Sovereign Foundry

Core API

A filed, versioned policy administration core with the front end left to you. Rating, forms, signatures, issuance, billing and earned premium stay inside the core; every screen your buyers touch is yours to build.

Authentication

Issue keys in your admin under Setup → Developer API. Sandbox keys start with sae_test_, live keys with sae_live_.

curl -X POST https://sovereignautoengine.com/api/public/v1/sessions \
  -H "Authorization: Bearer sae_test_…" \
  -H "content-type: application/json" \
  -d '{}'

The licensee is resolved from the key itself — never from the request body — so a key can only ever see and write its own tenant's records. Keys are stored as a hash; the full value is shown once at creation. Requests are rate limited and every call is metered.

Quote to bind

One sequence, in order. The session id plus the bind token returned with the rate are the credentials for every step after quoting.

POST

/api/public/v1/sessionsscope: quote

{ "agency_id": null }

Opens a checkout session against the filing version effective today. Returns the filed constraints your UI should render.

POST

/api/public/v1/quotesscope: quote

{ "session_id": "…", "answers": { "zip": "37013", "vehicles": [...], "drivers": [...] } }

Rates 6- and 12-month terms through the filed path, saves a real quote number, and returns a single-use bind_token. Ineligible risks come back with reasons instead of a price.

POST

/api/public/v1/quotes/termscope: quote

{ "session_id": "…", "bind_token": "…", "term_months": 6 }

Pins the term the buyer chose. Premium is recomputed server-side from the quote's own stored input.

POST

/api/public/v1/applicationsscope: quote

{ "session_id": "…", "bind_token": "…", "quote_id": "…", "term_months": 6, "payment_plan_code": "…" }

Creates the application staging record for the selected quote and pay plan.

POST

/api/public/v1/applications/{id}/updatescope: quote

{ "session_id": "…", "bind_token": "…", "email": "…", "phone": "…" }

Applicant, driver and vehicle detail. Personally identifying values are encrypted at rest and returned masked.

POST

/api/public/v1/applications/{id}/attestationsscope: bind

{ "session_id": "…", "bind_token": "…", "accepted_codes": ["…"] }

Records the statements the buyer accepted. Required statements must all be accepted.

POST

/api/public/v1/applications/{id}/signature-stepscope: bind

{ "session_id": "…", "bind_token": "…", "inline": true }

Returns the signing step for this channel, honoring the carrier's gating rule (require before issuance, chase after, or off).

POST

/api/public/v1/applications/{id}/amount-duescope: read

{ "session_id": "…", "bind_token": "…" }

Down payment, installment amount and count — always recomputed from the saved quote, never accepted from your app.

POST

/api/public/v1/applications/{id}/bindscope: bind

{ "session_id": "…", "bind_token": "…", "method": "card", "reference": "auth code" }

Issues the policy: term, coverages, charges, earning schedule, cash and documents. Returns the policy number.

Reads

GET

/api/public/v1/policiesscope: read

Recent policies for your licensee.

GET

/api/public/v1/policies/{id}scope: read

Policy header plus the masked insured profile.

GET

/api/public/v1/policies/{id}/billingscope: read

Charges, schedule, paid-to-date, balance and next due.

GET

/api/public/v1/policies/{id}/documentsscope: read

Document artifacts produced for the policy.

GET

/api/public/v1/whoami

Confirms which licensee and environment a key resolves to.

GET

/api/public/v1/health

Unauthenticated liveness probe.

Webhooks

Subscribe an HTTPS endpoint per environment. Each delivery carries x-sovereign-timestamp and x-sovereign-signature: v1=…, an HMAC-SHA256 of {timestamp}.{body} using that endpoint's secret. Verify before you trust the body.

quote.createdA quote was rated and saved.

application.attestedThe buyer accepted the required statements.

signature.completedEvery required signature is on file.

policy.boundA policy was issued — from any channel, not just the API.

payment.postedCash was applied to a policy.

policy.cancelledA policy moved to cancelled.

Errors

{ "error": { "code": "insufficient_scope", "message": "…" }, "request_id": "req_…" }

401 bad key · 403 scope or account · 404 unknown record or route · 409 nothing effective to quote · 429 rate limited. Retry only 429 and 5xx, with backoff.

Going live

Live keys unlock only after the readiness check passes: a sandbox key that has real traffic, a quote and a bind completed through the API, a subscribed webhook endpoint, and a filing version effective today. Run it from Setup → Developer API → Go live.

See the platform behind the API