DataRight+: Australian CDR Profile

Scope The scope of this document is intended to be the combinatorial outcome of a variety of specifications to achieve a compliant outcome within the Australian Consumer Data Right. Because this document relates to a specific ecosystem deployment it contains static configuration information. This document does not seek to navigate the complexities of but rather to establish a technical baseline to consider these in each implementors context.

Terminology This specification utilises the various terms outlined within .

Banking Sector: Relates to the Holders, designated under the in the Banking industry
Energy Sector: Relates to the Designated Holders, designated under the in the Energy industry
Designated Holders: Designated Holders are organisations which belong to a designated sector, according to the and meet certain eligibility requirements to be required to deliver CDR services within their sector.

Providers Providers are required to deliver authorisation and resource requirements. They are also required to integrate with the Ecosystem Authority in the prescribed way.

Information Security Providers MUST:

comply with the Provider provisions described in ;
comply with the provisions outlined in ;
comply with the provisions outlined in ;
support the following acr claim and validate the Consumer with the following values:
1. urn:cds.au:cdr:2 where the authentication achieved matches the Credential Level CL1 from or;
2. urn:cds.au:cdr:3 where the authentication achieved matches the Credential Level CL2 from
incorporate One-Time Passwords as part of the requirement to achieve the minimum acceptable value for the acr claim and:
1. MUST be delivered using existing and preferred channels
2. MUST be numeric digits and be between 4 and 6 digits in length
3. MUST only be valid for the purposes of establishing authorisations between Provider and Initiators
4. MUST be invalidated after a reasonable period of time
MUST authenticate a confidential client using private_key_jwt as described in section 9 of with a client identifier of cdr-register
MUST supply a scope value of admin:metrics.basic:read for all successful authentications of the cdr-register client identifier

Note: The CDR currently mandates, essentially exclusively, the use of One-Time Passwords while restricting the introduction of additional "friction" via other factors. It is understood this is currently being reconsidered.

Resource Server Providers operating within the Banking Sector MUST comply with the provisions outlined in and . Providers operating within the Energy Sector MUST comply with the provisions outlined in and .

Metrics In addition to the aforementioned requirements Providers MUST deliver protected resource(s), in accordance with , as follows:

Resource Server Endpoint	Required Scope	Valid `x-v`
`GET /admin/metrics`	`admin:metrics.basic:read`	`5`

Forced Metadata Refresh In addition to the aforementioned requirements Providers MUST deliver protected resource(s), in accordance with , as follows:

Resource Server Endpoint	Required Scope	Valid `x-v`
`GET /admin/metrics`	`admin:metadata:update`	`1`

On requesting this endpoint the Provider MUST trigger a refresh of the information obtained from the Ecosystem Directory.

Initiators Initiators are required to comply with Ecosystem Authority requirements and integrate with Providers in prescribed ways. Within the Australian CDR Initiators are commonly referred to as Software Products.

Information Security Initiators MUST:

comply with the Initiator provisions described in ;
comply with the provisions outlined in ;
comply with the provisions outlined in ;

Resource Server Client Initiators MUST access Provider resource server infrastructure in accordance with:

and;
and;
and;

Ecosystem Authority The Ecosystem Authority MUST comply with the requirements outlined within . The Ecosystem Authority for the Australian CDR is the Australian Competition and Consumer Commission (ACCC).

Accreditation The Ecosystem Authority performs external validation of participant capabilities, particularly of the Initiator Entity. This occurs by way of a combination of Ecosystem Authority verification, external technology audit standards (notably ASAE3150) and legal assertions by a Initiator Entity carrying higher accreditation as to the suitability of new subordinate Initiator Entities. As a result of this validation Initiator Entities are granted an accreditation status which in turn influences the authorisation scopes that are made available to thee relevant Initiator. Further detail on this process in the context of the CDR can be found within the and within guidelines published on the CDR website. The subject of accreditation is not intended to be covered by this specification. As a consequence this document focuses primarily on the relationship between Provider and Initiator with the Ecosystem Authority providing third party assurance with respect to technical admission control.

Electricity Authority The Electricity Authority MUST comply with the relevant provisions outlined within . The Electricity Authority for the Australian CDR is the Australian Energy Market Operator (AEMO).

Electricity Plan Website The Electricity Plan Website MUST comply with the relevant provisions outlined within . The Electricity Plan Website for the Australian CDR is Energy Made Easy operated by the Australian Energy Regulator.

Current Ecosystem Configuration The following outlines the currently understood endpoint configuration for the Australian CDR ecosystem:

Implementation Considerations Where One-Time Password OTP are in use the generation method SHOULD incorporate controls, such as retry limits, to minimise the risk of enumeration attacks.

Acknowledgement The following people contributed to this document:

Stuart Low (Biza.io) - Editor

We acknowledge the contribution to the of the following individuals: - James Bligh (Data Standards Body) - Lead Architect for the Consumer Data Right - Mark Verstege (Data Standards Body) - Lead Architect, Banking & Information Security for the Consumer Data Right - Ivan Hosgood (formerly Data Standards Body & ACCC) - Solutions Architect