https://www.dh.com.au/authorise",
  "token_endpoint": "https://www.dh.com.au/token",
  "introspection_endpoint": "https://www.dh.com.au/introspect",
  "revocation_endpoint": "https://www.dh.com.au/revoke",
  "userinfo_endpoint": "https://www.dh.com.au/userinfo",
  "registration_endpoint": "https://www.dh.com.au/register",
  "jwks_uri": "https://www.dh.com.au/jwks",
  "scopes_supported": ["openid", "profile", "..."],
  "response_types_supported": ["code id_token"],
  "response_modes_supported": ["fragment"],
  "grant_types_supported": ["authorization_code", "client_credentials", "urn:openid:params:modrna:grant-type:backchannel_request"],
  "acr_values_supported": ["urn:cds.au:cdr:2","urn:cds.au:cdr:3"],
  "subject_types_supported": ["pairwise"],
  "id_token_signing_alg_values_supported": ["ES256", "PS256"],
  "id_token_encryption_alg_values_supported": [ "RSA-OAEP", "RSA-OAEP-256", "dir", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A192KW", "ECDH-ES+A256KW", "A128KW", "A192KW", "A256KW", "A128GCMKW", "A192GCMKW", "A256GCMKW" ],
  "id_token_encryption_enc_values_supported": [ "A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512", "A128GCM", "A192GCM", "A256GCM" ],
  "cdr_arrangement_revocation_endpoint": "https://data.holder.com.au/arrangements/revoke",
  "pushed_authorization_request_endpoint": "https://data.holder.com.au/par",
  "request_object_signing_alg_values_supported": ["ES256", "PS256"],
  "token_endpoint_auth_methods_supported": ["private_key_jwt"],
  "tls_client_certificate_bound_access_tokens": true,
  "claims_supported": ["name", "given_name", "family_name", "acr", "auth_time", "sub", "refresh_token_expires_at", "sharing_expires_at"]
}
Description Value
Hosted By Data Holder
Transport Security TLS
Client Authentication Required No
Bearer Token Required No

Data Holders MUST make their OpenID Provider Metadata available via a configuration end point as outlined in Section 3 and 4 of the OpenID Connect Discovery standards [OIDD].

At a minimum, the Data Holder metadata MUST include:

Authorisation End Point

Non-Normative Example

## Request

GET /authorise?
   response_type=code%20id_token&client_id=12345&
   scope=openid%20profile%20bank:accounts.basic:read%20bank:accounts.detail:read&
   request=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMyJ9.ey ...
HTTP/1.1
Host: www.holder.com.au

## Decoded request JWT
{
  "alg": "PS256",
  "typ": "JWT",
  "kid": "123"
}
{
  "iss": "12345",
  "exp": 1516239322,
  "aud": "https://www.recipient.com.au",
  "response_type": "code id_token",
  "client_id": "12345",
  "redirect_uri": "https://www.recipient.com.au/coolstuff",
  "scope": "openid profile bank:accounts.basic:read bank:accounts.detail:read",
  "state": "af0ifjsldkj",
  "nonce": "n-0S6_WzA2Mj",
  "claims": {
    "sharing_duration": 7776000,
    "userinfo": {
      "given_name": null,
      "family_name": null
    },
    "id_token": {
      "acr": {
        "essential": true,
        "values": ["urn:cds.au:cdr:3"]
      }
    }
  }
}

Description Value
Hosted By Data Holder
Transport Security TLS
Client Authentication Required No
Bearer Token Required No

The requirements for the Authorisation End Point are specified in section 3.3.2 of [OIDC] and further specified under section 5.2.2 of [FAPI-RW]. This end point is invoked as part of the Hybrid Authentication flow.

JSON Web Key Set End Point

Description Value
Hosted By Data Holder & Data Recipient Software Product
Transport Security TLS
Client Authentication Required No
Bearer Token Required No

The requirements for the JWKS End Point are specified in various sections of [OIDC].

This end point is used by the Data Holder to provide the public keys they will use when required.

Data Holders MUST support a JWKS End Point.

Token End Point

Description Value
Hosted By Data Holder
Transport Security MTLS
Client Authentication Required Yes
Bearer Token Required No

The requirements for the Token End Point are specified in section 3.3.3 of [OIDC].

To obtain an Access Token, an ID Token, and a Refresh Token, the Data Recipient Software Product sends a Token Request to the Token End Point.

Data Holders MUST support a Token End Point.

UserInfo End Point

Description Value
Hosted By Data Holder
Transport Security MTLS
Client Authentication Required No
Bearer Token Required Yes

The requirements for the UserInfo End Point are specified in section 5.3 of [OIDC].

Data Holders MUST support a UserInfo End Point.

Introspection End Point

Description Value
Hosted By Data Holder
Transport Security MTLS
Client Authentication Required Yes
Bearer Token Required No

Data Holders MUST implement an Introspection End Point to allow Data Recipient Software Products to determine the status and expiry date of Refresh Tokens. The requirements for an Introspection End Point are described in section 2 of [RFC7662].

Introspection of Refresh Tokens MUST be supported.

Introspection of Access Tokens and ID Tokens MUST NOT be supported.

A Token Introspection End Point Response SHALL include, at least, the following fields:

A Token Introspection End Point Response MAY include claims defined in Section 2.2 of [RFC7662] but username SHALL NOT be allowed.

Token Revocation End Point

Description Value
Hosted By Data Holder
Transport Security MTLS
Client Authentication Required Yes
Bearer Token Required No

Requirements for Data Holder implementations

Data Holders MUST implement a Token Revocation End Point as described in section 2 of [RFC7009].

The Revocation End Point serves as a revocation mechanism that allows a Data Recipient Software Product to invalidate its tokens as required to allow for token clean up.

Revocation of Refresh Tokens and Access Tokens MUST be supported.

CDR Arrangement Revocation End Point

Non-Normative Example

Request

POST https://data.holder.com.au/arrangements/revoke
HTTP/1.1
Host: data.holder.com.au
Content-Type: application/x-www-form-urlencoded

  client_id=s6BhdRkqt3&
  client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&
  client_assertion=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyNDU2In0.ey ...&
  cdr_arrangement_id=5a1bf696-ee03-408b-b315-97955415d1f0
Description Value
Hosted By Data Holder & Data Recipient Software Product
Transport Security MTLS for Data Holders, TLS for Data Recipient Software Products
Client Authentication Required Yes (for Data Holders verifying Data Recipient Software Products)
Bearer Token Required Yes (for Data Recipient Software Products verifying Data Holders)

HTTP Method: POST

Data Holder Path: The cdr_arrangement_revocation_endpoint defined using OIDC Discovery

Data Recipient Software Product Path: <RecipientBaseUri>/arrangements/revoke where <RecipientBaseUri> is registered with the CDR Register.

Data Holders and Data Recipient Software Products MUST implement a CDR Arrangement Revocation End Point that can be used to revoke an existing sharing arrangement.

The request MUST include the following parameters using the application/x-www-form-urlencoded format in the HTTP request entity-body:


This end point will be implemented according to the following:

Response Codes

The following responses are in addition to error responses covered by normative references. Error scenarios in the following table MUST use the error structure defined in the Payload Conventions.

Response Code Situation Description
204 No Content Success The sharing arrangement has been revoked successfully
422 Unprocessable Entity Invalid Arrangement ID The client submitted an invalid arrangement identifier or the identifier could not be found. The server MUST respond with Invalid Consent Arrangement.

Revoking consent

Data Recipient Software Products MUST use the Data Holder's CDR Arrangement Revocation End Point with a valid cdr_arrangement_id to notify the Data Holder when consent is revoked by the consumer via the Data Recipient Software Product.

Data Holder's MUST use the Data Recipient Software Product's CDR Arrangement Revocation End Point with a valid cdr_arrangement_id to notify the Data Recipient Software Product when consent is revoked by the consumer via the Data Holder.

Data Holders calling Data Recipients

The location of the Data Recipient Software Product CDR Arrangement Revocation End Point is determined by the RecipientBaseURI provided by the Data Recipient Software Product in the client Software Statement Assertion (SSA).

Data Recipients calling Data Holders

The location of the Data Holder CDR Arrangement Revocation End Point is determined by the cdr_arrangement_revocation_endpoint in the Data Holder's OpenID Provider metadata.

Pushed Authorisation End Point

Non-Normative Example

Request

POST /par HTTP/1.1
     Host: data.holder.com.au
     Content-Type: application/x-www-form-urlencoded

request=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMyJ9.ey...

Decoded Request

{
  "iss": "s6BhdRkqt3",
  "exp": 1516239322,
  "aud": "https://www.recipient.com.au",
  "response_type": "code id_token",
  "client_id": "s6BhdRkqt3",
  "redirect_uri": "https://www.recipient.com.au/coolstuff",
  "scope": "openid profile bank:accounts.basic:read
            bank:accounts.detail:read",
  "nonce": "n-0S6_WzA2Mj",
  "state": "af0ifjsldkj",
  "claims": {
    "sharing_duration": 7776000,
    "cdr_arrangement_id": "02e7c9d9-cfe7-4c3e-8f64-e91173c84ecb",
    "id_token": {
      "acr": {
        "essential": true,
        "values": ["urn:cds.au:cdr:3"]
      }
    },
    "userinfo": {
      "given_name": null,
      "family_name": null
    }
  }
}

Response

HTTP/1.1 201 Created
Content-Type: application/json
Cache-Control: no-cache, no-store
{
  "request_uri": "urn:data.holder.com.au:bwc4JK-ESC0w8acc191e-Y1LTC2",
  "expires_in": 3600
}

Authorise

## This is used by the ADR in the subsequent authorisation request as follows
## (note that until PAR is an RFC standard, the mandatory oAuth parameters as
## per FAPI R/W for confidential clients must be replayed in the request URL):

GET /authorise?client_id=s6BhdRkqt3&
   response_type=code%20id_token&
   scope=openid%20profile%20bank:accounts.basic:read%20bank:accounts.detail:read&
   request_uri=urn%3Adata.holder.com.au%3Abwc4JK-ESC0w8acc191e-Y1LTC2
HTTP/1.1
Host: data.holder.com.au
Description Value
Hosted By Data Holder
Transport Security MTLS
Client Authentication Required Yes
Bearer Token Required No

Data Holders MUST support Pushed Authorisation Requests (PAR) via the pushed authorisation end point according to [PAR].

Data Recipient Software Products MAY send authorisation requests using [PAR] if supported by the Data Holder. Request objects which contain the cdr_arrangement_id claim MUST only be sent using [PAR]. If a Data Holder does not support [PAR], a Data Recipient Software Product SHOULD NOT provide the cdr_arrangement_id claim in the request object.

The Data Holder response provides the Data Recipient Software Product with a Request URI in the response. The Request URI is then passed to the Data Holder’s Authorisation End Point to initiate an authorisation flow.

In addition:

Dynamic Client Registration Endpoints

Data Holders MUST expose the following endpoints in accordance with [DCR].

For more details of these endpoints see the DCR Apis section.

For additional statements on the operation of these endpoint during client registration see the Client Registration section.

HTTP Verb Auth Server Support TLS-MA HoK Grant Type Access Token Scope
POST /register Required N/A None
GET /register/{clientID} Required Client Credentials cdr:registration
PUT /register/{clientID} Required Client Credentials cdr:registration
DELETE /register/{clientID} Optional Client Credentials cdr:registration

Additional statements regarding these endpoings:

Register Endpoints

The CDR Register exposes an OIDC Configuration Endpoint with associated JWKS and token endpoints to faciliate issuance of access tokens to consume the protected Register APIs.

Retrieve CDR Register OIDC Discovery Endpoint

GET /.well-known/openid-configuration HTTP/1.1
Host: cdr.register

## Response
{
    "issuer": "https://cdr.register/idp",
    "jwks_uri": "https://cdr.register/idp/.well-known/openid-configuration/jwks",
    "token_endpoint": "https://cdr.register/idp/connect/token",
    "claims_supported": ["sub"],
    "id_token_signing_alg_values_supported": ["PS256"],
    "subject_types_supported": ["public"],
    "scopes_supported": ["cdr-register:bank:read"],
    "response_types_supported": ["token"],
    "grant_types_supported": ["client_credentials"],
    "token_endpoint_auth_methods_supported": ["private_key_jwt"],
    "tls_client_certificate_bound_access_tokens": true,
    "request_object_signing_alg_values_supported": ["PS256"]
}

Participant Endpoints

OIDC Discovery Configuration Endpoint

<InfoSecBaseUri>/.well-known/openid-configuration

Participants will be required to register base URIs against each of their brands to facilitate the implementation of the Consumer Data Standards

Base URI DH Brand ADR Brand Description
PublicBaseUri Base URI for the Consumer Data Standard public endpoints. This should encompass all endpoints not requiring authentication
ResourceBaseUri Base URI for the Consumer Data Standard resource endpoints. This should encompass all CDS resource endpoints requiring authentication
InfoSecBaseUri Base URI for the Consumer Data Standard InfoSec endpoints. This provides ADRs reference to the OIDC Discovery Endpoint
AdminBaseUri Base URI for the Consumer Data Standard admin endpoints called by the CDR Register
ExtensionBaseUri Base URI for the Data Holder extension endpoints to the Consumer Data Standard (optional)
RevocationUri Used for consent withdrawal notification from a Data Holder and is populated in the SSA
RecipientBaseUri Base URI for the Consumer Data Standard Data Recipient Software Product endpoints.
This should be the base to provide reference to Data Recipient Endpoints
JwksUri DH: Used for client authentication for DH -> DRSP communication and is populated in the GetDataHolderBrands API
DR: Used for client authentication for DRSP -> DH & Register communication and is populated in the SSA

Normative References

Reference Description Version
[FAPI-R] Financial-grade API - Part 1: Read Only API Security Profile: https://openid.net/specs/openid-financial-api-part-1-ID2.html Draft-06
[FAPI-RW] Financial-grade API - Part 2: Read and Write API Security Profile: https://openid.net/specs/openid-financial-api-part-2-ID2.html Draft-06
[JSON] The JavaScript Object Notation (JSON) Data Interchange Format: https://tools.ietf.org/html/rfc8259 Dec 2017
[JWA] JSON Web Algorithms (JWA): https://tools.ietf.org/html/rfc7518 May 2015
[JWK] JSON Web Key (JWK): https://tools.ietf.org/html/rfc7517 May 2015
[JWT] JSON Web Token (JWT): https://tools.ietf.org/html/rfc7519 May 2015
[JWS] JSON Web Signature (JWS): https://tools.ietf.org/html/rfc7797 Feb 2016
[JWE] JSON Web Encryption (JWE): https://tools.ietf.org/html/rfc7516 May 2015
[MTLS] OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access Tokens: https://tools.ietf.org/html/rfc8705 Feb 2020
[OAUTH2] The OAuth 2.0 Authorization Framework: https://tools.ietf.org/html/rfc6749 Oct 2012
[OIDC] OpenID Connect Core 1.0 incorporating errata set 1: http://openid.net/specs/openid-connect-core-1_0.html Nov 2014
[OIDD] OpenID Connect Discovery 1.0 incorporating errata set 1: http://openid.net/specs/openid-connect-discovery-1_0.html Nov 2014
[TDIF] Digital Transformation Agency - Trusted Digital Identity Framework https://www.dta.gov.au/our-projects/digital-identity/trusted-digital-identity-framework Apr 2019
[RFC2119] Key words for use in RFCs to Indicate Requirement Levels https://tools.ietf.org/html/rfc2119 Mar 1997
[RFC7009] OAuth 2.0 Token Revocation: https://tools.ietf.org/html/rfc7009 Aug 2013
[RFC7523] JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants: https://tools.ietf.org/html/rfc7523 May 2015
[RFC7662] OAuth 2.0 Token Introspection: https://tools.ietf.org/html/rfc7662 Oct 2015
[RFC6750] The OAuth 2.0 Authorization Framework: Bearer Token Usage: https://tools.ietf.org/html/rfc6750 Oct 2012
[PAR] OAuth 2.0 Pushed Authorization Requests: https://tools.ietf.org/html/draft-ietf-oauth-par-01 Feb 2020
[DCR] OAuth 2.0 Dynamic Client Registration Protocol: https://datatracker.ietf.org/doc/html/rfc7591 Jul 2015

Informative References

Reference Description
[BCP195] Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS): https://tools.ietf.org/html/bcp195
[RFC7231] Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content: https://tools.ietf.org/html/rfc7231
[CDR] Consumer Data Right: https://www.accc.gov.au/focus-areas/consumer-data-right
[FAPI] Financial-Grade API - Home Page https://openid.net/wg/fapi/
[RFC4122] A Universally Unique Identifier (UUID) URN Namespace: https://tools.ietf.org/html/rfc4122
[X.1254] X.1254 - Entity authentication assurance framework: https://www.itu.int/rec/T-REC-X1254-201209-I/en

DCR APIs

This specification defines the APIs for Data Holders exposing Dynamic Client Registration endpoints.


DCR Swagger (JSON)
DCR Swagger (YAML)

Register Data Recipient oAuth Client

Code samples

POST https://data.holder.com.au/register/register HTTP/1.1
Host: data.holder.com.au
Content-Type: application/jwt
Accept: application/json

var headers = {
  'Content-Type':'application/jwt',
  'Accept':'application/json'

};

$.ajax({
  url: 'https://data.holder.com.au/register/register',
  method: 'post',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

POST /register

Register a client using a CDR Register issued Software Statement Assertion.

Body parameter

Endpoint Version

Version undefined

Parameters

Name In Type Required Description
body body ClientRegistrationRequest mandatory The registration request JWT to be used to register with a Data Holder.

Example responses

201 Response

{
  "client_id": "35a5a70b-5b8d-41f4-9cbd-96cfbc15c58a",
  "client_id_issued_at": 1571808167,
  "client_name": "Mock Software",
  "client_description": "A mock software product",
  "client_uri": "https://www.mockcompany.com.au",
  "legal_entity_id": "344F0E809-BDBE-4F8E-BD30-5E6C3CB78D7B",
  "legal_entity_name": "Mock Company Pty Ltd.",
  "org_id": "3B0B0A7B-3E7B-4A2C-9497-E357A71D07C8",
  "org_name": "Mock Company Brand.",
  "redirect_uris": [
    "https://www.mockcompany.com.au/redirects/redirect1",
    "https://www.mockcompany.com.au/redirects/redirect2"
  ],
  "sector_identifier_uri": "https://www.mockcompany.com.au/sector_identifier.json",
  "logo_uri": "https://www.mockcompany.com.au/logos/logo1.png",
  "tos_uri": "https://www.mockcompany.com.au/tos.html",
  "policy_uri": "https://www.mockcompany.com.au/policy.html",
  "jwks_uri": "https://www.mockcompany.com.au/jwks",
  "revocation_uri": "https://www.mockcompany.com.au/revocation",
  "recipient_base_uri": "https://www.mockcompany.com.au",
  "token_endpoint_auth_method": "private_key_jwt",
  "token_endpoint_auth_signing_alg": "PS256",
  "grant_types": [
    "client_credentials"
  ],
  "response_types": [
    "code id_token"
  ],
  "application_type": "web",
  "id_token_signed_response_alg": "PS256",
  "id_token_encrypted_response_alg": "RSA-OAEP",
  "id_token_encrypted_response_enc": "A256GCM",
  "request_object_signing_alg": "PS256",
  "software_statement": "string",
  "software_id": "740C368F-ECF9-4D29-A2EA-0514A66B0CDE",
  "software_roles": "data-recipient-software-product",
  "scope": "openid profile bank:accounts.basic:read bank:accounts.detail:read bank:transactions:read bank:payees:read bank:regular_payments:read common:customer.basic:read common:customer.detail:read cdr:registration"
}

Responses

Status Meaning Description Schema
201 Created Client registration success RegistrationProperties
400 Bad Request Request failed due to client error RegistrationError

Get oAuth Client Registration

Code samples

GET https://data.holder.com.au/register/register/{ClientId} HTTP/1.1
Host: data.holder.com.au
Accept: application/json
Authorization: string

var headers = {
  'Accept':'application/json',
  'Authorization':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/register/register/{ClientId}',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /register/{ClientId}

Get a Client Registration for a given Client ID.

