APIs for the headless MGA
Headless when you need it.
A REST API for rating, quoting, binding, and policy management. Webhooks on every state change. JSON in and out, with clear errors at every step.
Headless when you need it.
A REST API for rating, quoting, binding, and policy management. Webhooks on every state change. JSON in and out, with clear errors at every step.
Insurance is not a product you can ship in a box. Off-the-shelf SaaS asks you to bend around their software. We don't work that way.
InsureOS is a bespoke service built on shared infrastructure. The platform is the same for every insurer. The setup never is.
We partner with each insurer one by one. We map your rates, build your forms, and wire your integrations, all the way through to production.
Everything we set up is editable from the admin portal. Change rates, tweak forms, adjust rules. No tickets, no waiting.
Independent doesn't mean alone. We're a message away whenever you'd rather have a hand on the wheel.
Request rates, create quotes, issue policies, fetch history. JSON in and out, with clear errors at every step.
{
"rating_factors": {
"cover_start_date": "2025-01-20",
"sum_insured": 10000,
"cover_type": "comprehensive",
"driver_age": 18
}
}{
"calculation_id": "c-x7dhe",
"premium": "2970.0000",
...
}Every endpoint ships with an OpenAPI spec and an interactive Swagger UI. Browse the resource model, the request and response shapes, and every error code. Try a real request from the docs themselves with your own API token.
Every meaningful change in the platform fires an event. Subscribe with webhooks and your downstream systems stay in sync without polling. Deliveries are asynchronous, HMAC-signed, and replayable from a timestamp if your receiver was down.
See automationREST, with JSON payloads and conventional verbs. We considered GraphQL and decided REST is the better fit for the integration shapes we see (webhooks, idempotent state changes, partner integrations). If you need a GraphQL gateway you can wrap our REST surface; we have customers who do.
Yes. The widget is a client of the API. Anything the widget does, the API can do. There is no second rating engine.
HMAC-SHA256 signatures with a per-organisation secret. The receiving system verifies the signature; we retry with exponential backoff on non-2xx responses and dead-letter after a configurable threshold.
Yes. Each event has a monotonic ID and a timestamp; the replay endpoint re-emits events from a starting point. We typically combine that with idempotency keys on the receiving side so replay is safe.
Per-organisation, per-environment (test / live), and per-permission-set (read, quote, bind, manage). Tokens can be rotated without downtime and every call is logged with the issuing token for audit.
Online quoting
Embed a real quote-to-bind flow
Automatic rating
Product definitions, rules, tables, explainable factors
Third-party integrations
Plug in the tools you already run
Payment collection
Cards, bank transfers, finance
Renewals
Re-rate, payments, automatic renewals
Document generation
Branded policy docs, certificates, receipts
Automation
Webhooks, events, integrations