This is not our API. This repository is an independent, third-party profile of a company's publicly available API surface, maintained by API Evangelist. API Evangelist does not operate, host, resell, or support this company's APIs, and is not affiliated with or endorsed by the company unless stated on the profile.
Where the information came from. Everything here is assembled from material a member of the public can reach with a browser and no credentials — the company's own website, developer portal and documentation, the specifications it publishes for public use (OpenAPI, AsyncAPI, JSON Schema,
apis.json,llms.txtand similar), its public repositories, and its public status, pricing and changelog pages. Nothing here is obtained by breaching a system, defeating an access control, or using credentials of any kind.The rating is an independent assessment. The Kin Score and Agent Readiness rating are independently calculated scores of a company's public API artifacts, produced by API Evangelist against a published rubric. They are not certifications, endorsements, security assessments, or audits, and they score published artifacts — not the quality, safety, or security of the software.
Corrections, re-scores, and removal are free. No partnership, contract, or purchase is required, and you do not need to justify the request.
- Something wrong? Open an issue on this repository, or email info@apievangelist.com.
- Published something new? Ask for a re-score and we will re-run the rating.
- Want the listing taken down? Say so and we will honor it. The profile is reduced to your company name, a factual description, and a link to your own site, and the company is recorded as unrated — never scored zero for having asked.
Response times. Acknowledgement within one business day; removal or restriction within two business days; corrections and re-scores within five business days.
On a security or compliance team? Email info@apievangelist.com with security in the subject line and you will get a person, not a form. We will tell you exactly which public URLs this profile was built from so your team can see the same surface we did, and we will take the listing down on request while you work through it.
Full detail: Where this data comes from
Red Energy Pty Ltd (ABN 60 107 479 372) is an Australian electricity and gas retailer, wholly owned by Snowy Hydro Ltd, that supplies more than a million residential and business customers across New South Wales, Victoria, Queensland, South Australia and the ACT from a Richmond, Victoria base. It sits on the retail end of the National Electricity Market value chain: Snowy Hydro generates, the distribution network businesses own the poles and wires, AEMO operates the market and holds metering data, and Red Energy owns the customer, the tariff and the bill. Its API posture is entirely a product of statute rather than product strategy. Red Energy publishes no developer portal, no self-serve API programme and no proprietary specification — developer., api., docs. and data. subdomains do not resolve, and redenergy.com.au itself sits behind a Cloudflare bot challenge that returns HTTP 403 to any non-browser client. What it does have is a real, verified Consumer Data Right implementation: it is a designated CDR energy data holder listed on the CDR Register with the public base URI https://public.cdr.redenergy.com.au, which serves the Consumer Data Standards discovery endpoints live with correct x-v version negotiation, while 1,705 Red Energy branded plans are published anonymously through the Australian Energy Regulator's Energy Made Easy CDR host.
APIs.json: https://raw.githubusercontent.com/api-evangelist/red-energy/refs/heads/main/apis.yml
- Energy
- Australia
- Utilities
- Electricity
- Gas
- Energy Retail
- Consumer Data Right
- CDR
- Product Reference Data
- Smart Metering
- Open Data
- Created: 2026-07-27
- Modified: 2026-07-27
| Home market | Australia |
| Mandate regime | Consumer Data Right (energy) — Part IVD, Competition and Consumer Act 2010; ACCC as regulator, Treasury Data Standards Body as spec author |
| Mandate status | Live and implemented — verified via CDR Register entry, a live standards-conformant host on a Red Energy domain, and live branded product reference data |
| Data standard | CDR Consumer Data Standards (energy) — CDR Energy API v1.36.0 + CDR Common API v1.36.0, OpenAPI 3.0.3, x-v header versioning |
| Consumer data API | Yes — accredited CDR data recipients only, with consumer consent |
| Open market data | No — Red Energy is a retailer; open NEM/grid data comes from AEMO |
| Access gate | Accredited-only for consumer data; no gate at all on product reference data |
Red Energy is the control case for whether an API mandate is replicable. The same statutory machinery that made every Australian bank publish one identical contract was lifted out of banking and applied to energy, and it worked — a retailer with no developer programme of any kind is now a live, register-listed, standards-conformant API publisher. It produced a compliance surface, not a product.
The unauthenticated Consumer Data Right Product Reference Data surface for the Red Energy brand — Get Generic Plans and Get Generic Plan Detail from the Consumer Data Standards CDR Energy API. Unlike CDR banking, where each authorised deposit-taking institution serves its own product endpoint, energy plan data is served centrally by the Australian Energy Regulator's Energy Made Easy CDR host under a per-brand path. Confirmed live on 2026-07-27: GET /cds-au/v1/energy/plans with header x-v: 1 returned HTTP 200 with response header x-v: 1 and meta.totalRecords 1705 Red Energy plans; the same call with no x-v header returned HTTP 400 and with x-v: 9 returned HTTP 406. No API key, no signup and no accreditation is needed to call it.