Endpoint Version

Version undefined

Parameters

Name In Type Required Description
ClientId path string mandatory The client ID issued by the target Data Holder
Authorization header string mandatory An Authorisation Token as per RFC6750

Example responses

200 Response

{
  "client_id": "35a5a70b-5b8d-41f4-9cbd-96cfbc15c58a",
  "client_id_issued_at": 1571808167,
  "client_name": "Mock Software",
  "client_description": "A mock software product",
  "client_uri": "https://www.mockcompany.com.au",
  "legal_entity_id": "344F0E809-BDBE-4F8E-BD30-5E6C3CB78D7B",
  "legal_entity_name": "Mock Company Pty Ltd.",
  "org_id": "3B0B0A7B-3E7B-4A2C-9497-E357A71D07C8",
  "org_name": "Mock Company Brand.",
  "redirect_uris": [
    "https://www.mockcompany.com.au/redirects/redirect1",
    "https://www.mockcompany.com.au/redirects/redirect2"
  ],
  "sector_identifier_uri": "https://www.mockcompany.com.au/sector_identifier.json",
  "logo_uri": "https://www.mockcompany.com.au/logos/logo1.png",
  "tos_uri": "https://www.mockcompany.com.au/tos.html",
  "policy_uri": "https://www.mockcompany.com.au/policy.html",
  "jwks_uri": "https://www.mockcompany.com.au/jwks",
  "revocation_uri": "https://www.mockcompany.com.au/revocation",
  "recipient_base_uri": "https://www.mockcompany.com.au",
  "token_endpoint_auth_method": "private_key_jwt",
  "token_endpoint_auth_signing_alg": "PS256",
  "grant_types": [
    "client_credentials"
  ],
  "response_types": [
    "code id_token"
  ],
  "application_type": "web",
  "id_token_signed_response_alg": "PS256",
  "id_token_encrypted_response_alg": "RSA-OAEP",
  "id_token_encrypted_response_enc": "A256GCM",
  "request_object_signing_alg": "PS256",
  "software_statement": "string",
  "software_id": "740C368F-ECF9-4D29-A2EA-0514A66B0CDE",
  "software_roles": "data-recipient-software-product",
  "scope": "openid profile bank:accounts.basic:read bank:accounts.detail:read bank:transactions:read bank:payees:read bank:regular_payments:read common:customer.basic:read common:customer.detail:read cdr:registration"
}

Responses

Status Meaning Description Schema
200 OK Client registration retrieval success RegistrationProperties
401 Unauthorized Request failed due to unknown or invalid Client or invalid access token None
403 Forbidden The client does not have permission to read, update or delete the Client None

Response Headers

Status Header Type Format Description
401 WWW-Authenticate string The Response Header Field as per RFC6750

Update Data Recipient Registration

Code samples

PUT https://data.holder.com.au/register/register/{ClientId} HTTP/1.1
Host: data.holder.com.au
Content-Type: application/jwt
Accept: application/json
Authorization: string

var headers = {
  'Content-Type':'application/jwt',
  'Accept':'application/json',
  'Authorization':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/register/register/{ClientId}',
  method: 'put',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

PUT /register/{ClientId}

Update a Client Registration for a given Client ID.

Body parameter

Endpoint Version

Version undefined

Parameters

Name In Type Required Description
ClientId path string mandatory The client ID issued by the target Data Holder
Authorization header string mandatory An Authorisation Token as per RFC6750
body body ClientRegistrationRequest mandatory The registration request JWT to be used to register with a Data Holder.

Example responses

200 Response

{
  "client_id": "35a5a70b-5b8d-41f4-9cbd-96cfbc15c58a",
  "client_id_issued_at": 1571808167,
  "client_name": "Mock Software",
  "client_description": "A mock software product",
  "client_uri": "https://www.mockcompany.com.au",
  "legal_entity_id": "344F0E809-BDBE-4F8E-BD30-5E6C3CB78D7B",
  "legal_entity_name": "Mock Company Pty Ltd.",
  "org_id": "3B0B0A7B-3E7B-4A2C-9497-E357A71D07C8",
  "org_name": "Mock Company Brand.",
  "redirect_uris": [
    "https://www.mockcompany.com.au/redirects/redirect1",
    "https://www.mockcompany.com.au/redirects/redirect2"
  ],
  "sector_identifier_uri": "https://www.mockcompany.com.au/sector_identifier.json",
  "logo_uri": "https://www.mockcompany.com.au/logos/logo1.png",
  "tos_uri": "https://www.mockcompany.com.au/tos.html",
  "policy_uri": "https://www.mockcompany.com.au/policy.html",
  "jwks_uri": "https://www.mockcompany.com.au/jwks",
  "revocation_uri": "https://www.mockcompany.com.au/revocation",
  "recipient_base_uri": "https://www.mockcompany.com.au",
  "token_endpoint_auth_method": "private_key_jwt",
  "token_endpoint_auth_signing_alg": "PS256",
  "grant_types": [
    "client_credentials"
  ],
  "response_types": [
    "code id_token"
  ],
  "application_type": "web",
  "id_token_signed_response_alg": "PS256",
  "id_token_encrypted_response_alg": "RSA-OAEP",
  "id_token_encrypted_response_enc": "A256GCM",
  "request_object_signing_alg": "PS256",
  "software_statement": "string",
  "software_id": "740C368F-ECF9-4D29-A2EA-0514A66B0CDE",
  "software_roles": "data-recipient-software-product",
  "scope": "openid profile bank:accounts.basic:read bank:accounts.detail:read bank:transactions:read bank:payees:read bank:regular_payments:read common:customer.basic:read common:customer.detail:read cdr:registration"
}

Responses

Status Meaning Description Schema
200 OK Client registration update success RegistrationProperties
400 Bad Request Request failed due to client error RegistrationError
401 Unauthorized Request failed due to unknown or invalid Client or invalid access token None
403 Forbidden The client does not have permission to read, update or delete the Client None

Response Headers

Status Header Type Format Description
401 WWW-Authenticate string The Response Header Field as per RFC6750

Delete Data Recipient oAuth Client Registration

Code samples

DELETE https://data.holder.com.au/register/register/{ClientId} HTTP/1.1
Host: data.holder.com.au

Authorization: string

var headers = {
  'Authorization':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/register/register/{ClientId}',
  method: 'delete',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

DELETE /register/{ClientId}

Delete a Client Registration for a given Client ID.

Endpoint Version

Version undefined

Parameters

Name In Type Required Description
ClientId path string mandatory The client ID issued by the target Data Holder
Authorization header string mandatory An Authorisation Token as per RFC6750

Responses

Status Meaning Description Schema
204 No Content Client deleted None
401 Unauthorized Request failed due to unknown or invalid Client or invalid access token None
403 Forbidden The client does not have permission to read, update or delete the Client None
405 Method Not Allowed Method Not Allowed. The requested method is unsupported None

Response Headers

Status Header Type Format Description
401 WWW-Authenticate string The Response Header Field as per RFC6750

Schemas

ClientRegistrationRequest

"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

The registration request JWT to be used to register with a Data Holder.

Properties

Name Type Required Description
anonymous string(JWT) mandatory The registration request JWT to be used to register with a Data Holder.

RegistrationProperties

{
  "client_id": "35a5a70b-5b8d-41f4-9cbd-96cfbc15c58a",
  "client_id_issued_at": 1571808167,
  "client_name": "Mock Software",
  "client_description": "A mock software product",
  "client_uri": "https://www.mockcompany.com.au",
  "legal_entity_id": "344F0E809-BDBE-4F8E-BD30-5E6C3CB78D7B",
  "legal_entity_name": "Mock Company Pty Ltd.",
  "org_id": "3B0B0A7B-3E7B-4A2C-9497-E357A71D07C8",
  "org_name": "Mock Company Brand.",
  "redirect_uris": [
    "https://www.mockcompany.com.au/redirects/redirect1",
    "https://www.mockcompany.com.au/redirects/redirect2"
  ],
  "sector_identifier_uri": "https://www.mockcompany.com.au/sector_identifier.json",
  "logo_uri": "https://www.mockcompany.com.au/logos/logo1.png",
  "tos_uri": "https://www.mockcompany.com.au/tos.html",
  "policy_uri": "https://www.mockcompany.com.au/policy.html",
  "jwks_uri": "https://www.mockcompany.com.au/jwks",
  "revocation_uri": "https://www.mockcompany.com.au/revocation",
  "recipient_base_uri": "https://www.mockcompany.com.au",
  "token_endpoint_auth_method": "private_key_jwt",
  "token_endpoint_auth_signing_alg": "PS256",
  "grant_types": [
    "client_credentials"
  ],
  "response_types": [
    "code id_token"
  ],
  "application_type": "web",
  "id_token_signed_response_alg": "PS256",
  "id_token_encrypted_response_alg": "RSA-OAEP",
  "id_token_encrypted_response_enc": "A256GCM",
  "request_object_signing_alg": "PS256",
  "software_statement": "string",
  "software_id": "740C368F-ECF9-4D29-A2EA-0514A66B0CDE",
  "software_roles": "data-recipient-software-product",
  "scope": "openid profile bank:accounts.basic:read bank:accounts.detail:read bank:transactions:read bank:payees:read bank:regular_payments:read common:customer.basic:read common:customer.detail:read cdr:registration"
}

Properties

Name Type Required Description
client_id string mandatory Data Holder issued client identifier string
client_id_issued_at integer(int32) optional Time at which the client identifier was issued expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC
client_name string mandatory Human-readable string name of the software product to be presented to the end-user during authorization
client_description string mandatory Human-readable string name of the software product description to be presented to the end user during authorization
client_uri string mandatory URL string of a web page providing information about the client
legal_entity_id string optional A unique identifier string assigned by the CDR Register that identifies the Accredited Data Recipient Legal Entity
legal_entity_name string optional Human-readable string name of the Accredited Data Recipient Legal Entity
org_id string mandatory A unique identifier string assigned by the CDR Register that identifies the Accredited Data Recipient Brand
org_name string mandatory Human-readable string name of the Accredited Data Recipient to be presented to the end user during authorization
redirect_uris [string] mandatory Array of redirection URI strings for use in redirect-based flows. If used, redirect_uris MUST match or be a subset of the redirect_uris as defined in the SSA
sector_identifier_uri string optional URL string referencing the client sector identifier URI, used as an optional input to the Pairwise Identifier
logo_uri string mandatory URL string that references a logo for the client. If present, the server SHOULD display this image to the end-user during approval
tos_uri string optional URL string that points to a human-readable terms of service document for the Software Product
policy_uri string optional URL string that points to a human-readable policy document for the Software Product
jwks_uri string mandatory URL string referencing the client JSON Web Key (JWK) Set [RFC7517] document, which contains the client public keys
revocation_uri string optional URI string that references the location of the Software Product consent revocation endpoint
recipient_base_uri string optional Base URI for the Consumer Data Standard Data Recipient endpoints. This should be the base to provide reference to all other Data Recipient Endpoints
token_endpoint_auth_method string mandatory The requested authentication method for the token endpoint
token_endpoint_auth_signing_alg string mandatory The algorithm used for signing the JWT
grant_types [string] mandatory Array of OAuth 2.0 grant type strings that the client can use at the token endpoint
response_types [string] mandatory Array of the OAuth 2.0 response type strings that the client can use at the authorization endpoint.
application_type string optional Kind of the application. The only supported application type will be web
id_token_signed_response_alg string optional Algorithm with which an id_token is to be signed
id_token_encrypted_response_alg string mandatory JWE alg algorithm with which an id_token is to be encrypted
id_token_encrypted_response_enc string mandatory JWE enc algorithm with which an id_token is to be encrypted
request_object_signing_alg string mandatory Algorithm which the ADR expects to sign the request object if a request object will be part of the authorization request sent to the Data Holder
software_statement string(JWT) mandatory The Software Statement Assertion, as defined in CDR standards
software_id string mandatory String representing a unique identifier assigned by the Register and used by registration endpoints to identify the software product to be dynamically registered.

The "software_id" will remain the same for the lifetime of the product, across multiple updates and versions
software_roles string optional String containing a role of the software in the CDR Regime. Initially the only value used with be data-recipient-software-product
scope string mandatory String containing a space-separated list of scope values that the client can use when requesting access tokens.

Enumerated Values

Property Value
token_endpoint_auth_method private_key_jwt
token_endpoint_auth_signing_alg PS256
token_endpoint_auth_signing_alg ES256
application_type web
id_token_signed_response_alg PS256
id_token_signed_response_alg ES256
request_object_signing_alg PS256
request_object_signing_alg ES256

ClientRegistration

{
  "iss": "CDR Software Product ID",
  "iat": 1571808167,
  "exp": 2147483646,
  "jti": "37747cd1c10545699f754adf28b73e31",
  "aud": "https://secure.api.dataholder.com/issuer",
  "client_id": "35a5a70b-5b8d-41f4-9cbd-96cfbc15c58a",
  "client_id_issued_at": 1571808167,
  "client_name": "Mock Software",
  "client_description": "A mock software product",
  "client_uri": "https://www.mockcompany.com.au",
  "legal_entity_id": "344F0E809-BDBE-4F8E-BD30-5E6C3CB78D7B",
  "legal_entity_name": "Mock Company Pty Ltd.",
  "org_id": "3B0B0A7B-3E7B-4A2C-9497-E357A71D07C8",
  "org_name": "Mock Company Brand.",
  "redirect_uris": [
    "https://www.mockcompany.com.au/redirects/redirect1",
    "https://www.mockcompany.com.au/redirects/redirect2"
  ],
  "sector_identifier_uri": "https://www.mockcompany.com.au/sector_identifier.json",
  "logo_uri": "https://www.mockcompany.com.au/logos/logo1.png",
  "tos_uri": "https://www.mockcompany.com.au/tos.html",
  "policy_uri": "https://www.mockcompany.com.au/policy.html",
  "jwks_uri": "https://www.mockcompany.com.au/jwks",
  "revocation_uri": "https://www.mockcompany.com.au/revocation",
  "recipient_base_uri": "https://www.mockcompany.com.au",
  "token_endpoint_auth_method": "private_key_jwt",
  "token_endpoint_auth_signing_alg": "PS256",
  "grant_types": [
    "client_credentials"
  ],
  "response_types": [
    "code id_token"
  ],
  "application_type": "web",
  "id_token_signed_response_alg": "PS256",
  "id_token_encrypted_response_alg": "RSA-OAEP",
  "id_token_encrypted_response_enc": "A256GCM",
  "request_object_signing_alg": "PS256",
  "software_statement": "string",
  "software_id": "740C368F-ECF9-4D29-A2EA-0514A66B0CDE",
  "software_roles": "data-recipient-software-product",
  "scope": "openid profile bank:accounts.basic:read bank:accounts.detail:read bank:transactions:read bank:payees:read bank:regular_payments:read common:customer.basic:read common:customer.detail:read cdr:registration"
}

Properties

allOf

Name Type Required Description
anonymous object mandatory none
» iss string mandatory Contains the identifier for the ADR Software Product (SoftwareProductId) as defined in the CDR Register
» iat integer(int32) mandatory The time at which the request was issued by the Data Recipient expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC
» exp integer(int32) mandatory The time at which the request expires expressed as seconds since 1970-01-01T00:00:00Z as measured in UTC
» jti string mandatory Unique identifier for the JWT, used to prevent replay of the token
» aud string mandatory 'Contains the Data Holder issuer value as described in the OIDC Discovery Document

and

Name Type Required Description
anonymous RegistrationProperties mandatory none

RegistrationError

{
  "error": "invalid_redirect_uri",
  "error_description": "string"
}

Properties

Name Type Required Description
error string mandatory Predefined error code as described in section 3.3 OIDC Dynamic Client Registration
error_description string optional Additional text description of the error for debugging.

Enumerated Values

Property Value
error invalid_redirect_uri
error invalid_client_metadata
error invalid_software_statement
error unapproved_software_statement

Register APIs

This following provides an overview of the Register APIs for Data Holders and Data Recipients to collect participant metadata. These endpoints are exposed by the Register and consumed by Data Holders and Data Recipients.


Register Swagger (JSON)
Register Swagger (YAML)

API Caller Description MTLS TLS Bearer Token
Get Register OpenId Provider Config Data Recipient Brand or Software Product Discovery of CDR Register OpenID Configuration
Get Register JWKS Data Holder Validate SSA and CDR Register authentication JWT signatures
Get Data Holder Brands Data Recipient Brand or Software Product Discovery of Data Holder Brands and their associated endpoints
Get Data Recipient Software Statement Assertion Data Recipient Brand or Software Product Get SSA for a Software Product to be used in Dynamic Client Registration
Get Data Recipient Software Products Status Data Holder Brand Software Product Statuses to check validity of ADR requests
Get Data Recipient Statuses Data Holder Brand Data Recipient Statuses to check validity of ADR requests
Get Data Recipients Data Holder Brand Data Recipient, brand and product details to render Data Holder Consumer Dashboard

Base URLs:

Production TLS https://api.cdr.gov.au
Production mTLS https://secure.api.cdr.gov.au

Get OpenId Provider Config

Code samples

GET https://register.cdr.gov.au/cdr-register/v1/.well-known/openid-configuration HTTP/1.1
Host: register.cdr.gov.au
Accept: application/json

var headers = {
  'Accept':'application/json'

};

$.ajax({
  url: 'https://register.cdr.gov.au/cdr-register/v1/.well-known/openid-configuration',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /.well-known/openid-configuration

Endpoint used by participants to discover the CDR Register OpenID configuration and obtain information needed to interact with it, including its OAuth 2.0 endpoint locations.

Endpoint Version

Version undefined

Example responses

200 Response

{
  "issuer": "string",
  "jwks_uri": "string",
  "token_endpoint": "string",
  "claims_supported": [
    "string"
  ],
  "id_token_signing_alg_values_supported": [
    "string"
  ],
  "subject_types_supported": [
    "string"
  ],
  "code_challenge_methods_supported": [
    "string"
  ],
  "scopes_supported": [
    "string"
  ],
  "response_types_supported": [
    "string"
  ],
  "grant_types_supported": [
    "string"
  ],
  "token_endpoint_auth_methods_supported": [
    "string"
  ],
  "tls_client_certificate_bound_access_tokens": true,
  "request_object_signing_alg_values_supported": [
    "string"
  ]
}

Responses

Status Meaning Description Schema
200 OK The OpenID Provider Configuration Metadata values ResponseOpenIDProviderConfigMetadata

Get JWKS

Code samples

GET https://register.cdr.gov.au/cdr-register/v1/jwks HTTP/1.1
Host: register.cdr.gov.au
Accept: application/json

var headers = {
  'Accept':'application/json'

};

$.ajax({
  url: 'https://register.cdr.gov.au/cdr-register/v1/jwks',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /jwks

JWKS endpoint containing the public keys used by the CDR Register to validate the signature of issued SSAs and authenticate outbound calls to participants in the CDR.

Endpoint Version

Version undefined

Example responses

200 Response

{
  "keys": [
    {
      "alg": "string",
      "e": "string",
      "key_ops": [
        "string"
      ],
      "kid": "string",
      "kty": "string",
      "n": "string"
    }
  ]
}

Responses

Status Meaning Description Schema
200 OK A JSON object that represents a set of JWKs ResponseJWKS

Get Data Holder Brands

Code samples

GET https://register.cdr.gov.au/cdr-register/v1/{industry}/data-holders/brands HTTP/1.1
Host: register.cdr.gov.au
Accept: application/json
Authorization Endpoint (Register): string
x-v: string

var headers = {
  'Accept':'application/json',
  'Authorization Endpoint (Register)':'string',
  'x-v':'string'

};

$.ajax({
  url: 'https://register.cdr.gov.au/cdr-register/v1/{industry}/data-holders/brands',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /{industry}/data-holders/brands

Allows Data Recipients to discover data holder brands available in the CDR ecosystem.

Endpoint Version

Version 1

Parameters

Name In Type Required Description
industry path string mandatory The industry the participant is retrieving data for (Banking, etc)
updated-since query string(date-time) optional query filter returns data holder brands updated since the specified date-time
page query integer(int32) optional the page number to return
page-size query integer(int32) optional the number of records to return per page
Authorization Endpoint (Register) header string mandatory An Authorisation Token as per RFC6750.
x-v header string optional The version of the API end point requested by the client. Must be set to a positive integer.

Enumerated Values

Parameter Value
industry banking

Example responses

200 Response

{
  "data": [
    {
      "dataHolderBrandId": "string",
      "brandName": "string",
      "industry": "banking",
      "logoUri": "string",
      "legalEntity": {
        "legalEntityId": "string",
        "legalEntityName": "string",
        "logoUri": "string",
        "registrationNumber": "string",
        "registrationDate": "2019-08-24",
        "registeredCountry": "string",
        "abn": "string",
        "acn": "string",
        "arbn": "string",
        "industryCode": "string",
        "organisationType": "SOLE_TRADER"
      },
      "status": "ACTIVE",
      "endpointDetail": {
        "version": "string",
        "publicBaseUri": "string",
        "resourceBaseUri": "string",
        "infosecBaseUri": "string",
        "extensionBaseUri": "string",
        "websiteUri": "string"
      },
      "authDetails": [
        {
          "registerUType": "SIGNED-JWT",
          "jwksEndpoint": "string"
        }
      ],
      "lastUpdated": "2019-08-24T14:15:22Z"
    }
  ],
  "links": {
    "first": "string",
    "last": "string",
    "next": "string",
    "prev": "string",
    "self": "string"
  },
  "meta": {
    "totalPages": 0,
    "totalRecords": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseRegisterDataHolderBrandList
400 Bad Request Bad Request
Invalid industry path parameter
ResponseErrorList
401 Unauthorized Invalid Bearer Token None
406 Not Acceptable Invalid x-v header
Invalid Accept header
None

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the CDR Register has responded with.

