Overview
Who this reference is for
Every key is issued for one audience. The audience and its scopes decide which endpoints answer; everything else returns a clear error rather than data.
Agencies and agents
Read your agency's order book and summary totals with an agency key carrying orders:read. Data is limited to the book your key belongs to.
Partners
With an eligible partner or agent key, confirm identity, environment and scopes via GET /api/v1/me. Policyholder keys use GET /api/v1/my/identity instead.
Policyholders
Use the /api/v1/my surface to read your own policies, documents and claims, and open service requests.
Start here
Quickstart
All requests use HTTPS against https://covercore.services/api/v1. Store your key in an environment variable and never ship it in client-side code.
export COVERCORE_API_KEY="your_key_here" # 1. Partner or agent key: confirm identity and scopes (policyholder keys: /api/v1/my/identity) curl https://covercore.services/api/v1/me \ -H "Authorization: Bearer $COVERCORE_API_KEY" # 2a. Agency key: summary of your order book curl https://covercore.services/api/v1/orders/summary \ -H "Authorization: Bearer $COVERCORE_API_KEY" # 2b. Policyholder key: your current policies curl "https://covercore.services/api/v1/my/policies?selection=latest" \ -H "Authorization: Bearer $COVERCORE_API_KEY"
Security
Authentication
Send your API key on every request using either header. Requests without a valid key receive 401; a valid key without the required scope receives 403.
Authorization: Bearer <api_key>
X-API-Key: <api_key>
Policyholder keys are bound to exactly one policyholder record. Identity always comes from the key itself: no path, query, body or header value can select a different account.
Agency keys
Agency API
Results are limited to the agency book associated with the key.
/api/v1/mepartner or agent keyIdentity for an eligible partner or agent key (policyholder keys are denied; use /api/v1/my/identity): partner type, environment, granted scopes, rate limits, expiry and linked agency./api/v1/ordersorders:readList orders in your agency book./api/v1/orders/summaryorders:readAggregate totals for your agency book.Policyholder keys
Policyholder self-service API
Available only to keys issued for a policyholder. Other key types receive 403 POLICYHOLDER_SURFACE_ONLY.
/api/v1/my/identityany policyholder keyWho the key represents and its effective scopes. Also served at /api/v1/my./api/v1/my/profilepolicies:readContact details, address and business profile on file./api/v1/my/policiespolicies:readYour policies. Pass selection=latest for current terms or selection=history for every term./api/v1/my/policies/{id}policies:readA single policy. Accepts the optional selection parameter./api/v1/my/orderspolicies:readPolicy transactions associated with your account./api/v1/my/quotesquotes:readQuotes prepared for you./api/v1/my/documentsdocuments:readPolicy documents shared with you, each with a downloadUrl when a file is available./api/v1/my/documents/{id}documents:readMetadata for a single document./api/v1/my/documents/{id}/downloaddocuments:readDownload the document file./api/v1/my/claimsclaims:readRead claim information for your policies. Claim reporting is first notice of loss forwarded to the insurer; Stuckey does not adjust or decide claims. This GET endpoint only reads records./api/v1/my/agentagents:readContact details for your servicing agent./api/v1/my/billingmy_billing:readBilling records. Accepts page and limit./api/v1/my/ticketsmy_tickets:readYour service requests. Accepts page and limit./api/v1/my/ticketsmy_tickets:writeOpen a service request. Body accepts only subject and description; returns 201.curl -X POST https://covercore.services/api/v1/my/tickets \ -H "Authorization: Bearer $COVERCORE_API_KEY" \ -H "Content-Type: application/json" \ -d '{"subject":"Certificate of insurance","description":"Please send a COI for our new landlord."}'
Service Center
Human review and insurance decisions
Service Center requests remain subject to human review and approval before consequential insurance actions. Submitting a request is not approval and does not itself change coverage.
Cancellation requests follow the insurer's requirements and applicable state notice rules. Submitting a request does not itself cancel a policy or establish an effective date.
CoverCore applies the program's eligibility guidelines. The insurer or its authorized underwriter makes final underwriting decisions.
Collections
Pagination and caching
Collection responses return data and a pagination object (page, limit, total, totalPages, hasNextPage). Unknown query parameters are rejected with 400 INVALID_QUERY. Most /my reads return an ETag; send it back in If-None-Match to receive 304 Not Modified.
Limits
Rate limits
Limits are set per key. Defaults are 60 requests per minute and 10,000 per day; GET /api/v1/me reports your key's values. Exceeding a limit returns 429 Too Many Requests.
Failures
Errors
Every error uses one envelope. retryable is true for 408, 409, 429 and 5xx responses.
{
"error": {
"code": "INVALID_PAGINATION",
"message": "page must be a positive integer and limit must be between 1 and 100.",
"retryable": false
}
}
Get access
Ready to connect?
Sign in or get started at CoverCore. Once your account is set up, you can create API keys for your agency.