Versioned API
The /api/v1/ contract is the source of truth. Breaking changes require a new major version. Deprecation notices are published 180 days in advance with overlap windows.
A versioned, security-first API surface designed for Canadian commercial cyber insurance workflows. Built for carriers and brokers who need deterministic, auditable, and replay-safe integrations.
Four foundational patterns that govern every API interaction — from quoting to claims settlement.
The /api/v1/ contract is the source of truth. Breaking changes require a new major version. Deprecation notices are published 180 days in advance with overlap windows.
Every outbound notification carries an HMAC-SHA256 signature. Replay protection rejects any payload older than 5 minutes. Carriers verify integrity before processing.
HMAC-SHA256Clients provide an idempotency key on every write. Duplicate deliveries are safely deduplicated. Network retries never produce double-binds or duplicate policies.
Duplicate-SafeEvery decision — underwriting, pricing, bind, endorsement, claim — is captured as an immutable event. Full time-travel reconstruction of any policy state at any timestamp.
Event-SourcedFrom appetite check to settlement — each stage maps to a defined API contract with deterministic state transitions.
Submit industry, revenue, and coverage parameters to receive an instant appetite response. Carriers define class-code rules, territory constraints, and minimum premium thresholds — enforced in real time.
Full submission with underwriting data, risk assessment scores, and coverage requirements. Pricing engine applies carrier-specific rules, governance scoring, and authority limits. Response includes premium, deductibles, and endorsements.
Carrier issues a bind order with reference number and effective dates. Idempotency key ensures no duplicate binds. Bound status triggers policy issuance pipeline and downstream notifications.
Policy document generated with all endorsements, conditions, and carrier-specific language. Digital delivery to broker and insured. Policy number assigned and registered in the audit trail.
First notice of loss submitted via API or broker portal. Incident details, loss type, and preliminary assessment captured. Automated routing to the appropriate claims handler with full policy context.
Claim resolution with payment authorization, reserve adjustments, and final disposition. All financial movements are event-sourced and reconstructable for actuarial review and regulatory audit.
Defense-in-depth across authentication, transport, data handling, and audit layers. Every control is enforced in code, not in documentation.
Role-based access control with short-lived tokens and refresh rotation.
Every webhook signed. Carriers verify integrity before processing payloads.
5-minute timestamp window rejects stale or replayed webhook deliveries.
TLS 1.2+ at transport layer. Encrypted connections to database and internal services.
Auth and intake endpoints throttled. Burst protection with exponential backoff.
Fields tagged by sensitivity level. Handling rules enforced at the data layer.
Event-sourced records. Append-only design. No mutation or deletion of historical events.
Automated encrypted backups with defined retention policy and point-in-time recovery.
Representative request and response shapes showing the integration contract. These are patterns, not live endpoints — actual values are provisioned per carrier.
# Headers
POST /webhooks/carrier/quote-updated HTTP/1.1
Content-Type: application/json
X-CyberAgency-Signature: t="1752859200",v1="a]f4c2b8e...truncated"
X-CyberAgency-Event: quote.updated
# Body
{
"event_id": "evt_01J5XF3K...",
"event_type": "quote.updated",
"timestamp": "2026-07-18T17:22:00Z",
"data": {
"quote_ref": "qt_2026_CA_04821",
"status": "bound",
"bound_at": "2026-07-18T17:20:14Z"
}
}# Request
POST /api/v1/quotes HTTP/1.1
Authorization: Bearer <carrier_jwt>
Idempotency-Key: "key_carrier_8f3a2..."
Content-Type: application/json
{
"submission": {
"industry": "technology_services",
"revenue_band": "10M_50M",
"coverage_type": "cyber_liability",
"limit_requested": "5000000",
"deductible": "25000"
},
"risk_assessment": {
"governance_score": "0.82",
"controls_verified": 14
}
}
# Response (201 Created)
{
"quote_ref": "qt_2026_CA_04821",
"status": "quoted",
"premium": {
"annual": "18400",
"currency": "CAD"
},
"valid_until": "2026-07-25T17:22:00Z"
}# Request
POST /api/v1/binds HTTP/1.1
Authorization: Bearer <carrier_jwt>
Idempotency-Key: "key_bind_a7c91..."
Content-Type: application/json
{
"quote_ref": "qt_2026_CA_04821",
"effective_date": "2026-08-01",
"insured": {
"legal_name": "[Insured Entity]",
"jurisdiction": "ON"
}
}
# Response (201 Created)
{
"bind_ref": "bd_2026_01337",
"status": "bound",
"policy_number": "CYB-2026-CA-04821",
"bound_at": "2026-07-18T17:20:14Z",
"effective": "2026-08-01T00:00:00-04:00"
}The platform captures policy and claims outcomes throughout the lifecycle — not just at bind and renewal. Loss ratios, frequency trends, and severity data feed back into the pricing engine.
This creates a credibility-weighted feedback loop: as book experience accumulates, pricing models adjust. Carriers benefit from data-driven rate adequacy without manual actuarial cycles.
Policy, claim, and settlement data recorded as immutable events with full lineage.
Loss experience feeds into pricing models. Credibility weighting adjusts as data volume grows.
Updated rates and risk signals flow back to the quoting engine. Continuous improvement, not annual refreshes.
If you're a carrier evaluating MGAs for delegated authority, let's talk integration. Our team will walk you through the API surface, security model, and onboarding path.