Get Data Recipient Software Statement Assertion (SSA)

Code samples

GET https://register.cdr.gov.au/cdr-register/v1/{industry}/data-recipients/brands/{dataRecipientBrandId}/software-products/{softwareProductId}/ssa HTTP/1.1
Host: register.cdr.gov.au
Accept: application/json
Authorization Endpoint (Register): string
x-v: string

var headers = {
  'Accept':'application/json',
  'Authorization Endpoint (Register)':'string',
  'x-v':'string'

};

$.ajax({
  url: 'https://register.cdr.gov.au/cdr-register/v1/{industry}/data-recipients/brands/{dataRecipientBrandId}/software-products/{softwareProductId}/ssa',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /{industry}/data-recipients/brands/{dataRecipientBrandId}/software-products/{softwareProductId}/ssa

Get a Software Statement Assertion (SSA) for a Data Recipient software product on the CDR Register to be used for Dynamic Client Registration with a Data Holder Brand.

Endpoint Version

Version 2

Parameters

Name In Type Required Description
industry path string mandatory The industry the participant is retrieving data for (Banking, etc)
dataRecipientBrandId path string mandatory Unique id for the Accredited Data Recipient Brand that the Software Product is associated with in the CDR Register
softwareProductId path string mandatory Unique id for the Accredited Data Recipient Software Product in the CDR Register
Authorization Endpoint (Register) header string mandatory An Authorisation Token as per RFC6750.
x-v header string optional The version of the API end point requested by the client. Must be set to a positive integer.

Enumerated Values

Parameter Value
industry banking

Example responses

200 Response

"string"

Responses

Status Meaning Description Schema
200 OK Success string
400 Bad Request Invalid industry path parameter
Invalid SoftwareProductId
ResponseErrorList
401 Unauthorized Invalid Bearer Token None
403 Forbidden Invalid BrandId ResponseErrorList
406 Not Acceptable Invalid x-v header
Invalid Accept header
None
422 Unprocessable Entity SSA fields invalid or incomplete ResponseErrorList

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the CDR Register has responded with.

Get Data Recipient Software Products Statuses

Code samples

GET https://register.cdr.gov.au/cdr-register/v1/{industry}/data-recipients/brands/software-products/status HTTP/1.1
Host: register.cdr.gov.au
Accept: application/json
x-v: string

var headers = {
  'Accept':'application/json',
  'x-v':'string'

};

$.ajax({
  url: 'https://register.cdr.gov.au/cdr-register/v1/{industry}/data-recipients/brands/software-products/status',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /{industry}/data-recipients/brands/software-products/status

Endpoint used by participants to discover the statuses for software products from the CDR Register.

Endpoint Version

Version 1

Parameters

Name In Type Required Description
industry path string mandatory The industry the participant is retrieving data for (Banking, etc)
x-v header string optional The version of the API end point requested by the client. Must be set to a positive integer.

Enumerated Values

Parameter Value
industry banking

Example responses

200 Response

{
  "softwareProducts": [
    {
      "softwareProductId": "string",
      "softwareProductStatus": "ACTIVE"
    }
  ]
}

Responses

Status Meaning Description Schema
200 OK Success SoftwareProductsStatusList
400 Bad Request Bad Request
Invalid industry path parameter
ResponseErrorList
406 Not Acceptable Invalid x-v header
Invalid Accept header
None

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the CDR Register has responded with.

Get Data Recipient Statuses

Code samples

GET https://register.cdr.gov.au/cdr-register/v1/{industry}/data-recipients/status HTTP/1.1
Host: register.cdr.gov.au
Accept: application/json
x-v: string

var headers = {
  'Accept':'application/json',
  'x-v':'string'

};

$.ajax({
  url: 'https://register.cdr.gov.au/cdr-register/v1/{industry}/data-recipients/status',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /{industry}/data-recipients/status

Endpoint used by participants to discover the statuses for Data Recipients from the CDR Register.

Endpoint Version

Version 1

Parameters

Name In Type Required Description
industry path string mandatory The industry the participant is retrieving data for (Banking, etc)
x-v header string optional The version of the API end point requested by the client. Must be set to a positive integer.

Enumerated Values

Parameter Value
industry banking

Example responses

200 Response

{
  "dataRecipients": [
    {
      "dataRecipientId": "string",
      "dataRecipientStatus": "ACTIVE"
    }
  ]
}

Responses

Status Meaning Description Schema
200 OK Success DataRecipientsStatusList
400 Bad Request Bad Request
Invalid industry path parameter
ResponseErrorList
406 Not Acceptable Invalid x-v header
Invalid Accept header
None

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the CDR Register has responded with.

Get Data Recipients

Code samples

GET https://register.cdr.gov.au/cdr-register/v1/{industry}/data-recipients HTTP/1.1
Host: register.cdr.gov.au
Accept: application/json
x-v: string

var headers = {
  'Accept':'application/json',
  'x-v':'string'

};

$.ajax({
  url: 'https://register.cdr.gov.au/cdr-register/v1/{industry}/data-recipients',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /{industry}/data-recipients

Endpoint used by participants to discover data recipients and associated brands and software products, available in the CDR ecosystem.

Endpoint Version

Version 2

Parameters

Name In Type Required Description
industry path string mandatory The industry the participant is retrieving data for (Banking, etc)
x-v header string optional The version of the API end point requested by the client. Must be set to a positive integer.

Enumerated Values

Parameter Value
industry banking

Example responses

200 Response

{
  "data": [
    {
      "legalEntityId": "string",
      "legalEntityName": "string",
      "accreditationNumber": "string",
      "industry": "banking",
      "logoUri": "string",
      "dataRecipientBrands": [
        {
          "dataRecipientBrandId": "string",
          "brandName": "string",
          "logoUri": "string",
          "softwareProducts": [
            {
              "softwareProductId": "string",
              "softwareProductName": "string",
              "softwareProductDescription": "string",
              "logoUri": "string",
              "status": "ACTIVE"
            }
          ],
          "status": "ACTIVE"
        }
      ],
      "status": "ACTIVE",
      "lastUpdated": "2019-08-24T14:15:22Z"
    }
  ]
}

Responses

Status Meaning Description Schema
200 OK Success ResponseRegisterDataRecipientList
400 Bad Request Bad Request
Invalid industry path parameter
ResponseErrorList
406 Not Acceptable Invalid x-v header
Invalid Accept header
None

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the CDR Register has responded with.

Schemas

ResponseOpenIDProviderConfigMetadata

{
  "issuer": "string",
  "jwks_uri": "string",
  "token_endpoint": "string",
  "claims_supported": [
    "string"
  ],
  "id_token_signing_alg_values_supported": [
    "string"
  ],
  "subject_types_supported": [
    "string"
  ],
  "code_challenge_methods_supported": [
    "string"
  ],
  "scopes_supported": [
    "string"
  ],
  "response_types_supported": [
    "string"
  ],
  "grant_types_supported": [
    "string"
  ],
  "token_endpoint_auth_methods_supported": [
    "string"
  ],
  "tls_client_certificate_bound_access_tokens": true,
  "request_object_signing_alg_values_supported": [
    "string"
  ]
}

Response containing the Open ID Provider Configuration Metadata

Properties

Name Type Required Description
issuer string mandatory URL using the https scheme with no query or fragment component that the CDR Register asserts as its Issuer Identifier
jwks_uri string mandatory URL of the CDR Register's JSON Web Key Set [JWK] document. This contains the signing key(s) used to validate access tokens issued from the CDR Register. Note that this differs from the JWKS endpoint used to validate SSAs and CDR Register client authentication
token_endpoint string mandatory URL of the CDR Register's OAuth 2.0 Token Endpoint
claims_supported [string] mandatory JSON array containing a list of the Claim Names of the Claims that the CDR Register supplies values for
id_token_signing_alg_values_supported [string] mandatory JSON array containing a list of the JWS signing algorithms (alg values) supported by the CDR Register for the ID Token to encode the Claims in a JWT. Given the CDR Register does not issue ID tokens, this field can be safely ignored
subject_types_supported [string] mandatory JSON array containing a list of the Subject Identifier types that the CDR Register supports. Given the CDR Register does not issue ID tokens, this field can be safely ignored
code_challenge_methods_supported [string] mandatory JSON array containing a list of Proof Key for Code Exchange (PKCE) [RFC7636] code challenge methods supported by this authorization server. Given the CDR Register does not support PKCE, this field can be safely ignored
scopes_supported [string] mandatory JSON array containing a list of the OAuth 2.0 [RFC6749] scope values that the CDR Register supports
response_types_supported [string] mandatory JSON array containing a list of the OAuth 2.0 response_type values that the CDR Registrer supports
grant_types_supported [string] mandatory JSON array containing a list of the OAuth 2.0 Grant Type values that the CDR Register supports
token_endpoint_auth_methods_supported [string] mandatory JSON array containing a list of Client Authentication methods supported by this Token Endpoint
tls_client_certificate_bound_access_tokens boolean mandatory Boolean value indicating server support for mutual TLS client certificate bound access tokens
request_object_signing_alg_values_supported [string] mandatory JSON array containing a list of the JWS signing algorithms (alg values) supported by the CDR Register for Request Objects.

ResponseJWKS

{
  "keys": [
    {
      "alg": "string",
      "e": "string",
      "key_ops": [
        "string"
      ],
      "kid": "string",
      "kty": "string",
      "n": "string"
    }
  ]
}

Response containing the JSON Web Key Set

Properties

Name Type Required Description
keys [JWK] mandatory The value of the "keys" parameter is an array of JWK values

JWK

{
  "alg": "string",
  "e": "string",
  "key_ops": [
    "string"
  ],
  "kid": "string",
  "kty": "string",
  "n": "string"
}

Object representing a JSON Web Key

Properties

Name Type Required Description
alg string mandatory The "alg" (algorithm) parameter identifies the algorithm intended for use with the key
e string mandatory The "e" RSA public exponent parameter
key_ops [string] mandatory The "key_ops" (key operations) parameter identifies the operation(s) for which the key is intended to be used
kid string mandatory The "kid" (key ID) parameter is partially used to match a specific key. Note the "kid" parameter is not guaranteed unique and additional parameters should be used to progressively to identify a key within a set
kty string mandatory The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key
n string mandatory The "n" RSA public modulus parameter

ResponseRegisterDataHolderBrandList

{
  "data": [
    {
      "dataHolderBrandId": "string",
      "brandName": "string",
      "industry": "banking",
      "logoUri": "string",
      "legalEntity": {
        "legalEntityId": "string",
        "legalEntityName": "string",
        "logoUri": "string",
        "registrationNumber": "string",
        "registrationDate": "2019-08-24",
        "registeredCountry": "string",
        "abn": "string",
        "acn": "string",
        "arbn": "string",
        "industryCode": "string",
        "organisationType": "SOLE_TRADER"
      },
      "status": "ACTIVE",
      "endpointDetail": {
        "version": "string",
        "publicBaseUri": "string",
        "resourceBaseUri": "string",
        "infosecBaseUri": "string",
        "extensionBaseUri": "string",
        "websiteUri": "string"
      },
      "authDetails": [
        {
          "registerUType": "SIGNED-JWT",
          "jwksEndpoint": "string"
        }
      ],
      "lastUpdated": "2019-08-24T14:15:22Z"
    }
  ],
  "links": {
    "first": "string",
    "last": "string",
    "next": "string",
    "prev": "string",
    "self": "string"
  },
  "meta": {
    "totalPages": 0,
    "totalRecords": 0
  }
}

Response containing a list of CDR Register Data Holder Brand objects

Properties

Name Type Required Description
data [RegisterDataHolderBrand] mandatory Response data for the query
links LinksPaginated mandatory none
meta MetaPaginated mandatory none

RegisterDataHolderBrand

{
  "dataHolderBrandId": "string",
  "brandName": "string",
  "industry": "banking",
  "logoUri": "string",
  "legalEntity": {
    "legalEntityId": "string",
    "legalEntityName": "string",
    "logoUri": "string",
    "registrationNumber": "string",
    "registrationDate": "2019-08-24",
    "registeredCountry": "string",
    "abn": "string",
    "acn": "string",
    "arbn": "string",
    "industryCode": "string",
    "organisationType": "SOLE_TRADER"
  },
  "status": "ACTIVE",
  "endpointDetail": {
    "version": "string",
    "publicBaseUri": "string",
    "resourceBaseUri": "string",
    "infosecBaseUri": "string",
    "extensionBaseUri": "string",
    "websiteUri": "string"
  },
  "authDetails": [
    {
      "registerUType": "SIGNED-JWT",
      "jwksEndpoint": "string"
    }
  ],
  "lastUpdated": "2019-08-24T14:15:22Z"
}

Properties

Name Type Required Description
dataHolderBrandId string mandatory Unique id of the Data Holder Brand issued by the CDR Register
brandName string mandatory The name of Data Holder Brand
industry string mandatory The industry the Data Holder brand belongs to (Banking, etc)
logoUri URIString mandatory Brand logo URI
legalEntity LegalEntityDetail mandatory The data that is common to all organisations, regardless of the type (e.g. company, trust, partnership, government)
status string mandatory none
endpointDetail RegisterDataHolderBrandServiceEndpoint mandatory Endpoints related to Data Holder Brand services
authDetails [RegisterDataHolderAuth] mandatory [Provides details of authorisation endpoints for Data Holders]
lastUpdated DateTimeString mandatory The date/time that the Data Holder Brand data was last updated in the Register

Enumerated Values

Property Value
industry banking
status ACTIVE
status INACTIVE
status REMOVED

SoftwareProductsStatusList

{
  "softwareProducts": [
    {
      "softwareProductId": "string",
      "softwareProductStatus": "ACTIVE"
    }
  ]
}

Properties

Name Type Required Description
softwareProducts [SoftwareProductStatus] mandatory none

SoftwareProductStatus

{
  "softwareProductId": "string",
  "softwareProductStatus": "ACTIVE"
}

Properties

Name Type Required Description
softwareProductId string mandatory Unique id of the software product issued by the CDR Register
softwareProductStatus string mandatory Software product status in the CDR Register

Enumerated Values

Property Value
softwareProductStatus ACTIVE
softwareProductStatus INACTIVE
softwareProductStatus REMOVED

DataRecipientsStatusList

{
  "dataRecipients": [
    {
      "dataRecipientId": "string",
      "dataRecipientStatus": "ACTIVE"
    }
  ]
}

Properties

Name Type Required Description
dataRecipients [DataRecipientStatus] mandatory none

DataRecipientStatus

{
  "dataRecipientId": "string",
  "dataRecipientStatus": "ACTIVE"
}

Properties

Name Type Required Description
dataRecipientId string mandatory Unique id of the Data Recipient issued by the CDR Register
dataRecipientStatus string mandatory Data Recipient status in the CDR Register

Enumerated Values

Property Value
dataRecipientStatus ACTIVE
dataRecipientStatus SUSPENDED
dataRecipientStatus REVOKED
dataRecipientStatus SURRENDERED

ResponseRegisterDataRecipientList

{
  "data": [
    {
      "legalEntityId": "string",
      "legalEntityName": "string",
      "accreditationNumber": "string",
      "industry": "banking",
      "logoUri": "string",
      "dataRecipientBrands": [
        {
          "dataRecipientBrandId": "string",
          "brandName": "string",
          "logoUri": "string",
          "softwareProducts": [
            {
              "softwareProductId": "string",
              "softwareProductName": "string",
              "softwareProductDescription": "string",
              "logoUri": "string",
              "status": "ACTIVE"
            }
          ],
          "status": "ACTIVE"
        }
      ],
      "status": "ACTIVE",
      "lastUpdated": "2019-08-24T14:15:22Z"
    }
  ]
}

Response containing a list of Data Recipients in the CDR Register

Properties

Name Type Required Description
data [RegisterDataRecipient] mandatory Response data for the query

RegisterDataRecipient

{
  "legalEntityId": "string",
  "legalEntityName": "string",
  "accreditationNumber": "string",
  "industry": "banking",
  "logoUri": "string",
  "dataRecipientBrands": [
    {
      "dataRecipientBrandId": "string",
      "brandName": "string",
      "logoUri": "string",
      "softwareProducts": [
        {
          "softwareProductId": "string",
          "softwareProductName": "string",
          "softwareProductDescription": "string",
          "logoUri": "string",
          "status": "ACTIVE"
        }
      ],
      "status": "ACTIVE"
    }
  ],
  "status": "ACTIVE",
  "lastUpdated": "2019-08-24T14:15:22Z"
}

Properties

Name Type Required Description
legalEntityId string mandatory Unique id of the Data Recipient Legal Entity issued by the CDR Register
legalEntityName string mandatory Legal name of the Data Recipient
accreditationNumber string mandatory CDR Register issued human readable unique number given to Data Recipients upon accreditation
industry string mandatory none
logoUri URIString mandatory Legal Entity logo URI
dataRecipientBrands [DataRecipientBrandMetaData] optional [Metadata related to Data Recipient Brand]
status string mandatory none
lastUpdated DateTimeString mandatory The date/time that the Legal Entity was last updated in the CDR Register

Enumerated Values

Property Value
industry banking
status ACTIVE
status SUSPENDED
status REVOKED
status SURRENDERED

DataRecipientBrandMetaData

{
  "dataRecipientBrandId": "string",
  "brandName": "string",
  "logoUri": "string",
  "softwareProducts": [
    {
      "softwareProductId": "string",
      "softwareProductName": "string",
      "softwareProductDescription": "string",
      "logoUri": "string",
      "status": "ACTIVE"
    }
  ],
  "status": "ACTIVE"
}

Metadata related to Data Recipient Brand

Properties

Name Type Required Description
dataRecipientBrandId string mandatory Unique id of the Data Recipient brand issued by the CDR Register
brandName string mandatory Data Recipient Brand name
logoUri URIString mandatory Data Recipient Brand logo URI
softwareProducts [SoftwareProductMetaData] optional [Data Recipient Brand Software Products]
status string mandatory none

Enumerated Values

Property Value
status ACTIVE
status INACTIVE
status REMOVED

SoftwareProductMetaData

{
  "softwareProductId": "string",
  "softwareProductName": "string",
  "softwareProductDescription": "string",
  "logoUri": "string",
  "status": "ACTIVE"
}

Data Recipient Brand Software Products

Properties

Name Type Required Description
softwareProductId string mandatory Unique id of the Data Recipient software product issued by the CDR Register
softwareProductName string mandatory Name of the software product
softwareProductDescription string optional Description of the software product
logoUri URIString mandatory Software product logo URI
status string mandatory none

Enumerated Values

Property Value
status ACTIVE
status INACTIVE
status REMOVED

LegalEntityDetail

{
  "legalEntityId": "string",
  "legalEntityName": "string",
  "logoUri": "string",
  "registrationNumber": "string",
  "registrationDate": "2019-08-24",
  "registeredCountry": "string",
  "abn": "string",
  "acn": "string",
  "arbn": "string",
  "industryCode": "string",
  "organisationType": "SOLE_TRADER"
}

The data that is common to all organisations, regardless of the type (e.g. company, trust, partnership, government)

Properties

Name Type Required Description
legalEntityId string mandatory Unique id of the organisation issued by the CDR Register
legalEntityName string mandatory Unique legal name of the organisation
logoUri URIString mandatory Legal Entity logo URI
registrationNumber string optional Unique registration number (if the company is registered outside Australia)
registrationDate DateString optional Date of registration (if the company is registered outside Australia)
registeredCountry string optional Country of registeration (if the company is registered outside Australia)
abn string optional Australian Business Number for the organisation
acn string optional Australian Company Number for the organisation
arbn string optional Australian Registered Body Number. ARBNs are issued to registrable Australian bodies and foreign companies
industryCode string optional Industry Code for the organisation. ANZSIC (2006)
organisationType string optional Legal organisation type

Enumerated Values

Property Value
organisationType SOLE_TRADER
organisationType COMPANY
organisationType PARTNERSHIP
organisationType TRUST
organisationType GOVERNMENT_ENTITY
organisationType OTHER

RegisterDataHolderBrandServiceEndpoint

{
  "version": "string",
  "publicBaseUri": "string",
  "resourceBaseUri": "string",
  "infosecBaseUri": "string",
  "extensionBaseUri": "string",
  "websiteUri": "string"
}

Endpoints related to Data Holder Brand services

Properties

Name Type Required Description
version string mandatory The major version of the high level standards. This is not the version of the endpoint or the payload being requested but the version of the overall standards being applied. This version number will be "v" followed by the major version of the standards as a positive integer (e.g. v1, v12 or v76)
publicBaseUri URIString mandatory Base URI for the Data Holder's Consumer Data Standard public endpoints
resourceBaseUri URIString mandatory Base URI for the Data Holder's Consumer Data Standard resource endpoints
infosecBaseUri URIString mandatory Base URI for the Data Holder's Consumer Data Standard information security endpoints
extensionBaseUri URIString optional Base URI for the Data Holder extension endpoints to the Consumer Data Standard (optional)
websiteUri URIString mandatory Publicly available website or web resource URI

RegisterDataHolderAuth

{
  "registerUType": "SIGNED-JWT",
  "jwksEndpoint": "string"
}

Provides details of authorisation endpoints for Data Holders

Properties

Name Type Required Description
registerUType string mandatory The type of authentication and authorisation mechanism in use
jwksEndpoint URIString mandatory JWKS endpoint for private_key_jwt client authentication with Data Recipient

Enumerated Values

Property Value
registerUType SIGNED-JWT

LinksPaginated

{
  "first": "string",
  "last": "string",
  "next": "string",
  "prev": "string",
  "self": "string"
}

Properties

Name Type Required Description
first string optional URI to the first page of this set. Mandatory if this response is not the first page
last string optional URI to the last page of this set. Mandatory if this response is not the last page
next string optional URI to the next page of this set. Mandatory if this response is not the last page
prev string optional URI to the previous page of this set. Mandatory if this response is not the first page
self string mandatory Fully qualified link to this API call

MetaPaginated

{
  "totalPages": 0,
  "totalRecords": 0
}

Properties

Name Type Required Description
totalPages integer(int32) mandatory The total number of pages in the full set
totalRecords integer(int32) mandatory The total number of records in the full set

ResponseErrorList

{
  "errors": [
    {
      "code": "string",
      "title": "string",
      "detail": "string",
      "meta": {}
    }
  ]
}

Properties

Name Type Required Description
errors [Error] mandatory none

Error

{
  "code": "string",
  "title": "string",
  "detail": "string",
  "meta": {}
}

Properties

Name Type Required Description
code string mandatory Error code
title string mandatory Error title
detail string mandatory Error detail
meta object optional Optional additional data for specific error types

Authorisation Scopes

The following authorisation scopes have been defined for the standards. Each API end point will specify which scopes are required to access the data available via that end point.

