HSBC Bank Australia

HSBC Bank Australia Limited is the Australian banking subsidiary of the global HSBC Group (HSBC Holdings plc), operating as an Authorised Deposit-taking Institution (ADI) regulated by APRA and ASIC. It is a wholly owned, shareholder-owned bank (not a customer-owned mutual) offering home loans, everyday and savings accounts, credit cards, term deposits, and business and international banking across Australia. As a designated data holder under Australia's Consumer Data Right (CDR / Open Banking), HSBC Australia exposes a public, unauthenticated Product Reference Data (PRD) API plus the full authenticated CDR Banking surface - accounts, balances, transactions, direct debits, scheduled payments, and payees - conforming to the DSB Consumer Data Standards CDR Banking API (v1.36.0). The public product endpoints are on https://public.ob.hsbc.com.au/cds-au/v1 and the consumer-authorized endpoints on the MTLS host https://mtls.ob.hsbc.com.au/cds-au/v1, accessible only to Accredited Data Recipients under the CDR ADR model. HSBC is presently a data holder only and is not accredited to receive third-party banking data. Beyond the Australian CDR surface, HSBC Group operates a global developer portal at develop.hsbc.com covering commercial/corporate banking APIs and non-Australian Open Banking markets.

Kin Score

This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance.

How we profile HSBC Bank Australia

Each block below is one kind of artifact we hold for HSBC Bank Australia. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.

APIs 8

Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.

Individual APIs this provider publishes, each with its own machine-readable definition.

HSBC Developer Portal - Commercial APIs (HSBC Group, partner-gated)

HSBC Group's global developer portal (develop.hsbc.com) documents commercial / corporate-banking APIs available to HSBC's business and corporate clients, alongside Open Banking ...

HSBC Bank Australia Banking Account Balances API

Banking Account Balance endpoints

HSBC Bank Australia Banking Account Direct Debits API

Banking Account Direct Debit endpoints

HSBC Bank Australia Banking Account Scheduled Payments API

Banking Account Scheduled Payment endpoints

HSBC Bank Australia Banking Account Transactions API

Banking Account Transaction endpoints

HSBC Bank Australia Banking Accounts API

Banking Account endpoints

HSBC Bank Australia Banking Payees API

Banking Payee endpoints

HSBC Bank Australia Banking Products API

Banking Product endpoints

Scroll within the panel for all 8 ·

Arazzo Workflows 2

Real integrations are rarely a single call. Arazzo describes the multi-step sequences — auth, then create, then confirm — so both a human and an agent can follow the choreography, not just the endpoints.

Multi-step API workflows described with the Arazzo specification.

_Index

ARAZZO

HSBC Australia CDR - Browse Products

Browse the HSBC Bank Australia public Consumer Data Right Product Reference Data catalog, then fetch the full detail of the first product returned. Both operations are public an...

ARAZZO

MCP Servers 1

Model Context Protocol servers expose these APIs directly to AI agents. We profile them because agent-native access is the fastest-growing way this provider's capabilities actually get used.

Model Context Protocol servers that expose these APIs to AI agents.

hsbc-australia-mcp.yml

MCP SERVER

Security Posture 2

Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Hsbc Australia Authentication

none/openIdConnect/oauth2/mutualTLS · 3 schemes

SECURITY

Hsbc Australia Domain Security

TLSv1.3 · HSTS · DMARC

SECURITY

Scopes 1

OAuth scopes are the vocabulary of least-privilege access. Profiling them shows exactly what an integration — or an agent acting on a user's behalf — is allowed to do.

OAuth scopes governing access to this provider's APIs.

Hsbc Australia Scopes

10 scopes · authorizationCode

10 scopes

SCOPES

Agentic Access 1

An x-agentic-access contract marks which operations are safe for an agent to run on its own and which need a human in the loop. It is the difference between an API an agent can use and one it can use safely.

Recommended x-agentic-access execution contracts for AI agents.

Hsbc Australia Agentic Access

19 operations · 3 acting

19 operations · 3 acting

AGENTIC

Resources

Every other property we hold for HSBC Bank Australia — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.

← All providers · Data indexed from github.com/api-evangelist/hsbc-australia · machine-readable index on apis.io