- Human URL: https://consumerdatastandardsaustralia.github.io/standards/#energy-apis
- Base URL:
https://cdr.energymadeeasy.gov.au/red-energy/cds-au/v1
- Energy Plans
- Product Reference Data
- Consumer Data Right
- Tariffs
- Australia
Red Energy's own registered Consumer Data Right public base URI, serving the two unauthenticated Data Holder Operations endpoints of the Consumer Data Standards CDR Common API — Get Status and Get Outages. This is the only API surface hosted on a Red Energy controlled domain. Confirmed live on 2026-07-27: GET /cds-au/v1/discovery/status with header x-v: 1 returned HTTP 200 and a CDS-shaped envelope reporting status OK; without an x-v header it returned HTTP 400, and with x-v: 3 it returned HTTP 406.
- Human URL: https://consumerdatastandardsaustralia.github.io/standards/#common-apis
- Base URL:
https://public.cdr.redenergy.com.au/cds-au/v1
- Discovery
- Status
- Outages
- Consumer Data Right
- Australia
The consumer-authorised half of the Consumer Data Right energy obligation that Red Energy is designated to meet as a data holder — electricity service points, usage, distributed energy resources, energy accounts, balances, invoices, billing, concessions and payment schedules, sixteen paths in all. This surface is real and mandated, but it is not open: it is reachable only by an accredited CDR data recipient, over mutual TLS with FAPI-profile OAuth2 and OpenID Connect, after the individual customer grants consent. No base URL is recorded because none is publicly discoverable, and no endpoint on this surface was called.
- Energy Accounts
- Electricity Usage
- Billing
- Distributed Energy Resources
- Consumer Data Right
- Australia
- Kin Lane — kin@apievangelist.com
Round 2 of the API Evangelist enrichment pipeline. Nothing below was invented — each artifact is either harvested from a real source, captured live from a production endpoint, or derived from artifacts already in this repository, and every probe records its HTTP status.
| Artifact | What it holds | Method |
|---|---|---|
authentication/ |
The two-mode auth posture: nothing on the public half, FAPI 1.0 Advanced OAuth2/OIDC over mTLS on the consumer half | searched |
scopes/ |
11 CDR authorisation scopes with consumer-facing data-language equivalents | searched |
conventions/ |
x-v version negotiation, offset pagination, x-fapi-interaction-id tracing, CDS error envelope — and the absence of any idempotency contract |
searched |
errors/ |
The urn:au-cds:error:... registry; three codes observed live |
searched |
lifecycle/ |
Per-endpoint versioning, Endpoint Version Schedule as deprecation policy, 99.5% availability obligation, latency tiers | searched |
rate-limits/ |
CDS traffic thresholds and the 10-calls-per-24-hours velocity limits on NMI, usage and DER data | searched |
conformance/ |
Standards conformance separated into behaviourally verified versus statutorily asserted | searched |
changelog/ |
The DSB standards changelog that governs this contract | searched |
examples/ |
Seven request/response pairs captured live, including the 400, 404 and 406 error shapes | searched |
data-model/ |
The entity graph derived from 160 component schemas | derived |
overlays/ |
OpenAPI Overlay 1.0.0 recording the real hosts and the anonymous/accredited split, without mutating the DSB documents | generated |
agentic-access/ |
All 27 operations classified connected/read — nothing on this API mutates anything |
generated |
skills/ |
Three packaged agent skills grounded in verified operationIds | generated |
arazzo/ |
A runnable four-step workflow across both public hosts | generated |
mcp/ |
Candidate MCP tool set plus a tool-to-operation crosswalk. No MCP server exists in the CDR ecosystem | derived |
llms/ |
Generated llms.txt. No /llms.txt is published on any host |
generated |
packages/ |
Registry search results — no first-party SDK anywhere — plus the DSB/ACCC ecosystem tooling | searched |
security/ |
TLS, HSTS, DNSSEC, CAA, SPF and DMARC probe results | probed |
well-known/ |
Every /.well-known/ and spec-discovery probe and its status. All missed — recorded as a negative, not omitted |
searched |
No webhooks or event surface, so no AsyncAPI. No CLI, no embedded UI components, no sandbox published by Red Energy, no first-party SDK, no Postman collection, no gRPC, no GraphQL, no vulnerability disclosure programme and no trust centre. www.redenergy.com.au returns HTTP 403 with a Cloudflare bot challenge to every programmatic client, including its own CDR policy PDF.