Public

Scope Name Scope ID Description
Public NA Openly accessible information. A customer would never need to grant this scope. This scope is included so that end points that can be called without requiring authorisation can be identified.

Includes access to openly available information such as generic product information.

CDR Data

These scopes are used to access authenticated resource endpoints that can be used to obtain CDR Data.

Scope Name Scope ID Description
Basic Bank Account Data bank:accounts.basic:read This scope would allow for the third party to access basic information of the customer’s accounts.

Includes simple account information including balance.
Does not include detailed account information such as account numbers, product information or transaction data.
Detailed Bank Account Data bank:accounts.detail:read This scope would allow for the third party to access detailed information of the customer’s accounts. This scope is effectively additional authorisation to the Basic Bank Account Data scope. Granting this authorisation only makes sense if the Bank Account Data scope is also authorised.

Includes basic account information plus account identifiers and product information.
Does not include transaction data.
Bank Transaction Data bank:transactions:read This scope would allow the third party to access transaction data for accounts. This scope is effectively additional authorisation to the Basic Bank Account Data scope. Granting this authorisation only makes sense if the Basic Bank Account Data scope is also authorised.

Includes all account transaction data.
Bank Payee Data bank:payees:read This scope allows access to payee information stored by the customer.

Includes payee information such as billers, international beneficiaries and domestic payees.
Bank Regular Payments bank:regular_payments:read The scope would allow the third party to access regular payments. Includes Direct Debits and Scheduled Payments.
Basic Service Point Data energy:electricity.servicepoints.basic:read This scope would allow for the third party to access basic standing data information of the customer’s service points.

Includes simple standing data including the National Meter Identifier (NMI). Does not include detailed service point information such as loaction or meter attributres.
Detailed Service Point Data energy:electricity.servicepoints.detail:read This scope would allow for the third party to access detailed information of the customer’s service point connection. This scope is effectively additional authorisation to the Basic Service Point Data scope. Granting this authorisation only makes sense if the Service Point Data scope is also authorised.

Includes basic service point information plus account identifiers and meter information.
Does not include meter usage data.
Electricity Usage Data energy:electricity.usage:read This scope would allow the third party to access electricity usage data for service points. This scope is effectively additional authorisation to the Basic Service Point Data scope. Granting this authorisation only makes sense if the Basic Service Point Data scope is also authorised.

Includes all electricity usage data including basic and interval meter meters.
Distributed Energy Resource Data energy:electricity.der:read This scope would allow the third party to access data about distributed energy resources for service points. This scope is effectively additional authorisation to the Basic Service Point Data scope. Granting this authorisation only makes sense if the Basic Service Point Data scope is also authorised.

Includes distributed energy resource data available in AEMOs DER Register
Basic Energy Account Data energy:accounts.basic:read This scope would allow for the third party to access basic information of the customer’s energy accounts with retailers.

Includes simple energy account information basic plan information and service points that are part of the account.
Does not include detailed account information such as tailored plans, electricity contract details or discounts.
Detailed Energy Account Data energy:accounts.detail:read This scope would allow for the third party to access detailed information of the customer’s energy accounts with retailers. This scope is effectively additional authorisation to the Basic Energy Account Data scope. Granting this authorisation only makes sense if the Energy Account Data scope is also authorised.

Includes basic energy account information plus tailored tariff information including charges included in the account or plan.
Does not include usage data.
Energy Regular Payments Data energy:accounts.paymentschedule:read The scope would allow the third party to access payment schedules for energy accounts. Includes Direct Debit or Credit based Scheduled Payments and Manual Payments.
Energy Concession & Hardship Data energy:accounts.concessions:read The scope would allow the third party to access the details of any concessions or hardship arrangement data for a customer’s energy account.
Energy Billing Data energy:billing:read The scope would allow the third party to access the billing and invoice data for a customer’s energy account.
Basic Customer Data common:customer.basic:read The scope would allow the third party to access personally identifiable information about the customer. For retail customers this would be information about the customer themselves. For business customers it would imply the name of specific user but also information about the business.

Includes name and occupation for individuals or name, business numbers and industry code for organisations
Detailed Customer Data common:customer.detail:read The scope would allow the third party to access more detailed information about the customer. Includes the data available with the Basic Customer Data scope plus contact details.

Includes basic data plus phone, email and address information.

Admin & Registration

The following scopes are used for administrative interactions. These scopes MUST never be included in the same access token as a CDR Data scope.

Scope Name Scope ID Description
Basic Admin Metrics Data admin:metrics.basic:read Metrics data accessible ONLY to the CDR Register. If the Data Holder uses Private Key JWT Client Authentication to authenticate the CDR Register, this scope is required.

Includes access to basic Metrics data.
Admin Metadata Update Data admin:metadata:update Update notification accessible ONLY to the CDR Register. If the Data Holder uses Private Key JWT Client Authentication to authenticate the CDR Register, this scope is required.

Includes permission to notify Data Holders of changes to Data Recipient metadata held by the CDR Register.
Bank Data Holders List cdr-register:bank:read This scope would allow Data Recipients and Data Holders access to Data Holder metadata held by the Register.
Register Client cdr:registration This scope would allow a Data Recipient to register or manage a software product client with a Data Holder.

Non-functional Requirements

The non-functional requirements (NFRs) for the Consumer Data Right regime cover a number of considerations:

Definitions

In the following definition of NFRs specific terms have the following meanings:

Session Requirements

A expiry time of a unique session should be set according to the statements included in the Security Profile.

After a unique session is expired it is expected that the Data Recipient Software Product, for the same customer, may establish a new session as long as the authorisation is still valid.

Availability Requirements

Service availability requirement for data holders and secondary data holders: 99.5% per month

The definition of a period of unavailability is any period of time when any of the API end points defined in the standard is unable to reliably provide a successful response to an appropriately constructed request.

The availability requirement applies to both authenticated and unauthenticated end points.

The availability requirement does not include planned outages. Planned outages should be:

The unavailability of a secondary data holder will mean that some requests cannot be fulfilled by a data holder making a secondary responsibility request. This will not be taken to mean that the data holder is unavailable.

Performance Requirements

API end point performance will be measured in response time of individual API requests from receipt of request to delivery of response.

It is understood that different response times can be measured depending on which technical layer of an API implementation stack is instrumented and that not all of the technical layers between the Data Recipient Software Product and the Data Holder will be in the control of the Data Holder. As this is implementation specific it is expected that the Data Holder will ensure that the measurement of response time occurs as close to the Data Recipient Software Product as practicable.

In light of these considerations, the performance requirement for Data Holders is:

95% of calls per hour responded to within a nominated threshold

The nominated threshold for each end point will be according to the following table:

Tier Response Time Applies To…
Unauthenticated 1500ms All Unauthenticated end points not otherwise specified in a separate threshold.
High Priority 1000ms All calls to the following end points:
  • All InfoSec end points including Dynamic Client Registration
  • CDR Arrangement Revocation
The following Unauthenticated end points:
    Common
  • Get Status
  • Get Outages
Customer Present calls to the following end points:
    Banking
  • Get Accounts
  • Energy
  • Get Accounts
  • Get Account Detail
  • Get Balance For Account
  • Get Invoices For Account
  • Common
  • Get Customer
  • Get Customer Detail
Low Priority 1500ms Customer Present calls to the following end points:
    Banking
  • Get Account Detail
  • Get Account Balance
  • Get Bulk Balances
  • Get Balances For Specific Accounts
  • Get Transactions For Account
  • Get Transaction Detail
  • Get Payees
  • Get Payee Detail
  • Get Direct Debits For Account
  • Get Scheduled Payments For Account
  • Get Scheduled Payments Bulk
  • Get Scheduled Payments For Specific Accounts
  • Energy
  • Get Agreed Payment Schedule
  • Get Concessions
  • Get Bulk Balances
  • Get Balances For Specific Accounts
  • Get Bulk Invoices
  • Get Invoices For Specific Accounts
  • Get Billing For Account
Unattended 4000ms Unattended calls to the following end points that are not Large Payload end points:
  • High Priority Authenticated end points
  • Low Priority Authenticated end points
  • All Admin end points.
Large Payload 6000ms Any Unattended calls to the following end points:
    Banking
  • Get Bulk Direct Debits
  • Get Direct Debits For Specific Accounts
  • Energy
  • Get Bulk Billing
  • Get Billing For Specific Accounts
Secondary Request 1000ms (for data holders)
1500ms (for secondary data holders)
Customer Present calls to the following end points:
    Energy
  • Get Service Points
  • Get Service Point Detail
  • Get DER For Service Point
Large Secondary Request 1500ms (for data holders)
4500ms (for secondary data holders)
Unattended calls to the following end points:
    Energy
  • Get Service Points
  • Get Service Point Detail
  • Get DER For Service Point
All calls to the following end points:
    Energy
  • Get Bulk Usage
  • Get Usage For Service Point
  • Get Usage For Specific Service Points
  • Get Bulk DER
  • Get DER For Specific Service Points

Note that calls initiated in excess of a traffic threshold (see next section) may be excluded from the performance requirement.

Traffic Thresholds

Calls in excess of the following traffic thresholds will be able to be freely throttled or rejected by a data holder without impact to their performance or availability requirements.

Traffic thresholds will be set using the following metrics:

For Customer Present and authorisation traffic the following traffic thresholds will apply:

For Unattended traffic the following traffic thresholds will apply for low traffic periods:

For Unattended traffic during high traffic periods only best effort support is required.

For secure traffic (both Customer Present and Unattended) the following traffic thresholds will apply:

For Public traffic (i.e. traffic to unauthenticated end points) the following traffic thresholds will apply:

As traffic from Data Recipient Software Products to Data Holders will be shaped by the thresholds above, there are no specific thresholds applicable to secondary Data Holders.

Data Recipient Requirements

Data Recipient Software Products will be limited by the traffic thresholds documented in the previous section. In addition to this Data Recipients are expected to design their services according to the following principles:

Reporting Requirements

The mechanism for reporting will be via the CDR Administration Endpoints.

The following information is to be reported:

Data Latency

Within this proposal there is no specific requirement with regard to data latency (ie. how up to date data should be). Instead, the requirement for data latency is that data presented via API end points should be commensurate to data presented via other primary digital channels.

For example, for a Bank that provides a mobile application as their primary digital experience, a balance presented via one of the balance end points should be the same as the balance presented through the mobile application.

To be able to manage network efficiency using normal mechanisms, a data holder making secondary responsibility requests may cache the results from the secondary data holder for a short period of time to accommodate repeated, duplicate, calls from the Data Recipient Software Product. Any such cache should be short lived.

Data Quality

Data holders are required to take reasonable steps to ensure that CDR data, having regard to the purpose for which it is held, is accurate and up to date.

A data holder is required to be able to demonstrate that reasonable steps to maintain data quality are being undertaken.

Exemptions To Protect Service

In the event of the following extreme circumstances data holders will be able to obtain relief from non-functional requirements:

Banking APIs

This specification defines the APIs for Data Holders exposing Banking endpoints.


Banking Swagger (JSON)
Banking Swagger (YAML)

Get Accounts

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/accounts HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/accounts',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/accounts

Obtain a list of accounts

Endpoint Version

Version 1

Parameters

Name In Type Required Description
product-category query string optional Used to filter results on the productCategory field applicable to accounts. Any one of the valid values for this field can be supplied. If absent then all accounts returned.
open-status query string optional Used to filter results according to open/closed status. Values can be OPEN, CLOSED or ALL. If absent then ALL is assumed
is-owned query Boolean optional Filters accounts based on whether they are owned by the authorised customer. True for owned accounts, false for unowned accounts and absent for all accounts
page query PositiveInteger optional Page of results to request (standard pagination)
page-size query PositiveInteger optional Page size to request. Default is 25 (standard pagination)
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.

Enumerated Values

Parameter Value
product-category BUSINESS_LOANS
product-category CRED_AND_CHRG_CARDS
product-category LEASES
product-category MARGIN_LOANS
product-category OVERDRAFTS
product-category PERS_LOANS
product-category REGULATED_TRUST_ACCOUNTS
product-category RESIDENTIAL_MORTGAGES
product-category TERM_DEPOSITS
product-category TRADE_FINANCE
product-category TRANS_AND_SAVINGS_ACCOUNTS
product-category TRAVEL_CARDS
open-status ALL
open-status CLOSED
open-status OPEN

Example responses

200 Response

{
  "data": {
    "accounts": [
      {
        "accountId": "string",
        "creationDate": "string",
        "displayName": "string",
        "nickname": "string",
        "openStatus": "CLOSED",
        "isOwned": true,
        "maskedNumber": "string",
        "productCategory": "BUSINESS_LOANS",
        "productName": "string"
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingAccountList
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Bulk Balances

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/accounts/balances HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/accounts/balances',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/accounts/balances

Obtain balances for multiple, filtered accounts

Endpoint Version

Version 1

Parameters

Name In Type Required Description
product-category query string optional Used to filter results on the productCategory field applicable to accounts. Any one of the valid values for this field can be supplied. If absent then all accounts returned.
open-status query string optional Used to filter results according to open/closed status. Values can be OPEN, CLOSED or ALL. If absent then ALL is assumed
is-owned query Boolean optional Filters accounts based on whether they are owned by the authorised customer. True for owned accounts, false for unowned accounts and absent for all accounts
page query PositiveInteger optional Page of results to request (standard pagination)
page-size query PositiveInteger optional Page size to request. Default is 25 (standard pagination)
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.

Enumerated Values

Parameter Value
product-category BUSINESS_LOANS
product-category CRED_AND_CHRG_CARDS
product-category LEASES
product-category MARGIN_LOANS
product-category OVERDRAFTS
product-category PERS_LOANS
product-category REGULATED_TRUST_ACCOUNTS
product-category RESIDENTIAL_MORTGAGES
product-category TERM_DEPOSITS
product-category TRADE_FINANCE
product-category TRANS_AND_SAVINGS_ACCOUNTS
product-category TRAVEL_CARDS
open-status ALL
open-status CLOSED
open-status OPEN

Example responses

200 Response

{
  "data": {
    "balances": [
      {
        "accountId": "string",
        "currentBalance": "string",
        "availableBalance": "string",
        "creditLimit": "string",
        "amortisedLimit": "string",
        "currency": "string",
        "purses": [
          {
            "amount": "string",
            "currency": "string"
          }
        ]
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingAccountsBalanceList
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Balances For Specific Accounts

Code samples

POST https://data.holder.com.au/cds-au/v1/banking/accounts/balances HTTP/1.1
Host: data.holder.com.au
Content-Type: application/json
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Content-Type':'application/json',
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/accounts/balances',
  method: 'post',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

POST /banking/accounts/balances

Obtain balances for a specified list of accounts

Body parameter

{
  "data": {
    "accountIds": [
      "string"
    ]
  },
  "meta": {}
}

Endpoint Version

Version 1

Parameters

Name In Type Required Description
page query PositiveInteger optional Page of results to request (standard pagination)
page-size query PositiveInteger optional Page size to request. Default is 25 (standard pagination)
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.
body body RequestAccountIds mandatory The list of account IDs to obtain balances for

Example responses

200 Response

{
  "data": {
    "balances": [
      {
        "accountId": "string",
        "currentBalance": "string",
        "availableBalance": "string",
        "creditLimit": "string",
        "amortisedLimit": "string",
        "currency": "string",
        "purses": [
          {
            "amount": "string",
            "currency": "string"
          }
        ]
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingAccountsBalanceList
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Account Balance

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/accounts/{accountId}/balance HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/accounts/{accountId}/balance',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/accounts/{accountId}/balance

Obtain the balance for a single specified account

Endpoint Version

Version 1

Parameters

Name In Type Required Description
accountId path ASCIIString mandatory ID of the specific account requested
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.

Example responses

200 Response

{
  "data": {
    "accountId": "string",
    "currentBalance": "string",
    "availableBalance": "string",
    "creditLimit": "string",
    "amortisedLimit": "string",
    "currency": "string",
    "purses": [
      {
        "amount": "string",
        "currency": "string"
      }
    ]
  },
  "links": {
    "self": "string"
  },
  "meta": {}
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingAccountsBalanceById
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Account Detail

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/accounts/{accountId} HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/accounts/{accountId}',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/accounts/{accountId}

Obtain detailed information on a single account

Endpoint Version

Version 1

Parameters

Name In Type Required Description
accountId path ASCIIString mandatory A tokenised identifier for the account which is unique but not shareable
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.

