Developer FAQs

AWS – Sydney (ap-southeast-2)

ECDH, RSA

Make sure you have an active consent in ‘My Consent Data‘.

Then navigate to ‘Consent API’ and click on the settings cog at the top right to see your ‘Consent record’. There you’ll find each of your consents. If you click on a specific consent you’ll see each of the data IDs. These consent IDs are needed to get any data.

Navigate to any of the APIs under ‘API Reference’ and select GET next to any of the data types you’d like to retrieve.

For those who aren’t technologists and just want to see how it works, we recommend choosing the Data API which only requires your cdrArrangementId (copied and pasted from your ‘consent record’) to display the consent data.

Most of the time we get data updates in <100ms! If it takes longer, it could depend on a few things, being your bank or how many transactions you have in the first API call (could be thousands!). If the first time takes longer, subsequent API calls are done in a flash.

CDR data currently goes back to 2017. But the longer CDR is around the further back the data will go, to a maximum of 7 years of data.

Adatree passes through your data directly from the source, so the best place to start is with the data holder (your bank or energy provider).

With screen scraping customers provide their bank login credentials, such as their username and passwords, to a third-party service who is collecting the data on behalf of the inquiring business like your bank or a lender. That third-party facilitates the scraping of a customer’s information by logging into a consumer’s account and accessing all the same information the consumer would see in their account. Once logged in, the third party is able to “scrape” the data.

The scraping extracts the data from a digital display, collects it as raw text, and converts it for use by the collecting business. Data can continuously be “scraped” and updated from the customer’s accounts when refreshed. To facilitate this automatic process, screen scraping utilises image processing, so it’s not always accurate.

Unfortunately many consumers are unaware and non-consenting to this third-party accessing their personal data. Furthermore, many screen scrapers will sell your data and keep it indefinitely.

Conversely, CDR uses secure APIs provided by the Data Holder (e.g. a bank) organisations so Data Recipients (e.g. mortgage brokers) can access the data consistently, reliably, and in near real-time.

CDR rules and regulations dictate what customers and data recipients can view and do in terms of data sharing as well as the underlying technical standards, which ensures that consumers know what data is shared, with whom, for how long, and for what purpose. This is managed through an interface called a consent dashboard, which the customer can operate through both the Data Holder and the Data Recipient.

You may withdraw your consent at any time and can be done in three (3) ways:
1 – Through the data recipient consent dashboard;
2 – Through the data holder consent dashboard; or
3 – In writing to either party.

If you use the consent dashboard to withdraw your consent, the status of your consent will be updated in near real-time and reflect your change almost immediately. If you choose to withdraw your consent in writing, this will be completed by the data recipient or data holder within two business days.

If you withdraw your consent we’ll delete your data. However some services require your active consent and withdrawing consent could mean the services provided by the data recipient may cease.

Consumers receive a notification every 90 days to confirm the data they’ve shared, the expiry date and other consent information. They’ll receive a notification with a summary of these details any time they:
Grant consent
Commence allowing Adatree to collect CDR data
Commence allowing Adatree to disclose CDR data;
Manage consent;
Withdraw consent; or
Have consent that is expired.

You may not opt out of these notifications at any time.

Adatree must adhere to the data minimisation principle. This principle outlines that a data recipient can only ask you for data that is absolutely necessary and can only hold it for the minimum amount of time it is needed to provide their service.

Any time you give consent to a data recipient, you can also request that your CDR data, and any data derived from it, be deleted as soon as it becomes redundant. This can be managed when you first give consent or at any time your consent status is active..

We’ll only use your data for the purpose you have agreed to, and we will delete it after it has been used for that purpose.

When you withdraw data sharing consent or your consent expires, we’ll automatically irretrievably destroy your data within seconds. We’ll also automatically notify any Outsourced Service Provider or CDR Representative with whom your data has been shared and require them to irretrievably destroy your data as well.

Your data is held by Adatree in our secure and audited environment. Adatree only stores your data in Australia. Adatree does not share data with accredited parties based outside of Australia.