Skip to main content

Budget 2024: The Government has announced FamilyBoost, a proposed new childcare payment to help eligible families with the rising costs of Early Childhood Education (ECE). Find out more:

APIs and web services are accessed over the internet. Security is applied in stages and layers to keep our systems and customer information safe.

Our services are restricted

Digital service providers wanting to integrate with us need to go through an approval process.

Security protocols

The following security protocols apply when using our gateway services:

Aspect Standard/protocol Version
Transport layer encryption TLS 1.2
Digital certificates for mutual authentication X.509 RFC 5280 profile
Access tokens OAuth 2.0
Machine-to-machine (M2M) Client signed JSON web token (JWT) 1.2

Transport level security

At a network level, access to our services is restricted to approved providers. This includes access to our test environments.

For integration through a cloud end point

A TLS (SSL) mutual authentication using the TLS 1.2 specification is applied across all gateway services in PROD and QUAL environments.

In the mock services environment, TLS mutual authentication is not used but IP address white listing is applied.

TLS connection requirements for cloud providers

Incoming connections are identified using client side X509 certificates. The client side X509 certificates must be from a certificate of authority and cannot be self-signed.

TLS connection requirements for desktop providers

Desktop providers must connect through one-way TLS. No client side X509 certificates are required.

User identity

Most gateway service requests are controlled using an OAuth token. This token identifies who is making the request. Users need to authenticate using myIR Secure Online Services logon details.

How to get an OAuth token

For web service requests an OAuth token is required in the HTTP header.

Authorisation to use gateway services is defined in the myIR permissions.

If a user does not have permission to file a return online, they will not be able to file a return via gateway services. This applies to users who are granted access as staff inside an organisation or as staff in a tax agency.

Supporting services

Identity and access service

Last updated: 28 Apr 2021
Jump back to the top of the page