Example responses

200 Response

{
  "data": {
    "accountId": "string",
    "creationDate": "string",
    "displayName": "string",
    "nickname": "string",
    "openStatus": "CLOSED",
    "isOwned": true,
    "maskedNumber": "string",
    "productCategory": "BUSINESS_LOANS",
    "productName": "string",
    "bsb": "string",
    "accountNumber": "string",
    "bundleName": "string",
    "specificAccountUType": "creditCard",
    "termDeposit": [
      {
        "lodgementDate": "string",
        "maturityDate": "string",
        "maturityAmount": "string",
        "maturityCurrency": "string",
        "maturityInstructions": "HOLD_ON_MATURITY"
      }
    ],
    "creditCard": {
      "minPaymentAmount": "string",
      "paymentDueAmount": "string",
      "paymentCurrency": "string",
      "paymentDueDate": "string"
    },
    "loan": {
      "originalStartDate": "string",
      "originalLoanAmount": "string",
      "originalLoanCurrency": "string",
      "loanEndDate": "string",
      "nextInstalmentDate": "string",
      "minInstalmentAmount": "string",
      "minInstalmentCurrency": "string",
      "maxRedraw": "string",
      "maxRedrawCurrency": "string",
      "minRedraw": "string",
      "minRedrawCurrency": "string",
      "offsetAccountEnabled": true,
      "offsetAccountIds": [
        "string"
      ],
      "repaymentType": "INTEREST_ONLY",
      "repaymentFrequency": "string"
    },
    "depositRate": "string",
    "lendingRate": "string",
    "depositRates": [
      {
        "depositRateType": "BONUS",
        "rate": "string",
        "calculationFrequency": "string",
        "applicationFrequency": "string",
        "tiers": [
          {
            "name": "string",
            "unitOfMeasure": "DAY",
            "minimumValue": 0,
            "maximumValue": 0,
            "rateApplicationMethod": "PER_TIER",
            "applicabilityConditions": {
              "additionalInfo": "string",
              "additionalInfoUri": "string"
            },
            "additionalInfo": "string",
            "additionalInfoUri": "string"
          }
        ],
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ],
    "lendingRates": [
      {
        "lendingRateType": "BUNDLE_DISCOUNT_FIXED",
        "rate": "string",
        "comparisonRate": "string",
        "calculationFrequency": "string",
        "applicationFrequency": "string",
        "interestPaymentDue": "IN_ADVANCE",
        "repaymentType": "INTEREST_ONLY",
        "loanPurpose": "INVESTMENT",
        "tiers": [
          {
            "name": "string",
            "unitOfMeasure": "DAY",
            "minimumValue": 0,
            "maximumValue": 0,
            "rateApplicationMethod": "PER_TIER",
            "applicabilityConditions": {
              "additionalInfo": "string",
              "additionalInfoUri": "string"
            },
            "additionalInfo": "string",
            "additionalInfoUri": "string"
          }
        ],
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ],
    "features": [
      {
        "featureType": "ADDITIONAL_CARDS",
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string",
        "isActivated": true
      }
    ],
    "fees": [
      {
        "name": "string",
        "feeType": "DEPOSIT",
        "amount": "string",
        "balanceRate": "string",
        "transactionRate": "string",
        "accruedRate": "string",
        "accrualFrequency": "string",
        "currency": "string",
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string",
        "discounts": [
          {
            "description": "string",
            "discountType": "BALANCE",
            "amount": "string",
            "balanceRate": "string",
            "transactionRate": "string",
            "accruedRate": "string",
            "feeRate": "string",
            "additionalValue": "string",
            "additionalInfo": "string",
            "additionalInfoUri": "string",
            "eligibility": [
              {
                "discountEligibilityType": "BUSINESS",
                "additionalValue": "string",
                "additionalInfo": "string",
                "additionalInfoUri": "string"
              }
            ]
          }
        ]
      }
    ],
    "addresses": [
      {
        "addressUType": "paf",
        "simple": {
          "mailingName": "string",
          "addressLine1": "string",
          "addressLine2": "string",
          "addressLine3": "string",
          "postcode": "string",
          "city": "string",
          "state": "string",
          "country": "AUS"
        },
        "paf": {
          "dpid": "string",
          "thoroughfareNumber1": 0,
          "thoroughfareNumber1Suffix": "string",
          "thoroughfareNumber2": 0,
          "thoroughfareNumber2Suffix": "string",
          "flatUnitType": "string",
          "flatUnitNumber": "string",
          "floorLevelType": "string",
          "floorLevelNumber": "string",
          "lotNumber": "string",
          "buildingName1": "string",
          "buildingName2": "string",
          "streetName": "string",
          "streetType": "string",
          "streetSuffix": "string",
          "postalDeliveryType": "string",
          "postalDeliveryNumber": 0,
          "postalDeliveryNumberPrefix": "string",
          "postalDeliveryNumberSuffix": "string",
          "localityName": "string",
          "postcode": "string",
          "state": "string"
        }
      }
    ]
  },
  "links": {
    "self": "string"
  },
  "meta": {}
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingAccountById
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Transactions For Account

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/accounts/{accountId}/transactions HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/accounts/{accountId}/transactions',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/accounts/{accountId}/transactions

Obtain transactions for a specific account.

Some general notes that apply to all end points that retrieve transactions:

Endpoint Version

Version 1

Parameters

Name In Type Required Description
accountId path ASCIIString mandatory ID of the account to get transactions for. Must have previously been returned by one of the account list end points.
oldest-time query DateTimeString optional Constrain the transaction history request to transactions with effective time at or after this date/time. If absent defaults to newest-time minus 90 days. Format is aligned to DateTimeString common type
newest-time query DateTimeString optional Constrain the transaction history request to transactions with effective time at or before this date/time. If absent defaults to today. Format is aligned to DateTimeString common type
min-amount query AmountString optional Filter transactions to only transactions with amounts higher or equal to than this amount
max-amount query AmountString optional Filter transactions to only transactions with amounts less than or equal to than this amount
text query string optional Filter transactions to only transactions where this string value is found as a substring of either the reference or description fields. Format is arbitrary ASCII string. This parameter is optionally implemented by data holders. If it is not implemented then a response should be provided as normal without text filtering applied and an additional boolean field named isQueryParamUnsupported should be included in the meta object and set to true (whether the text parameter is supplied or not)
page query PositiveInteger optional Page of results to request (standard pagination)
page-size query PositiveInteger optional Page size to request. Default is 25 (standard pagination)
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.

Example responses

200 Response

{
  "data": {
    "transactions": [
      {
        "accountId": "string",
        "transactionId": "string",
        "isDetailAvailable": true,
        "type": "DIRECT_DEBIT",
        "status": "PENDING",
        "description": "string",
        "postingDateTime": "string",
        "valueDateTime": "string",
        "executionDateTime": "string",
        "amount": "string",
        "currency": "string",
        "reference": "string",
        "merchantName": "string",
        "merchantCategoryCode": "string",
        "billerCode": "string",
        "billerName": "string",
        "crn": "string",
        "apcaNumber": "string"
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingTransactionList
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Transaction Detail

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/accounts/{accountId}/transactions/{transactionId} HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/accounts/{accountId}/transactions/{transactionId}',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/accounts/{accountId}/transactions/{transactionId}

Obtain detailed information on a transaction for a specific account

Endpoint Version

Version 1

Parameters

Name In Type Required Description
accountId path ASCIIString mandatory ID of the account to get transactions for. Must have previously been returned by one of the account list end points
transactionId path ASCIIString mandatory ID of the transaction obtained from a previous call to one of the other transaction end points
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.

Example responses

200 Response

{
  "data": {
    "accountId": "string",
    "transactionId": "string",
    "isDetailAvailable": true,
    "type": "DIRECT_DEBIT",
    "status": "PENDING",
    "description": "string",
    "postingDateTime": "string",
    "valueDateTime": "string",
    "executionDateTime": "string",
    "amount": "string",
    "currency": "string",
    "reference": "string",
    "merchantName": "string",
    "merchantCategoryCode": "string",
    "billerCode": "string",
    "billerName": "string",
    "crn": "string",
    "apcaNumber": "string",
    "extendedData": {
      "payer": "string",
      "payee": "string",
      "extensionUType": "x2p101Payload",
      "x2p101Payload": {
        "extendedDescription": "string",
        "endToEndId": "string",
        "purposeCode": "string"
      },
      "service": "X2P1.01"
    }
  },
  "links": {
    "self": "string"
  },
  "meta": {}
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingTransactionById
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Direct Debits For Account

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/accounts/{accountId}/direct-debits HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/accounts/{accountId}/direct-debits',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/accounts/{accountId}/direct-debits

Obtain direct debit authorisations for a specific account

Endpoint Version

Version 1

Parameters

Name In Type Required Description
accountId path ASCIIString mandatory ID of the account to get direct debit authorisations for. Must have previously been returned by one of the account list end points.
page query PositiveInteger optional Page of results to request (standard pagination)
page-size query PositiveInteger optional Page size to request. Default is 25 (standard pagination)
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.

Example responses

200 Response

{
  "data": {
    "directDebitAuthorisations": [
      {
        "accountId": "string",
        "authorisedEntity": {
          "description": "string",
          "financialInstitution": "string",
          "abn": "string",
          "acn": "string",
          "arbn": "string"
        },
        "lastDebitDateTime": "string",
        "lastDebitAmount": "string"
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingDirectDebitAuthorisationList
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Bulk Direct Debits

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/accounts/direct-debits HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/accounts/direct-debits',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/accounts/direct-debits

Obtain direct debit authorisations for multiple, filtered accounts

Endpoint Version

Version 1

Parameters

Name In Type Required Description
product-category query string optional Used to filter results on the productCategory field applicable to accounts. Any one of the valid values for this field can be supplied. If absent then all accounts returned.
open-status query string optional Used to filter results according to open/closed status. Values can be OPEN, CLOSED or ALL. If absent then ALL is assumed
is-owned query Boolean optional Filters accounts based on whether they are owned by the authorised customer. True for owned accounts, false for unowned accounts and absent for all accounts
page query PositiveInteger optional Page of results to request (standard pagination)
page-size query PositiveInteger optional Page size to request. Default is 25 (standard pagination)
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.

Enumerated Values

Parameter Value
product-category BUSINESS_LOANS
product-category CRED_AND_CHRG_CARDS
product-category LEASES
product-category MARGIN_LOANS
product-category OVERDRAFTS
product-category PERS_LOANS
product-category REGULATED_TRUST_ACCOUNTS
product-category RESIDENTIAL_MORTGAGES
product-category TERM_DEPOSITS
product-category TRADE_FINANCE
product-category TRANS_AND_SAVINGS_ACCOUNTS
product-category TRAVEL_CARDS
open-status ALL
open-status CLOSED
open-status OPEN

Example responses

200 Response

{
  "data": {
    "directDebitAuthorisations": [
      {
        "accountId": "string",
        "authorisedEntity": {
          "description": "string",
          "financialInstitution": "string",
          "abn": "string",
          "acn": "string",
          "arbn": "string"
        },
        "lastDebitDateTime": "string",
        "lastDebitAmount": "string"
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingDirectDebitAuthorisationList
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Direct Debits For Specific Accounts

Code samples

POST https://data.holder.com.au/cds-au/v1/banking/accounts/direct-debits HTTP/1.1
Host: data.holder.com.au
Content-Type: application/json
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Content-Type':'application/json',
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/accounts/direct-debits',
  method: 'post',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

POST /banking/accounts/direct-debits

Obtain direct debit authorisations for a specified list of accounts

Body parameter

{
  "data": {
    "accountIds": [
      "string"
    ]
  },
  "meta": {}
}

Endpoint Version

Version 1

Parameters

Name In Type Required Description
page query PositiveInteger optional Page of results to request (standard pagination)
page-size query PositiveInteger optional Page size to request. Default is 25 (standard pagination)
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.
body body RequestAccountIds mandatory Array of specific accountIds to obtain authorisations for

Example responses

200 Response

{
  "data": {
    "directDebitAuthorisations": [
      {
        "accountId": "string",
        "authorisedEntity": {
          "description": "string",
          "financialInstitution": "string",
          "abn": "string",
          "acn": "string",
          "arbn": "string"
        },
        "lastDebitDateTime": "string",
        "lastDebitAmount": "string"
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingDirectDebitAuthorisationList
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Scheduled Payments for Account

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/accounts/{accountId}/payments/scheduled HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/accounts/{accountId}/payments/scheduled',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/accounts/{accountId}/payments/scheduled

Obtain scheduled, outgoing payments for a specific account

Endpoint Version

Version 1

Parameters

Name In Type Required Description
accountId path ASCIIString mandatory ID of the account to get scheduled payments for. Must have previously been returned by one of the account list end points. The account specified is the source account for the payment
page query PositiveInteger optional Page of results to request (standard pagination)
page-size query PositiveInteger optional Page size to request. Default is 25 (standard pagination)
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.

Example responses

200 Response

{
  "data": {
    "scheduledPayments": [
      {
        "scheduledPaymentId": "string",
        "nickname": "string",
        "payerReference": "string",
        "payeeReference": "string",
        "status": "ACTIVE",
        "from": {
          "accountId": "string"
        },
        "paymentSet": [
          {
            "to": {
              "toUType": "accountId",
              "accountId": "string",
              "payeeId": "string",
              "nickname": "string",
              "payeeReference": "string",
              "domestic": {
                "payeeAccountUType": "account",
                "account": {
                  "accountName": "string",
                  "bsb": "string",
                  "accountNumber": "string"
                },
                "card": {
                  "cardNumber": "string"
                },
                "payId": {
                  "name": "string",
                  "identifier": "string",
                  "type": "ABN"
                }
              },
              "biller": {
                "billerCode": "string",
                "crn": "string",
                "billerName": "string"
              },
              "international": {
                "beneficiaryDetails": {
                  "name": "string",
                  "country": "string",
                  "message": "string"
                },
                "bankDetails": {
                  "country": "string",
                  "accountNumber": "string",
                  "bankAddress": {
                    "name": "string",
                    "address": "string"
                  },
                  "beneficiaryBankBIC": "string",
                  "fedWireNumber": "string",
                  "sortCode": "string",
                  "chipNumber": "string",
                  "routingNumber": "string",
                  "legalEntityIdentifier": "string"
                }
              }
            },
            "isAmountCalculated": true,
            "amount": "string",
            "currency": "string"
          }
        ],
        "recurrence": {
          "nextPaymentDate": "string",
          "recurrenceUType": "eventBased",
          "onceOff": {
            "paymentDate": "string"
          },
          "intervalSchedule": {
            "finalPaymentDate": "string",
            "paymentsRemaining": 1,
            "nonBusinessDayTreatment": "AFTER",
            "intervals": [
              {
                "interval": "string",
                "dayInInterval": "string"
              }
            ]
          },
          "lastWeekDay": {
            "finalPaymentDate": "string",
            "paymentsRemaining": 1,
            "interval": "string",
            "lastWeekDay": "FRI",
            "nonBusinessDayTreatment": "AFTER"
          },
          "eventBased": {
            "description": "string"
          }
        }
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingScheduledPaymentsList
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Scheduled Payments Bulk

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/payments/scheduled HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/payments/scheduled',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/payments/scheduled

Obtain scheduled payments for multiple, filtered accounts that are the source of funds for the payments

Endpoint Version

Version 1

Parameters

Name In Type Required Description
product-category query string optional Used to filter results on the productCategory field applicable to accounts. Any one of the valid values for this field can be supplied. If absent then all accounts returned.
open-status query string optional Used to filter results according to open/closed status. Values can be OPEN, CLOSED or ALL. If absent then ALL is assumed
is-owned query Boolean optional Filters accounts based on whether they are owned by the authorised customer. True for owned accounts, false for unowned accounts and absent for all accounts
page query PositiveInteger optional Page of results to request (standard pagination)
page-size query PositiveInteger optional Page size to request. Default is 25 (standard pagination)
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.

Enumerated Values

Parameter Value
product-category BUSINESS_LOANS
product-category CRED_AND_CHRG_CARDS
product-category LEASES
product-category MARGIN_LOANS
product-category OVERDRAFTS
product-category PERS_LOANS
product-category REGULATED_TRUST_ACCOUNTS
product-category RESIDENTIAL_MORTGAGES
product-category TERM_DEPOSITS
product-category TRADE_FINANCE
product-category TRANS_AND_SAVINGS_ACCOUNTS
product-category TRAVEL_CARDS
open-status ALL
open-status CLOSED
open-status OPEN

Example responses

200 Response

{
  "data": {
    "scheduledPayments": [
      {
        "scheduledPaymentId": "string",
        "nickname": "string",
        "payerReference": "string",
        "payeeReference": "string",
        "status": "ACTIVE",
        "from": {
          "accountId": "string"
        },
        "paymentSet": [
          {
            "to": {
              "toUType": "accountId",
              "accountId": "string",
              "payeeId": "string",
              "nickname": "string",
              "payeeReference": "string",
              "domestic": {
                "payeeAccountUType": "account",
                "account": {
                  "accountName": "string",
                  "bsb": "string",
                  "accountNumber": "string"
                },
                "card": {
                  "cardNumber": "string"
                },
                "payId": {
                  "name": "string",
                  "identifier": "string",
                  "type": "ABN"
                }
              },
              "biller": {
                "billerCode": "string",
                "crn": "string",
                "billerName": "string"
              },
              "international": {
                "beneficiaryDetails": {
                  "name": "string",
                  "country": "string",
                  "message": "string"
                },
                "bankDetails": {
                  "country": "string",
                  "accountNumber": "string",
                  "bankAddress": {
                    "name": "string",
                    "address": "string"
                  },
                  "beneficiaryBankBIC": "string",
                  "fedWireNumber": "string",
                  "sortCode": "string",
                  "chipNumber": "string",
                  "routingNumber": "string",
                  "legalEntityIdentifier": "string"
                }
              }
            },
            "isAmountCalculated": true,
            "amount": "string",
            "currency": "string"
          }
        ],
        "recurrence": {
          "nextPaymentDate": "string",
          "recurrenceUType": "eventBased",
          "onceOff": {
            "paymentDate": "string"
          },
          "intervalSchedule": {
            "finalPaymentDate": "string",
            "paymentsRemaining": 1,
            "nonBusinessDayTreatment": "AFTER",
            "intervals": [
              {
                "interval": "string",
                "dayInInterval": "string"
              }
            ]
          },
          "lastWeekDay": {
            "finalPaymentDate": "string",
            "paymentsRemaining": 1,
            "interval": "string",
            "lastWeekDay": "FRI",
            "nonBusinessDayTreatment": "AFTER"
          },
          "eventBased": {
            "description": "string"
          }
        }
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingScheduledPaymentsList
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Scheduled Payments For Specific Accounts

Code samples

POST https://data.holder.com.au/cds-au/v1/banking/payments/scheduled HTTP/1.1
Host: data.holder.com.au
Content-Type: application/json
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Content-Type':'application/json',
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/payments/scheduled',
  method: 'post',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

POST /banking/payments/scheduled

Obtain scheduled payments for a specified list of accounts

Body parameter

{
  "data": {
    "accountIds": [
      "string"
    ]
  },
  "meta": {}
}

Endpoint Version

Version 1

Parameters

Name In Type Required Description
page query PositiveInteger optional Page of results to request (standard pagination)
page-size query PositiveInteger optional Page size to request. Default is 25 (standard pagination)
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.
body body RequestAccountIds mandatory Array of specific accountIds to obtain scheduled payments for. The accounts specified are the source of funds for the payments returned

Example responses

200 Response

{
  "data": {
    "scheduledPayments": [
      {
        "scheduledPaymentId": "string",
        "nickname": "string",
        "payerReference": "string",
        "payeeReference": "string",
        "status": "ACTIVE",
        "from": {
          "accountId": "string"
        },
        "paymentSet": [
          {
            "to": {
              "toUType": "accountId",
              "accountId": "string",
              "payeeId": "string",
              "nickname": "string",
              "payeeReference": "string",
              "domestic": {
                "payeeAccountUType": "account",
                "account": {
                  "accountName": "string",
                  "bsb": "string",
                  "accountNumber": "string"
                },
                "card": {
                  "cardNumber": "string"
                },
                "payId": {
                  "name": "string",
                  "identifier": "string",
                  "type": "ABN"
                }
              },
              "biller": {
                "billerCode": "string",
                "crn": "string",
                "billerName": "string"
              },
              "international": {
                "beneficiaryDetails": {
                  "name": "string",
                  "country": "string",
                  "message": "string"
                },
                "bankDetails": {
                  "country": "string",
                  "accountNumber": "string",
                  "bankAddress": {
                    "name": "string",
                    "address": "string"
                  },
                  "beneficiaryBankBIC": "string",
                  "fedWireNumber": "string",
                  "sortCode": "string",
                  "chipNumber": "string",
                  "routingNumber": "string",
                  "legalEntityIdentifier": "string"
                }
              }
            },
            "isAmountCalculated": true,
            "amount": "string",
            "currency": "string"
          }
        ],
        "recurrence": {
          "nextPaymentDate": "string",
          "recurrenceUType": "eventBased",
          "onceOff": {
            "paymentDate": "string"
          },
          "intervalSchedule": {
            "finalPaymentDate": "string",
            "paymentsRemaining": 1,
            "nonBusinessDayTreatment": "AFTER",
            "intervals": [
              {
                "interval": "string",
                "dayInInterval": "string"
              }
            ]
          },
          "lastWeekDay": {
            "finalPaymentDate": "string",
            "paymentsRemaining": 1,
            "interval": "string",
            "lastWeekDay": "FRI",
            "nonBusinessDayTreatment": "AFTER"
          },
          "eventBased": {
            "description": "string"
          }
        }
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingScheduledPaymentsList
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Payees

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/payees HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/payees',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/payees

Obtain a list of pre-registered payees

Endpoint Version

Version 1

Parameters

Name In Type Required Description
type query string optional Filter on the payee type field. In addition to normal type field values, ALL can be specified to retrieve all payees. If absent the assumed value is ALL
page query PositiveInteger optional Page of results to request (standard pagination)
page-size query PositiveInteger optional Page size to request. Default is 25 (standard pagination)
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.

