The Consumer Data Standards (CDS) are the technical standards for Australia's Consumer Data Right (CDR), maintained by the Data Standards Body. They define a single, byte-for-byte machine-readable contract — including the Banking API — that every accredited data holder must implement identically, covering the resource surface, the FAPI-grade security and consent model, and the standardized error and versioning behavior.
Consumer Data Standards
The Consumer Data Standards (CDS) are the technical rulebook for Australia’s Consumer Data Right (CDR) regime, published and maintained by the Data Standards Body (DSB). Where the CDR is the law, the CDS is the machine-readable contract that makes the law real — a single OpenAPI-described API that every accredited data holder re-hosts under its own base path.
- A mandated, uniform contract - The DSB publishes one Banking API specification (e.g. v1.36.0) and every bank ships the identical surface:
products,accounts,balances,transactions,direct-debits,scheduled-payments,payees, andcustomer. Cross-provider differentiation at the API layer is close to zero by design. - A two-surface access model - A public, unauthenticated Product Reference Data (PRD) surface anyone can call with only an
x-vversion header, and a consent-gated consumer data sharing surface requiring the full FAPI stack and CDR accreditation. - A standardized, least-privilege scope model - Consent maps to scope, scope maps to resource, using a byte-identical CDR scope set (
bank:accounts.basic:read,bank:transactions:read,common:customer.detail:read, and so on).
The CDS is the cleanest specimen in my catalog of a regulator forcing machine-readable substance: it dragged an entire banking sector across the machine-readability line most industries are still arguing about. The lesson from scoring it is that the mandate produced existence, not quality — a valid OpenAPI and bank-grade auth as the floor, but governance, operational transparency, and commercial clarity left to each provider. For anyone building on CDR, the standard is the surface; the differentiation lives entirely in the developer experience and product surface built around it.
Referenced in API Evangelist papers
This standard shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this standard in the context of a real sector.
The State of Australian Banking APIs
The byte-for-byte contract at the center of the report — one API deployed fifty times.
Governed by these regulations
A standard is the machine-readable contract; a regulation is the law that requires it. These are the regulations that mandate or drive this standard, catalogued at regulations.apievangelist.com.
Consumer Data Right (CDR)
The Australian law that mandates this byte-for-byte Banking API contract.
Referenced on the API Evangelist blog
Where this standard shows up across sixteen years of my writing at apievangelist.com — how it fits into API design, governance, and the agentic turn.