Enumerated Values

Parameter Value
type ALL
type BILLER
type DOMESTIC
type INTERNATIONAL

Example responses

200 Response

{
  "data": {
    "payees": [
      {
        "payeeId": "string",
        "nickname": "string",
        "description": "string",
        "type": "BILLER",
        "creationDate": "string"
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingPayeeList
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Payee Detail

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/payees/{payeeId} HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string
x-fapi-interaction-id: string
x-fapi-auth-date: string
x-fapi-customer-ip-address: string
x-cds-client-headers: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string',
  'x-fapi-interaction-id':'string',
  'x-fapi-auth-date':'string',
  'x-fapi-customer-ip-address':'string',
  'x-cds-client-headers':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/payees/{payeeId}',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/payees/{payeeId}

Obtain detailed information on a single payee.

Note that the payee sub-structure should be selected to represent the payment destination only rather than any known characteristics of the payment recipient

Endpoint Version

Version 1

Parameters

Name In Type Required Description
payeeId path ASCIIString mandatory The ID used to locate the details of a particular payee
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.
x-fapi-interaction-id header string optional An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
x-fapi-auth-date header string optional The time when the customer last logged in to the Data Recipient Software Product. Required for all resource calls (customer present and unattended). Not to be included for unauthenticated calls.
x-fapi-customer-ip-address header string optional The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.
x-cds-client-headers header Base64 optional The customer's original standard http headers Base64 encoded, including the original User Agent header, if the customer is currently logged in to the Data Recipient Software Product. Mandatory for customer present calls. Not required for unattended or unauthenticated calls.

Example responses

200 Response

{
  "data": {
    "payeeId": "string",
    "nickname": "string",
    "description": "string",
    "type": "BILLER",
    "creationDate": "string",
    "payeeUType": "biller",
    "domestic": {
      "payeeAccountUType": "account",
      "account": {
        "accountName": "string",
        "bsb": "string",
        "accountNumber": "string"
      },
      "card": {
        "cardNumber": "string"
      },
      "payId": {
        "name": "string",
        "identifier": "string",
        "type": "ABN"
      }
    },
    "biller": {
      "billerCode": "string",
      "crn": "string",
      "billerName": "string"
    },
    "international": {
      "beneficiaryDetails": {
        "name": "string",
        "country": "string",
        "message": "string"
      },
      "bankDetails": {
        "country": "string",
        "accountNumber": "string",
        "bankAddress": {
          "name": "string",
          "address": "string"
        },
        "beneficiaryBankBIC": "string",
        "fedWireNumber": "string",
        "sortCode": "string",
        "chipNumber": "string",
        "routingNumber": "string",
        "legalEntityIdentifier": "string"
      }
    }
  },
  "links": {
    "self": "string"
  },
  "meta": {}
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingPayeeById
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.
200 x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.
4xx x-fapi-interaction-id string An RFC4122 UUID used as a correlation id. If provided, the data holder must play back this value in the x-fapi-interaction-id response header. If not provided a [RFC4122] UUID value is required to be provided in the response header to track the interaction.

Get Products

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/products HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/products',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/products

Obtain a list of products that are currently openly offered to the market

Note that the results returned by this end point are expected to be ordered in descending order according to lastUpdated.

Conventions

In the product reference payloads there are a number of recurring conventions that are explained here, in one place.

Arrays Of Features

In the product detail payload there are a number of arrays articulating generic features, constraints, prices, etc. The intent of these arrays is as follows:

URIs To More Information

As the complexities and nuances of a financial product can not easily be fully expressed in a data structure without a high degree of complexity it is necessary to provide additional reference information that a potential customer can access so that they are fully informed of the features and implications of the product. The payloads for product reference therefore contain numerous fields that are provided to allow the product holder to describe the product more fully using a web page hosted on their online channels.

These URIs do not need to all link to different pages. If desired, they can all link to a single hosted page and use difference HTML anchors to focus on a specific topic such as eligibility or fees.

Linkage To Accounts

From the moment that a customer applies for a product and an account is created the account and the product that spawned it will diverge. Rates and features of the product may change and a discount may be negotiated for the account.

For this reason, while productCategory is a common field between accounts and products, there is no specific ID that can be used to link an account to a product within the regime.

Similarly, many of the fields and objects in the product payload will appear in the account detail payload but the structures and semantics are not identical as one refers to a product that can potentially be originated and one refers to an account that actual has been instantiated and created along with the associated decisions inherent in that process.

Dates

It is expected that data consumers needing this data will call relatively frequently to ensure the data they have is representative of the current offering from a bank. To minimise the volume and frequency of these calls the ability to set a lastUpdated field with the date and time of the last update to this product is included. A call for a list of products can then be filtered to only return products that have been updated since the last time that data was obtained using the updated-since query parameter.

In addition, the concept of effective date and time has also been included. This allows for a product to be marked for obsolescence, or introduction, from a certain time without the need for an update to show that a product has been changed. The inclusion of these dates also removes the need to represent deleted products in the payload. Products that are no long offered can be marked not effective for a few weeks before they are then removed from the product set as an option entirely.

Obsolete versions: v1 v2

Endpoint Version

Version 3

Parameters

Name In Type Required Description
effective query string optional Allows for the filtering of products based on whether the current time is within the period of time defined as effective by the effectiveFrom and effectiveTo fields. Valid values are ‘CURRENT’, ‘FUTURE’ and ‘ALL’. If absent defaults to 'CURRENT'
updated-since query DateTimeString optional Only include products that have been updated after the specified date and time. If absent defaults to include all products
brand query string optional Filter results based on a specific brand
product-category query string optional Used to filter results on the productCategory field applicable to accounts. Any one of the valid values for this field can be supplied. If absent then all accounts returned.
page query PositiveInteger optional Page of results to request (standard pagination)
page-size query PositiveInteger optional Page size to request. Default is 25 (standard pagination)
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.

Enumerated Values

Parameter Value
effective ALL
effective CURRENT
effective FUTURE
product-category BUSINESS_LOANS
product-category CRED_AND_CHRG_CARDS
product-category LEASES
product-category MARGIN_LOANS
product-category OVERDRAFTS
product-category PERS_LOANS
product-category REGULATED_TRUST_ACCOUNTS
product-category RESIDENTIAL_MORTGAGES
product-category TERM_DEPOSITS
product-category TRADE_FINANCE
product-category TRANS_AND_SAVINGS_ACCOUNTS
product-category TRAVEL_CARDS

Example responses

200 Response

{
  "data": {
    "products": [
      {
        "productId": "string",
        "effectiveFrom": "string",
        "effectiveTo": "string",
        "lastUpdated": "string",
        "productCategory": "BUSINESS_LOANS",
        "name": "string",
        "description": "string",
        "brand": "string",
        "brandName": "string",
        "applicationUri": "string",
        "isTailored": true,
        "additionalInformation": {
          "overviewUri": "string",
          "termsUri": "string",
          "eligibilityUri": "string",
          "feesAndPricingUri": "string",
          "bundleUri": "string"
        },
        "cardArt": [
          {
            "title": "string",
            "imageUri": "string"
          }
        ]
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingProductList
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.

Get Product Detail

Code samples

GET https://data.holder.com.au/cds-au/v1/banking/products/{productId} HTTP/1.1
Host: data.holder.com.au
Accept: application/json
x-v: string
x-min-v: string

var headers = {
  'Accept':'application/json',
  'x-v':'string',
  'x-min-v':'string'

};

$.ajax({
  url: 'https://data.holder.com.au/cds-au/v1/banking/products/{productId}',
  method: 'get',

  headers: headers,
  success: function(data) {
    console.log(JSON.stringify(data));
  }
})

GET /banking/products/{productId}

Obtain detailed information on a single product offered openly to the market.

Obsolete versions: v1 v2

Endpoint Version

Version 3

Parameters

Name In Type Required Description
productId path ASCIIString mandatory ID of the specific product requested
x-v header string mandatory Version of the API end point requested by the client. Must be set to a positive integer. The data holder should respond with the highest supported version between x-min-v and x-v. If the value of x-min-v is equal to or higher than the value of x-v then the x-min-v header should be treated as absent. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable. See HTTP Headers
x-min-v header string optional Minimum version of the API end point requested by the client. Must be set to a positive integer if provided. The data holder should respond with the highest supported version between x-min-v and x-v. If all versions requested are not supported then the data holder must respond with a 406 Not Acceptable.

Example responses

200 Response

{
  "data": {
    "productId": "string",
    "effectiveFrom": "string",
    "effectiveTo": "string",
    "lastUpdated": "string",
    "productCategory": "BUSINESS_LOANS",
    "name": "string",
    "description": "string",
    "brand": "string",
    "brandName": "string",
    "applicationUri": "string",
    "isTailored": true,
    "additionalInformation": {
      "overviewUri": "string",
      "termsUri": "string",
      "eligibilityUri": "string",
      "feesAndPricingUri": "string",
      "bundleUri": "string"
    },
    "cardArt": [
      {
        "title": "string",
        "imageUri": "string"
      }
    ],
    "bundles": [
      {
        "name": "string",
        "description": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string",
        "productIds": [
          "string"
        ]
      }
    ],
    "features": [
      {
        "featureType": "ADDITIONAL_CARDS",
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ],
    "constraints": [
      {
        "constraintType": "MAX_BALANCE",
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ],
    "eligibility": [
      {
        "eligibilityType": "BUSINESS",
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ],
    "fees": [
      {
        "name": "string",
        "feeType": "DEPOSIT",
        "amount": "string",
        "balanceRate": "string",
        "transactionRate": "string",
        "accruedRate": "string",
        "accrualFrequency": "string",
        "currency": "string",
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string",
        "discounts": [
          {
            "description": "string",
            "discountType": "BALANCE",
            "amount": "string",
            "balanceRate": "string",
            "transactionRate": "string",
            "accruedRate": "string",
            "feeRate": "string",
            "additionalValue": "string",
            "additionalInfo": "string",
            "additionalInfoUri": "string",
            "eligibility": [
              {
                "discountEligibilityType": "BUSINESS",
                "additionalValue": "string",
                "additionalInfo": "string",
                "additionalInfoUri": "string"
              }
            ]
          }
        ]
      }
    ],
    "depositRates": [
      {
        "depositRateType": "BONUS",
        "rate": "string",
        "calculationFrequency": "string",
        "applicationFrequency": "string",
        "tiers": [
          {
            "name": "string",
            "unitOfMeasure": "DAY",
            "minimumValue": 0,
            "maximumValue": 0,
            "rateApplicationMethod": "PER_TIER",
            "applicabilityConditions": {
              "additionalInfo": "string",
              "additionalInfoUri": "string"
            },
            "additionalInfo": "string",
            "additionalInfoUri": "string"
          }
        ],
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ],
    "lendingRates": [
      {
        "lendingRateType": "BUNDLE_DISCOUNT_FIXED",
        "rate": "string",
        "comparisonRate": "string",
        "calculationFrequency": "string",
        "applicationFrequency": "string",
        "interestPaymentDue": "IN_ADVANCE",
        "repaymentType": "INTEREST_ONLY",
        "loanPurpose": "INVESTMENT",
        "tiers": [
          {
            "name": "string",
            "unitOfMeasure": "DAY",
            "minimumValue": 0,
            "maximumValue": 0,
            "rateApplicationMethod": "PER_TIER",
            "applicabilityConditions": {
              "additionalInfo": "string",
              "additionalInfoUri": "string"
            },
            "additionalInfo": "string",
            "additionalInfoUri": "string"
          }
        ],
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ]
  },
  "links": {
    "self": "string"
  },
  "meta": {}
}

Responses

Status Meaning Description Schema
200 OK Success ResponseBankingProductById
4xx Client Error The following error codes MUST be supported:
ResponseErrorListV2

Response Headers

Status Header Type Format Description
200 x-v string The version of the API end point that the data holder has responded with.

Schemas

RequestAccountIds

{
  "data": {
    "accountIds": [
      "string"
    ]
  },
  "meta": {}
}

Properties

Name Type Required Description
data object mandatory none
» accountIds [string] mandatory none
meta Meta optional none

ResponseBankingProductList

{
  "data": {
    "products": [
      {
        "productId": "string",
        "effectiveFrom": "string",
        "effectiveTo": "string",
        "lastUpdated": "string",
        "productCategory": "BUSINESS_LOANS",
        "name": "string",
        "description": "string",
        "brand": "string",
        "brandName": "string",
        "applicationUri": "string",
        "isTailored": true,
        "additionalInformation": {
          "overviewUri": "string",
          "termsUri": "string",
          "eligibilityUri": "string",
          "feesAndPricingUri": "string",
          "bundleUri": "string"
        },
        "cardArt": [
          {
            "title": "string",
            "imageUri": "string"
          }
        ]
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Properties

Name Type Required Description
data object mandatory none
» products [BankingProductV3] mandatory The list of products returned. If the filter results in an empty set then this array may have no records
links LinksPaginated mandatory none
meta MetaPaginated mandatory none

BankingProductV3

{
  "productId": "string",
  "effectiveFrom": "string",
  "effectiveTo": "string",
  "lastUpdated": "string",
  "productCategory": "BUSINESS_LOANS",
  "name": "string",
  "description": "string",
  "brand": "string",
  "brandName": "string",
  "applicationUri": "string",
  "isTailored": true,
  "additionalInformation": {
    "overviewUri": "string",
    "termsUri": "string",
    "eligibilityUri": "string",
    "feesAndPricingUri": "string",
    "bundleUri": "string"
  },
  "cardArt": [
    {
      "title": "string",
      "imageUri": "string"
    }
  ]
}

Properties

Name Type Required Description
productId ASCIIString mandatory A data holder specific unique identifier for this product. This identifier must be unique to a product but does not otherwise need to adhere to ID permanence guidelines.
effectiveFrom DateTimeString optional The date and time from which this product is effective (ie. is available for origination). Used to enable the articulation of products to the regime before they are available for customers to originate
effectiveTo DateTimeString optional The date and time at which this product will be retired and will no longer be offered. Used to enable the managed deprecation of products
lastUpdated DateTimeString mandatory The last date and time that the information for this product was changed (or the creation date for the product if it has never been altered)
productCategory BankingProductCategory mandatory The category to which a product or account belongs. See here for more details
name string mandatory The display name of the product
description string mandatory A description of the product
brand string mandatory A label of the brand for the product. Able to be used for filtering. For data holders with single brands this value is still required
brandName string optional An optional display name of the brand
applicationUri URIString optional A link to an application web page where this product can be applied for.
isTailored Boolean mandatory Indicates whether the product is specifically tailored to a circumstance. In this case fees and prices are significantly negotiated depending on context. While all products are open to a degree of tailoring this flag indicates that tailoring is expected and thus that the provision of specific fees and rates is not applicable
additionalInformation object optional Object that contains links to additional information on specific topics
» overviewUri URIString optional General overview of the product
» termsUri URIString optional Terms and conditions for the product
» eligibilityUri URIString optional Eligibility rules and criteria for the product
» feesAndPricingUri URIString optional Description of fees, pricing, discounts, exemptions and bonuses for the product
» bundleUri URIString optional Description of a bundle that this product can be part of
cardArt [object] optional An array of card art images
» title string optional Display label for the specific image
» imageUri URIString mandatory URI reference to a PNG, JPG or GIF image with proportions defined by ISO 7810 ID-1 and width no greater than 512 pixels. The URI reference may be a link or url-encoded data URI RFC 2397

ResponseBankingProductById

{
  "data": {
    "productId": "string",
    "effectiveFrom": "string",
    "effectiveTo": "string",
    "lastUpdated": "string",
    "productCategory": "BUSINESS_LOANS",
    "name": "string",
    "description": "string",
    "brand": "string",
    "brandName": "string",
    "applicationUri": "string",
    "isTailored": true,
    "additionalInformation": {
      "overviewUri": "string",
      "termsUri": "string",
      "eligibilityUri": "string",
      "feesAndPricingUri": "string",
      "bundleUri": "string"
    },
    "cardArt": [
      {
        "title": "string",
        "imageUri": "string"
      }
    ],
    "bundles": [
      {
        "name": "string",
        "description": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string",
        "productIds": [
          "string"
        ]
      }
    ],
    "features": [
      {
        "featureType": "ADDITIONAL_CARDS",
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ],
    "constraints": [
      {
        "constraintType": "MAX_BALANCE",
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ],
    "eligibility": [
      {
        "eligibilityType": "BUSINESS",
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ],
    "fees": [
      {
        "name": "string",
        "feeType": "DEPOSIT",
        "amount": "string",
        "balanceRate": "string",
        "transactionRate": "string",
        "accruedRate": "string",
        "accrualFrequency": "string",
        "currency": "string",
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string",
        "discounts": [
          {
            "description": "string",
            "discountType": "BALANCE",
            "amount": "string",
            "balanceRate": "string",
            "transactionRate": "string",
            "accruedRate": "string",
            "feeRate": "string",
            "additionalValue": "string",
            "additionalInfo": "string",
            "additionalInfoUri": "string",
            "eligibility": [
              {
                "discountEligibilityType": "BUSINESS",
                "additionalValue": "string",
                "additionalInfo": "string",
                "additionalInfoUri": "string"
              }
            ]
          }
        ]
      }
    ],
    "depositRates": [
      {
        "depositRateType": "BONUS",
        "rate": "string",
        "calculationFrequency": "string",
        "applicationFrequency": "string",
        "tiers": [
          {
            "name": "string",
            "unitOfMeasure": "DAY",
            "minimumValue": 0,
            "maximumValue": 0,
            "rateApplicationMethod": "PER_TIER",
            "applicabilityConditions": {
              "additionalInfo": "string",
              "additionalInfoUri": "string"
            },
            "additionalInfo": "string",
            "additionalInfoUri": "string"
          }
        ],
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ],
    "lendingRates": [
      {
        "lendingRateType": "BUNDLE_DISCOUNT_FIXED",
        "rate": "string",
        "comparisonRate": "string",
        "calculationFrequency": "string",
        "applicationFrequency": "string",
        "interestPaymentDue": "IN_ADVANCE",
        "repaymentType": "INTEREST_ONLY",
        "loanPurpose": "INVESTMENT",
        "tiers": [
          {
            "name": "string",
            "unitOfMeasure": "DAY",
            "minimumValue": 0,
            "maximumValue": 0,
            "rateApplicationMethod": "PER_TIER",
            "applicabilityConditions": {
              "additionalInfo": "string",
              "additionalInfoUri": "string"
            },
            "additionalInfo": "string",
            "additionalInfoUri": "string"
          }
        ],
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ]
  },
  "links": {
    "self": "string"
  },
  "meta": {}
}

Properties

Name Type Required Description
data BankingProductDetailV3 mandatory none
links Links mandatory none
meta Meta optional none

BankingProductDetailV3

{
  "productId": "string",
  "effectiveFrom": "string",
  "effectiveTo": "string",
  "lastUpdated": "string",
  "productCategory": "BUSINESS_LOANS",
  "name": "string",
  "description": "string",
  "brand": "string",
  "brandName": "string",
  "applicationUri": "string",
  "isTailored": true,
  "additionalInformation": {
    "overviewUri": "string",
    "termsUri": "string",
    "eligibilityUri": "string",
    "feesAndPricingUri": "string",
    "bundleUri": "string"
  },
  "cardArt": [
    {
      "title": "string",
      "imageUri": "string"
    }
  ],
  "bundles": [
    {
      "name": "string",
      "description": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string",
      "productIds": [
        "string"
      ]
    }
  ],
  "features": [
    {
      "featureType": "ADDITIONAL_CARDS",
      "additionalValue": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string"
    }
  ],
  "constraints": [
    {
      "constraintType": "MAX_BALANCE",
      "additionalValue": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string"
    }
  ],
  "eligibility": [
    {
      "eligibilityType": "BUSINESS",
      "additionalValue": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string"
    }
  ],
  "fees": [
    {
      "name": "string",
      "feeType": "DEPOSIT",
      "amount": "string",
      "balanceRate": "string",
      "transactionRate": "string",
      "accruedRate": "string",
      "accrualFrequency": "string",
      "currency": "string",
      "additionalValue": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string",
      "discounts": [
        {
          "description": "string",
          "discountType": "BALANCE",
          "amount": "string",
          "balanceRate": "string",
          "transactionRate": "string",
          "accruedRate": "string",
          "feeRate": "string",
          "additionalValue": "string",
          "additionalInfo": "string",
          "additionalInfoUri": "string",
          "eligibility": [
            {
              "discountEligibilityType": "BUSINESS",
              "additionalValue": "string",
              "additionalInfo": "string",
              "additionalInfoUri": "string"
            }
          ]
        }
      ]
    }
  ],
  "depositRates": [
    {
      "depositRateType": "BONUS",
      "rate": "string",
      "calculationFrequency": "string",
      "applicationFrequency": "string",
      "tiers": [
        {
          "name": "string",
          "unitOfMeasure": "DAY",
          "minimumValue": 0,
          "maximumValue": 0,
          "rateApplicationMethod": "PER_TIER",
          "applicabilityConditions": {
            "additionalInfo": "string",
            "additionalInfoUri": "string"
          },
          "additionalInfo": "string",
          "additionalInfoUri": "string"
        }
      ],
      "additionalValue": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string"
    }
  ],
  "lendingRates": [
    {
      "lendingRateType": "BUNDLE_DISCOUNT_FIXED",
      "rate": "string",
      "comparisonRate": "string",
      "calculationFrequency": "string",
      "applicationFrequency": "string",
      "interestPaymentDue": "IN_ADVANCE",
      "repaymentType": "INTEREST_ONLY",
      "loanPurpose": "INVESTMENT",
      "tiers": [
        {
          "name": "string",
          "unitOfMeasure": "DAY",
          "minimumValue": 0,
          "maximumValue": 0,
          "rateApplicationMethod": "PER_TIER",
          "applicabilityConditions": {
            "additionalInfo": "string",
            "additionalInfoUri": "string"
          },
          "additionalInfo": "string",
          "additionalInfoUri": "string"
        }
      ],
      "additionalValue": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string"
    }
  ]
}

Properties

allOf

Name Type Required Description
anonymous BankingProductV3 mandatory none

and

Name Type Required Description
anonymous object mandatory none
» bundles [BankingProductBundle] optional An array of bundles that this product participates in. Each bundle is described by free form information but also by a list of product IDs of the other products that are included in the bundle. It is assumed that the current product is included in the bundle also
» features [BankingProductFeature] optional Array of features available for the product
» constraints [BankingProductConstraint] optional Constraints on the application for or operation of the product such as minimum balances or limit thresholds
» eligibility [BankingProductEligibility] optional Eligibility criteria for the product
» fees [BankingProductFee] optional Fees applicable for the product
» depositRates [BankingProductDepositRate] optional Interest rates available for deposits
» lendingRates [BankingProductLendingRateV2] optional Interest rates charged against lending balances

BankingProductBundle

{
  "name": "string",
  "description": "string",
  "additionalInfo": "string",
  "additionalInfoUri": "string",
  "productIds": [
    "string"
  ]
}

Properties

Name Type Required Description
name string mandatory Name of the bundle
description string mandatory Description of the bundle
additionalInfo string optional Display text providing more information on the bundle
additionalInfoUri URIString optional Link to a web page with more information on the bundle criteria and benefits
productIds [string] optional Array of product IDs for products included in the bundle that are available via the product end points. Note that this array is not intended to represent a comprehensive model of the products included in the bundle and some products available for the bundle may not be available via the product reference end points

BankingProductFeature

{
  "featureType": "ADDITIONAL_CARDS",
  "additionalValue": "string",
  "additionalInfo": "string",
  "additionalInfoUri": "string"
}

Properties

Name Type Required Description
featureType string mandatory The type of feature described
additionalValue string conditional Generic field containing additional information relevant to the featureType specified. Whether mandatory or not is dependent on the value of the featureType.
additionalInfo string conditional Display text providing more information on the feature. Mandatory if the feature type is set to OTHER
additionalInfoUri URIString optional Link to a web page with more information on this feature

Enumerated Values

Property Value
featureType ADDITIONAL_CARDS
featureType BALANCE_TRANSFERS
featureType BILL_PAYMENT
featureType BONUS_REWARDS
featureType CARD_ACCESS
featureType COMPLEMENTARY_PRODUCT_DISCOUNTS
featureType DIGITAL_BANKING
featureType DIGITAL_WALLET
featureType DONATE_INTEREST
featureType FREE_TXNS
featureType FREE_TXNS_ALLOWANCE
featureType INSURANCE
featureType INTEREST_FREE
featureType INTEREST_FREE_TRANSFERS
featureType LOYALTY_PROGRAM
featureType NOTIFICATIONS
featureType NPP_ENABLED
featureType NPP_PAYID
featureType OFFSET
featureType OTHER
featureType OVERDRAFT
featureType REDRAW
featureType UNLIMITED_TXNS

BankingProductConstraint

{
  "constraintType": "MAX_BALANCE",
  "additionalValue": "string",
  "additionalInfo": "string",
  "additionalInfoUri": "string"
}

Properties

Name Type Required Description
constraintType string mandatory The type of constraint described. See the next section for an overview of valid values and their meaning
additionalValue string conditional Generic field containing additional information relevant to the constraintType specified. Whether mandatory or not is dependent on the value of constraintType
additionalInfo string optional Display text providing more information the constraint
additionalInfoUri URIString optional Link to a web page with more information on the constraint

Enumerated Values

Property Value
constraintType MAX_BALANCE
constraintType MAX_LIMIT
constraintType MIN_BALANCE
constraintType MIN_LIMIT
constraintType OPENING_BALANCE

BankingProductEligibility

{
  "eligibilityType": "BUSINESS",
  "additionalValue": "string",
  "additionalInfo": "string",
  "additionalInfoUri": "string"
}

Properties

Name Type Required Description
eligibilityType string mandatory The type of eligibility criteria described. See the next section for an overview of valid values and their meaning
additionalValue string conditional Generic field containing additional information relevant to the eligibilityType specified. Whether mandatory or not is dependent on the value of eligibilityType
additionalInfo string conditional Display text providing more information on the eligibility criteria. Mandatory if the field is set to OTHER
additionalInfoUri URIString optional Link to a web page with more information on this eligibility criteria

Enumerated Values

Property Value
eligibilityType BUSINESS
eligibilityType EMPLOYMENT_STATUS
eligibilityType MAX_AGE
eligibilityType MIN_AGE
eligibilityType MIN_INCOME
eligibilityType MIN_TURNOVER
eligibilityType NATURAL_PERSON
eligibilityType OTHER
eligibilityType PENSION_RECIPIENT
eligibilityType RESIDENCY_STATUS
eligibilityType STAFF
eligibilityType STUDENT

BankingProductFee

{
  "name": "string",
  "feeType": "DEPOSIT",
  "amount": "string",
  "balanceRate": "string",
  "transactionRate": "string",
  "accruedRate": "string",
  "accrualFrequency": "string",
  "currency": "string",
  "additionalValue": "string",
  "additionalInfo": "string",
  "additionalInfoUri": "string",
  "discounts": [
    {
      "description": "string",
      "discountType": "BALANCE",
      "amount": "string",
      "balanceRate": "string",
      "transactionRate": "string",
      "accruedRate": "string",
      "feeRate": "string",
      "additionalValue": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string",
      "eligibility": [
        {
          "discountEligibilityType": "BUSINESS",
          "additionalValue": "string",
          "additionalInfo": "string",
          "additionalInfoUri": "string"
        }
      ]
    }
  ]
}

Properties

Name Type Required Description
name string mandatory Name of the fee
feeType string mandatory The type of fee
amount AmountString conditional The amount charged for the fee. One of amount, balanceRate, transactionRate and accruedRate is mandatory unless the feeType "VARIABLE" is supplied
balanceRate RateString conditional A fee rate calculated based on a proportion of the balance. One of amount, balanceRate, transactionRate and accruedRate is mandatory unless the feeType "VARIABLE" is supplied.
transactionRate RateString conditional A fee rate calculated based on a proportion of a transaction. One of amount, balanceRate, transactionRate and accruedRate is mandatory unless the feeType "VARIABLE" is supplied
accruedRate RateString conditional A fee rate calculated based on a proportion of the calculated interest accrued on the account. One of amount, balanceRate, transactionRate and accruedRate is mandatory unless the feeType "VARIABLE" is supplied
accrualFrequency ExternalRef optional The indicative frequency with which the fee is calculated on the account. Only applies if balanceRate or accruedRate is also present. Formatted according to ISO 8601 Durations (excludes recurrence syntax)
currency CurrencyString optional The currency the fee will be charged in. Assumes AUD if absent
additionalValue string conditional Generic field containing additional information relevant to the feeType specified. Whether mandatory or not is dependent on the value of feeType
additionalInfo string optional Display text providing more information on the fee
additionalInfoUri URIString optional Link to a web page with more information on this fee
discounts [BankingProductDiscount] optional An optional list of discounts to this fee that may be available

Enumerated Values

Property Value
feeType DEPOSIT
feeType EVENT
feeType EXIT
feeType PAYMENT
feeType PERIODIC
feeType PURCHASE
feeType TRANSACTION
feeType UPFRONT
feeType VARIABLE
feeType WITHDRAWAL

BankingProductDiscount

{
  "description": "string",
  "discountType": "BALANCE",
  "amount": "string",
  "balanceRate": "string",
  "transactionRate": "string",
  "accruedRate": "string",
  "feeRate": "string",
  "additionalValue": "string",
  "additionalInfo": "string",
  "additionalInfoUri": "string",
  "eligibility": [
    {
      "discountEligibilityType": "BUSINESS",
      "additionalValue": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string"
    }
  ]
}

Properties

Name Type Required Description
description string mandatory Description of the discount
discountType string mandatory The type of discount. See the next section for an overview of valid values and their meaning
amount AmountString conditional Dollar value of the discount. One of amount, balanceRate, transactionRate, accruedRate and feeRate is mandatory.
balanceRate RateString conditional A discount rate calculated based on a proportion of the balance. Note that the currency of the fee discount is expected to be the same as the currency of the fee itself. One of amount, balanceRate, transactionRate, accruedRate and feeRate is mandatory. Unless noted in additionalInfo, assumes the application and calculation frequency are the same as the corresponding fee
transactionRate RateString conditional A discount rate calculated based on a proportion of a transaction. Note that the currency of the fee discount is expected to be the same as the currency of the fee itself. One of amount, balanceRate, transactionRate, accruedRate and feeRate is mandatory
accruedRate RateString conditional A discount rate calculated based on a proportion of the calculated interest accrued on the account. Note that the currency of the fee discount is expected to be the same as the currency of the fee itself. One of amount, balanceRate, transactionRate, accruedRate and feeRate is mandatory. Unless noted in additionalInfo, assumes the application and calculation frequency are the same as the corresponding fee
feeRate RateString conditional A discount rate calculated based on a proportion of the fee to which this discount is attached. Note that the currency of the fee discount is expected to be the same as the currency of the fee itself. One of amount, balanceRate, transactionRate, accruedRate and feeRate is mandatory. Unless noted in additionalInfo, assumes the application and calculation frequency are the same as the corresponding fee
additionalValue string conditional Generic field containing additional information relevant to the discountType specified. Whether mandatory or not is dependent on the value of discountType
additionalInfo string optional Display text providing more information on the discount
additionalInfoUri URIString optional Link to a web page with more information on this discount
eligibility [BankingProductDiscountEligibility] conditional Eligibility constraints that apply to this discount. Mandatory if discountType is ELIGIBILITY_ONLY.

Enumerated Values

Property Value
discountType BALANCE
discountType DEPOSITS
discountType ELIGIBILITY_ONLY
discountType FEE_CAP
discountType PAYMENTS

BankingProductDiscountEligibility

{
  "discountEligibilityType": "BUSINESS",
  "additionalValue": "string",
  "additionalInfo": "string",
  "additionalInfoUri": "string"
}

Properties

Name Type Required Description
discountEligibilityType string mandatory The type of the specific eligibility constraint for a discount
additionalValue string conditional Generic field containing additional information relevant to the discountEligibilityType specified. Whether mandatory or not is dependent on the value of discountEligibilityType
additionalInfo string conditional Display text providing more information on this eligibility constraint. Whether mandatory or not is dependent on the value of discountEligibilityType
additionalInfoUri URIString optional Link to a web page with more information on this eligibility constraint

Enumerated Values

Property Value
discountEligibilityType BUSINESS
discountEligibilityType EMPLOYMENT_STATUS
discountEligibilityType INTRODUCTORY
discountEligibilityType MAX_AGE
discountEligibilityType MIN_AGE
discountEligibilityType MIN_INCOME
discountEligibilityType MIN_TURNOVER
discountEligibilityType NATURAL_PERSON
discountEligibilityType OTHER
discountEligibilityType PENSION_RECIPIENT
discountEligibilityType RESIDENCY_STATUS
discountEligibilityType STAFF
discountEligibilityType STUDENT

BankingProductDepositRate

{
  "depositRateType": "BONUS",
  "rate": "string",
  "calculationFrequency": "string",
  "applicationFrequency": "string",
  "tiers": [
    {
      "name": "string",
      "unitOfMeasure": "DAY",
      "minimumValue": 0,
      "maximumValue": 0,
      "rateApplicationMethod": "PER_TIER",
      "applicabilityConditions": {
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      },
      "additionalInfo": "string",
      "additionalInfoUri": "string"
    }
  ],
  "additionalValue": "string",
  "additionalInfo": "string",
  "additionalInfoUri": "string"
}

Properties

Name Type Required Description
depositRateType string mandatory The type of rate (base, bonus, etc). See the next section for an overview of valid values and their meaning
rate RateString mandatory The rate to be applied
calculationFrequency ExternalRef optional The period after which the rate is applied to the balance to calculate the amount due for the period. Calculation of the amount is often daily (as balances may change) but accumulated until the total amount is 'applied' to the account (see applicationFrequency). Formatted according to ISO 8601 Durations (excludes recurrence syntax)
applicationFrequency ExternalRef optional The period after which the calculated amount(s) (see calculationFrequency) are 'applied' (i.e. debited or credited) to the account. Formatted according to ISO 8601 Durations (excludes recurrence syntax)
tiers [BankingProductRateTierV3] optional Rate tiers applicable for this rate
additionalValue string conditional Generic field containing additional information relevant to the depositRateType specified. Whether mandatory or not is dependent on the value of depositRateType
additionalInfo string optional Display text providing more information on the rate
additionalInfoUri URIString optional Link to a web page with more information on this rate

Enumerated Values

Property Value
depositRateType BONUS
depositRateType BUNDLE_BONUS
depositRateType FIXED
depositRateType FLOATING
depositRateType INTRODUCTORY
depositRateType MARKET_LINKED
depositRateType VARIABLE

BankingProductLendingRateV2

{
  "lendingRateType": "BUNDLE_DISCOUNT_FIXED",
  "rate": "string",
  "comparisonRate": "string",
  "calculationFrequency": "string",
  "applicationFrequency": "string",
  "interestPaymentDue": "IN_ADVANCE",
  "repaymentType": "INTEREST_ONLY",
  "loanPurpose": "INVESTMENT",
  "tiers": [
    {
      "name": "string",
      "unitOfMeasure": "DAY",
      "minimumValue": 0,
      "maximumValue": 0,
      "rateApplicationMethod": "PER_TIER",
      "applicabilityConditions": {
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      },
      "additionalInfo": "string",
      "additionalInfoUri": "string"
    }
  ],
  "additionalValue": "string",
  "additionalInfo": "string",
  "additionalInfoUri": "string"
}

Properties

Name Type Required Description
lendingRateType string mandatory The type of rate (fixed, variable, etc). See the next section for an overview of valid values and their meaning
rate RateString mandatory The rate to be applied
comparisonRate RateString optional A comparison rate equivalent for this rate
calculationFrequency ExternalRef optional The period after which the rate is applied to the balance to calculate the amount due for the period. Calculation of the amount is often daily (as balances may change) but accumulated until the total amount is 'applied' to the account (see applicationFrequency). Formatted according to ISO 8601 Durations (excludes recurrence syntax)
applicationFrequency ExternalRef optional The period after which the calculated amount(s) (see calculationFrequency) are 'applied' (i.e. debited or credited) to the account. Formatted according to ISO 8601 Durations (excludes recurrence syntax)
interestPaymentDue string optional When loan payments are due to be paid within each period. The investment benefit of earlier payments affect the rate that can be offered
repaymentType string optional Options in place for repayments. If absent, the lending rate is applicable to all repayment types
loanPurpose string optional The reason for taking out the loan. If absent, the lending rate is applicable to all loan purposes
tiers [BankingProductRateTierV3] optional Rate tiers applicable for this rate
additionalValue string conditional Generic field containing additional information relevant to the lendingRateType specified. Whether mandatory or not is dependent on the value of lendingRateType
additionalInfo string optional Display text providing more information on the rate.
additionalInfoUri URIString optional Link to a web page with more information on this rate

Enumerated Values

Property Value
lendingRateType BUNDLE_DISCOUNT_FIXED
lendingRateType BUNDLE_DISCOUNT_VARIABLE
lendingRateType CASH_ADVANCE
lendingRateType DISCOUNT
lendingRateType FIXED
lendingRateType FLOATING
lendingRateType INTRODUCTORY
lendingRateType MARKET_LINKED
lendingRateType PENALTY
lendingRateType PURCHASE
lendingRateType VARIABLE
interestPaymentDue IN_ADVANCE
interestPaymentDue IN_ARREARS
repaymentType INTEREST_ONLY
repaymentType PRINCIPAL_AND_INTEREST
loanPurpose INVESTMENT
loanPurpose OWNER_OCCUPIED

BankingProductRateTierV3

{
  "name": "string",
  "unitOfMeasure": "DAY",
  "minimumValue": 0,
  "maximumValue": 0,
  "rateApplicationMethod": "PER_TIER",
  "applicabilityConditions": {
    "additionalInfo": "string",
    "additionalInfoUri": "string"
  },
  "additionalInfo": "string",
  "additionalInfoUri": "string"
}

Defines the criteria and conditions for which a rate applies

Properties

Name Type Required Description
name string mandatory A display name for the tier
unitOfMeasure string mandatory The unit of measure that applies to the tierValueMinimum and tierValueMaximum values e.g. a DOLLAR amount. PERCENT (in the case of loan-to-value ratio or LVR). Tier term period representing a discrete number of MONTH's or DAY's (in the case of term deposit tiers)
minimumValue Number mandatory The number of tierUnitOfMeasure units that form the lower bound of the tier. The tier should be inclusive of this value
maximumValue Number optional The number of tierUnitOfMeasure units that form the upper bound of the tier or band. For a tier with a discrete value (as opposed to a range of values e.g. 1 month) this must be the same as tierValueMinimum. Where this is the same as the tierValueMinimum value of the next-higher tier the referenced tier should be exclusive of this value. For example a term deposit of 2 months falls into the upper tier of the following tiers: (1 – 2 months, 2 – 3 months). If absent the tier's range has no upper bound.
rateApplicationMethod string optional The method used to calculate the amount to be applied using one or more tiers. A single rate may be applied to the entire balance or each applicable tier rate is applied to the portion of the balance that falls into that tier (referred to as 'bands' or 'steps')
applicabilityConditions BankingProductRateCondition optional Defines a condition for the applicability of a tiered rate
additionalInfo string optional Display text providing more information on the rate tier.
additionalInfoUri URIString optional Link to a web page with more information on this rate tier

Enumerated Values

Property Value
unitOfMeasure DAY
unitOfMeasure DOLLAR
unitOfMeasure MONTH
unitOfMeasure PERCENT
rateApplicationMethod PER_TIER
rateApplicationMethod WHOLE_BALANCE

BankingProductRateCondition

{
  "additionalInfo": "string",
  "additionalInfoUri": "string"
}

Defines a condition for the applicability of a tiered rate

Properties

Name Type Required Description
additionalInfo string optional Display text providing more information on the condition
additionalInfoUri URIString optional Link to a web page with more information on this condition

ResponseBankingAccountList

{
  "data": {
    "accounts": [
      {
        "accountId": "string",
        "creationDate": "string",
        "displayName": "string",
        "nickname": "string",
        "openStatus": "CLOSED",
        "isOwned": true,
        "maskedNumber": "string",
        "productCategory": "BUSINESS_LOANS",
        "productName": "string"
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Properties

Name Type Required Description
data object mandatory none
» accounts [BankingAccount] mandatory The list of accounts returned. If the filter results in an empty set then this array may have no records
links LinksPaginated mandatory none
meta MetaPaginated mandatory none

BankingAccount

{
  "accountId": "string",
  "creationDate": "string",
  "displayName": "string",
  "nickname": "string",
  "openStatus": "CLOSED",
  "isOwned": true,
  "maskedNumber": "string",
  "productCategory": "BUSINESS_LOANS",
  "productName": "string"
}

Properties

Name Type Required Description
accountId ASCIIString mandatory A unique ID of the account adhering to the standards for ID permanence
creationDate DateString optional Date that the account was created (if known)
displayName string mandatory The display name of the account as defined by the bank. This should not incorporate account numbers or PANs. If it does the values should be masked according to the rules of the MaskedAccountString common type.
nickname string optional A customer supplied nick name for the account
openStatus string optional Open or closed status for the account. If not present then OPEN is assumed
isOwned Boolean optional Flag indicating that the customer associated with the authorisation is an owner of the account. Does not indicate sole ownership, however. If not present then 'true' is assumed
maskedNumber MaskedAccountString mandatory A masked version of the account. Whether BSB/Account Number, Credit Card PAN or another number
productCategory BankingProductCategory mandatory The category to which a product or account belongs. See here for more details
productName string mandatory The unique identifier of the account as defined by the data holder (akin to model number for the account)

Enumerated Values

Property Value
openStatus CLOSED
openStatus OPEN

ResponseBankingAccountById

{
  "data": {
    "accountId": "string",
    "creationDate": "string",
    "displayName": "string",
    "nickname": "string",
    "openStatus": "CLOSED",
    "isOwned": true,
    "maskedNumber": "string",
    "productCategory": "BUSINESS_LOANS",
    "productName": "string",
    "bsb": "string",
    "accountNumber": "string",
    "bundleName": "string",
    "specificAccountUType": "creditCard",
    "termDeposit": [
      {
        "lodgementDate": "string",
        "maturityDate": "string",
        "maturityAmount": "string",
        "maturityCurrency": "string",
        "maturityInstructions": "HOLD_ON_MATURITY"
      }
    ],
    "creditCard": {
      "minPaymentAmount": "string",
      "paymentDueAmount": "string",
      "paymentCurrency": "string",
      "paymentDueDate": "string"
    },
    "loan": {
      "originalStartDate": "string",
      "originalLoanAmount": "string",
      "originalLoanCurrency": "string",
      "loanEndDate": "string",
      "nextInstalmentDate": "string",
      "minInstalmentAmount": "string",
      "minInstalmentCurrency": "string",
      "maxRedraw": "string",
      "maxRedrawCurrency": "string",
      "minRedraw": "string",
      "minRedrawCurrency": "string",
      "offsetAccountEnabled": true,
      "offsetAccountIds": [
        "string"
      ],
      "repaymentType": "INTEREST_ONLY",
      "repaymentFrequency": "string"
    },
    "depositRate": "string",
    "lendingRate": "string",
    "depositRates": [
      {
        "depositRateType": "BONUS",
        "rate": "string",
        "calculationFrequency": "string",
        "applicationFrequency": "string",
        "tiers": [
          {
            "name": "string",
            "unitOfMeasure": "DAY",
            "minimumValue": 0,
            "maximumValue": 0,
            "rateApplicationMethod": "PER_TIER",
            "applicabilityConditions": {
              "additionalInfo": "string",
              "additionalInfoUri": "string"
            },
            "additionalInfo": "string",
            "additionalInfoUri": "string"
          }
        ],
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ],
    "lendingRates": [
      {
        "lendingRateType": "BUNDLE_DISCOUNT_FIXED",
        "rate": "string",
        "comparisonRate": "string",
        "calculationFrequency": "string",
        "applicationFrequency": "string",
        "interestPaymentDue": "IN_ADVANCE",
        "repaymentType": "INTEREST_ONLY",
        "loanPurpose": "INVESTMENT",
        "tiers": [
          {
            "name": "string",
            "unitOfMeasure": "DAY",
            "minimumValue": 0,
            "maximumValue": 0,
            "rateApplicationMethod": "PER_TIER",
            "applicabilityConditions": {
              "additionalInfo": "string",
              "additionalInfoUri": "string"
            },
            "additionalInfo": "string",
            "additionalInfoUri": "string"
          }
        ],
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string"
      }
    ],
    "features": [
      {
        "featureType": "ADDITIONAL_CARDS",
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string",
        "isActivated": true
      }
    ],
    "fees": [
      {
        "name": "string",
        "feeType": "DEPOSIT",
        "amount": "string",
        "balanceRate": "string",
        "transactionRate": "string",
        "accruedRate": "string",
        "accrualFrequency": "string",
        "currency": "string",
        "additionalValue": "string",
        "additionalInfo": "string",
        "additionalInfoUri": "string",
        "discounts": [
          {
            "description": "string",
            "discountType": "BALANCE",
            "amount": "string",
            "balanceRate": "string",
            "transactionRate": "string",
            "accruedRate": "string",
            "feeRate": "string",
            "additionalValue": "string",
            "additionalInfo": "string",
            "additionalInfoUri": "string",
            "eligibility": [
              {
                "discountEligibilityType": "BUSINESS",
                "additionalValue": "string",
                "additionalInfo": "string",
                "additionalInfoUri": "string"
              }
            ]
          }
        ]
      }
    ],
    "addresses": [
      {
        "addressUType": "paf",
        "simple": {
          "mailingName": "string",
          "addressLine1": "string",
          "addressLine2": "string",
          "addressLine3": "string",
          "postcode": "string",
          "city": "string",
          "state": "string",
          "country": "AUS"
        },
        "paf": {
          "dpid": "string",
          "thoroughfareNumber1": 0,
          "thoroughfareNumber1Suffix": "string",
          "thoroughfareNumber2": 0,
          "thoroughfareNumber2Suffix": "string",
          "flatUnitType": "string",
          "flatUnitNumber": "string",
          "floorLevelType": "string",
          "floorLevelNumber": "string",
          "lotNumber": "string",
          "buildingName1": "string",
          "buildingName2": "string",
          "streetName": "string",
          "streetType": "string",
          "streetSuffix": "string",
          "postalDeliveryType": "string",
          "postalDeliveryNumber": 0,
          "postalDeliveryNumberPrefix": "string",
          "postalDeliveryNumberSuffix": "string",
          "localityName": "string",
          "postcode": "string",
          "state": "string"
        }
      }
    ]
  },
  "links": {
    "self": "string"
  },
  "meta": {}
}

Properties

Name Type Required Description
data BankingAccountDetail mandatory none
links Links mandatory none
meta Meta optional none

BankingAccountDetail

{
  "accountId": "string",
  "creationDate": "string",
  "displayName": "string",
  "nickname": "string",
  "openStatus": "CLOSED",
  "isOwned": true,
  "maskedNumber": "string",
  "productCategory": "BUSINESS_LOANS",
  "productName": "string",
  "bsb": "string",
  "accountNumber": "string",
  "bundleName": "string",
  "specificAccountUType": "creditCard",
  "termDeposit": [
    {
      "lodgementDate": "string",
      "maturityDate": "string",
      "maturityAmount": "string",
      "maturityCurrency": "string",
      "maturityInstructions": "HOLD_ON_MATURITY"
    }
  ],
  "creditCard": {
    "minPaymentAmount": "string",
    "paymentDueAmount": "string",
    "paymentCurrency": "string",
    "paymentDueDate": "string"
  },
  "loan": {
    "originalStartDate": "string",
    "originalLoanAmount": "string",
    "originalLoanCurrency": "string",
    "loanEndDate": "string",
    "nextInstalmentDate": "string",
    "minInstalmentAmount": "string",
    "minInstalmentCurrency": "string",
    "maxRedraw": "string",
    "maxRedrawCurrency": "string",
    "minRedraw": "string",
    "minRedrawCurrency": "string",
    "offsetAccountEnabled": true,
    "offsetAccountIds": [
      "string"
    ],
    "repaymentType": "INTEREST_ONLY",
    "repaymentFrequency": "string"
  },
  "depositRate": "string",
  "lendingRate": "string",
  "depositRates": [
    {
      "depositRateType": "BONUS",
      "rate": "string",
      "calculationFrequency": "string",
      "applicationFrequency": "string",
      "tiers": [
        {
          "name": "string",
          "unitOfMeasure": "DAY",
          "minimumValue": 0,
          "maximumValue": 0,
          "rateApplicationMethod": "PER_TIER",
          "applicabilityConditions": {
            "additionalInfo": "string",
            "additionalInfoUri": "string"
          },
          "additionalInfo": "string",
          "additionalInfoUri": "string"
        }
      ],
      "additionalValue": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string"
    }
  ],
  "lendingRates": [
    {
      "lendingRateType": "BUNDLE_DISCOUNT_FIXED",
      "rate": "string",
      "comparisonRate": "string",
      "calculationFrequency": "string",
      "applicationFrequency": "string",
      "interestPaymentDue": "IN_ADVANCE",
      "repaymentType": "INTEREST_ONLY",
      "loanPurpose": "INVESTMENT",
      "tiers": [
        {
          "name": "string",
          "unitOfMeasure": "DAY",
          "minimumValue": 0,
          "maximumValue": 0,
          "rateApplicationMethod": "PER_TIER",
          "applicabilityConditions": {
            "additionalInfo": "string",
            "additionalInfoUri": "string"
          },
          "additionalInfo": "string",
          "additionalInfoUri": "string"
        }
      ],
      "additionalValue": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string"
    }
  ],
  "features": [
    {
      "featureType": "ADDITIONAL_CARDS",
      "additionalValue": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string",
      "isActivated": true
    }
  ],
  "fees": [
    {
      "name": "string",
      "feeType": "DEPOSIT",
      "amount": "string",
      "balanceRate": "string",
      "transactionRate": "string",
      "accruedRate": "string",
      "accrualFrequency": "string",
      "currency": "string",
      "additionalValue": "string",
      "additionalInfo": "string",
      "additionalInfoUri": "string",
      "discounts": [
        {
          "description": "string",
          "discountType": "BALANCE",
          "amount": "string",
          "balanceRate": "string",
          "transactionRate": "string",
          "accruedRate": "string",
          "feeRate": "string",
          "additionalValue": "string",
          "additionalInfo": "string",
          "additionalInfoUri": "string",
          "eligibility": [
            {
              "discountEligibilityType": "BUSINESS",
              "additionalValue": "string",
              "additionalInfo": "string",
              "additionalInfoUri": "string"
            }
          ]
        }
      ]
    }
  ],
  "addresses": [
    {
      "addressUType": "paf",
      "simple": {
        "mailingName": "string",
        "addressLine1": "string",
        "addressLine2": "string",
        "addressLine3": "string",
        "postcode": "string",
        "city": "string",
        "state": "string",
        "country": "AUS"
      },
      "paf": {
        "dpid": "string",
        "thoroughfareNumber1": 0,
        "thoroughfareNumber1Suffix": "string",
        "thoroughfareNumber2": 0,
        "thoroughfareNumber2Suffix": "string",
        "flatUnitType": "string",
        "flatUnitNumber": "string",
        "floorLevelType": "string",
        "floorLevelNumber": "string",
        "lotNumber": "string",
        "buildingName1": "string",
        "buildingName2": "string",
        "streetName": "string",
        "streetType": "string",
        "streetSuffix": "string",
        "postalDeliveryType": "string",
        "postalDeliveryNumber": 0,
        "postalDeliveryNumberPrefix": "string",
        "postalDeliveryNumberSuffix": "string",
        "localityName": "string",
        "postcode": "string",
        "state": "string"
      }
    }
  ]
}

Properties

allOf

Name Type Required Description
anonymous BankingAccount mandatory none

and

Name Type Required Description
anonymous object mandatory none
» bsb string optional The unmasked BSB for the account. Is expected to be formatted as digits only with leading zeros included and no punctuation or spaces
» accountNumber string optional The unmasked account number for the account. Should not be supplied if the account number is a PAN requiring PCI compliance. Is expected to be formatted as digits only with leading zeros included and no punctuation or spaces
» bundleName string optional Optional field to indicate if this account is part of a bundle that is providing additional benefit for to the customer
» specificAccountUType string optional The type of structure to present account specific fields.
» termDeposit [BankingTermDepositAccount] conditional none
» creditCard BankingCreditCardAccount conditional none
» loan BankingLoanAccount conditional none
» depositRate RateString optional current rate to calculate interest earned being applied to deposit balances as it stands at the time of the API call
» lendingRate RateString optional The current rate to calculate interest payable being applied to lending balances as it stands at the time of the API call
» depositRates [BankingProductDepositRate] optional Fully described deposit rates for this account based on the equivalent structure in Product Reference
» lendingRates [BankingProductLendingRateV2] optional Fully described deposit rates for this account based on the equivalent structure in Product Reference
» features [allOf] optional Array of features of the account based on the equivalent structure in Product Reference with the following additional field

allOf

Name Type Required Description
»» anonymous BankingProductFeature mandatory none

and

Name Type Required Description
»» anonymous object mandatory none
»»» isActivated Boolean optional True if the feature is already activated and false if the feature is available for activation. Defaults to true if absent. (note this is an additional field appended to the feature object defined in the Product Reference payload)

continued

Name Type Required Description
»» fees [BankingProductFee] optional Fees and charges applicable to the account based on the equivalent structure in Product Reference
»» addresses [CommonPhysicalAddress] optional The addresses for the account to be used for correspondence

Enumerated Values

Property Value
specificAccountUType creditCard
specificAccountUType loan
specificAccountUType termDeposit

BankingTermDepositAccount

{
  "lodgementDate": "string",
  "maturityDate": "string",
  "maturityAmount": "string",
  "maturityCurrency": "string",
  "maturityInstructions": "HOLD_ON_MATURITY"
}

Properties

Name Type Required Description
lodgementDate DateString mandatory The lodgement date of the original deposit
maturityDate DateString mandatory Maturity date for the term deposit
maturityAmount AmountString optional Amount to be paid upon maturity. If absent it implies the amount to paid is variable and cannot currently be calculated
maturityCurrency CurrencyString optional If absent assumes AUD
maturityInstructions string mandatory Current instructions on action to be taken at maturity. This includes default actions that may be specified in the terms and conditions for the product e.g. roll-over to the same term and frequency of interest payments

Enumerated Values

Property Value
maturityInstructions HOLD_ON_MATURITY
maturityInstructions PAID_OUT_AT_MATURITY
maturityInstructions ROLLED_OVER

BankingCreditCardAccount

{
  "minPaymentAmount": "string",
  "paymentDueAmount": "string",
  "paymentCurrency": "string",
  "paymentDueDate": "string"
}

Properties

Name Type Required Description
minPaymentAmount AmountString mandatory The minimum payment amount due for the next card payment
paymentDueAmount AmountString mandatory The amount due for the next card payment
paymentCurrency CurrencyString optional If absent assumes AUD
paymentDueDate DateString mandatory Date that the next payment for the card is due

BankingLoanAccount

{
  "originalStartDate": "string",
  "originalLoanAmount": "string",
  "originalLoanCurrency": "string",
  "loanEndDate": "string",
  "nextInstalmentDate": "string",
  "minInstalmentAmount": "string",
  "minInstalmentCurrency": "string",
  "maxRedraw": "string",
  "maxRedrawCurrency": "string",
  "minRedraw": "string",
  "minRedrawCurrency": "string",
  "offsetAccountEnabled": true,
  "offsetAccountIds": [
    "string"
  ],
  "repaymentType": "INTEREST_ONLY",
  "repaymentFrequency": "string"
}

Properties

Name Type Required Description
originalStartDate DateString optional Optional original start date for the loan
originalLoanAmount AmountString optional Optional original loan value
originalLoanCurrency CurrencyString optional If absent assumes AUD
loanEndDate DateString mandatory Date that the loan is due to be repaid in full
nextInstalmentDate DateString mandatory Next date that an instalment is required
minInstalmentAmount AmountString optional Minimum amount of next instalment
minInstalmentCurrency CurrencyString optional If absent assumes AUD
maxRedraw AmountString optional Maximum amount of funds that can be redrawn. If not present redraw is not available even if the feature exists for the account
maxRedrawCurrency CurrencyString optional If absent assumes AUD
minRedraw AmountString optional Minimum redraw amount
minRedrawCurrency CurrencyString optional If absent assumes AUD
offsetAccountEnabled Boolean optional Set to true if one or more offset accounts are configured for this loan account
offsetAccountIds [string] optional The accountIDs of the configured offset accounts attached to this loan. Only offset accounts that can be accessed under the current authorisation should be included. It is expected behaviour that offsetAccountEnabled is set to true but the offsetAccountIds field is absent or empty. This represents a situation where an offset account exists but details can not be accessed under the current authorisation
repaymentType string optional Options in place for repayments. If absent defaults to PRINCIPAL_AND_INTEREST
repaymentFrequency ExternalRef mandatory The expected or required repayment frequency. Formatted according to ISO 8601 Durations (excludes recurrence syntax)

Enumerated Values

Property Value
repaymentType INTEREST_ONLY
repaymentType PRINCIPAL_AND_INTEREST

ResponseBankingTransactionList

{
  "data": {
    "transactions": [
      {
        "accountId": "string",
        "transactionId": "string",
        "isDetailAvailable": true,
        "type": "DIRECT_DEBIT",
        "status": "PENDING",
        "description": "string",
        "postingDateTime": "string",
        "valueDateTime": "string",
        "executionDateTime": "string",
        "amount": "string",
        "currency": "string",
        "reference": "string",
        "merchantName": "string",
        "merchantCategoryCode": "string",
        "billerCode": "string",
        "billerName": "string",
        "crn": "string",
        "apcaNumber": "string"
      }
    ]
  },
  "links": {
    "self": "string",
    "first": "string",
    "prev": "string",
    "next": "string",
    "last": "string"
  },
  "meta": {
    "totalRecords": 0,
    "totalPages": 0
  }
}

Properties

Name Type Required Description
data object mandatory none
» transactions [BankingTransaction] mandatory none
links LinksPaginated mandatory none
meta MetaPaginated mandatory none

BankingTransaction

{
  "accountId": "string",
  "transactionId": "string",
  "isDetailAvailable": true,
  "type": "DIRECT_DEBIT",
  "status": "PENDING",
  "description": "string",
  "postingDateTime": "string",
  "valueDateTime": "string",
  "executionDateTime": "string",
  "amount": "string",
  "currency": "string",
  "reference": "string",
  "merchantName": "string",
  "merchantCategoryCode": "string",
  "billerCode": "string",
  "billerName": "string",
  "crn": "string",
  "apcaNumber": "string"
}

Properties

Name Type Required Description
accountId ASCIIString mandatory ID of the account for which transactions are provided
transactionId ASCIIString conditional A unique ID of the transaction adhering to the standards for ID permanence. This is mandatory (through hashing if necessary) unless there are specific and justifiable technical reasons why a transaction cannot be uniquely identified for a particular account type. It is mandatory if isDetailAvailable is set to true.
isDetailAvailable Boolean mandatory True if extended information is available using the transaction detail end point. False if extended data is not available
type string mandatory The type of the transaction
status string mandatory Status of the transaction whether pending or posted. Note that there is currently no provision in the standards to guarantee the ability to correlate a pending transaction with an associated posted transaction
description string mandatory The transaction description as applied by the financial institution
postingDateTime DateTimeString conditional The time the transaction was posted. This field is Mandatory if the transaction has status POSTED. This is the time that appears on a standard statement
valueDateTime DateTimeString optional Date and time at which assets become available to the account owner in case of a credit entry, or cease to be available to the account owner in case of a debit transaction entry
executionDateTime DateTimeString optional The time the transaction was executed by the originating customer, if available
amount AmountString mandatory The value of the transaction. Negative values mean money was outgoing from the account
currency CurrencyString optional The currency for the transaction amount. AUD assumed if not present
reference string mandatory The reference for the transaction provided by the originating institution. Empty string if no data provided
merchantName string optional Name of the merchant for an outgoing payment to a merchant
merchantCategoryCode string optional The merchant category code (or MCC) for an outgoing payment to a merchant
billerCode string optional BPAY Biller Code for the transaction (if available)
billerName string optional Name of the BPAY biller for the transaction (if available)
crn string conditional BPAY CRN for the transaction (if available).
Where the CRN contains sensitive information, it should be masked in line with how the Data Holder currently displays account identifiers in their existing online banking channels. If the contents of the CRN match the format of a Credit Card PAN they should be masked according to the rules applicable for MaskedPANString. If the contents are are otherwise sensitive, then it should be masked using the rules applicable for the MaskedAccountString common type.
apcaNumber string optional 6 Digit APCA number for the initiating institution. The field is fixed-width and padded with leading zeros if applicable.

Enumerated Values

Property Value
type DIRECT_DEBIT
type FEE
type INTEREST_CHARGED
type INTEREST_PAID
type OTHER
type PAYMENT
type TRANSFER_INCOMING
type TRANSFER_OUTGOING
status PENDING
status POSTED

ResponseBankingTransactionById

{
  "data": {
    "accountId": "string",
    "transactionId": "string",
    "isDetailAvailable": true,
    "type": "DIRECT_DEBIT",
    "status": "PENDING",
    "description": "string",
    "postingDateTime": "string",
    "valueDateTime": "string",
    "executionDateTime": "string",
    "amount": "string",
    "currency": "string",
    "reference": "string",
    "merchantName": "string",
    "merchantCategoryCode": "string",
    "billerCode": "string",
    "billerName": "string",
    "crn": "string",
    "apcaNumber": "string",
    "extendedData": {
      "payer": "string",
      "payee": "string",
      "extensionUType": "x2p101Payload",
      "x2p101Payload": {