SovereignFoundry

Developers

Docs

Plain REST, bearer keys, JSON in and out. The full endpoint reference lives on the API reference page; this is the orientation you need before your first call.

Building with an AI tool?

Point Lovable, Replit or Cursor at the machine-readable spec and the agent writes correct calls for you — no guesswork. Grab a sandbox key, then see the full walkthrough on Build with AI.

OpenAPI 3 spec:  https://foundry.sovereignautoengine.com/openapi.json
Site summary:    https://foundry.sovereignautoengine.com/llms.txt

Authentication

Mint keys in your admin under Setup → Developer API. Sandbox keys start with sae_test_, live keys with sae_live_. Keys are stored hashed and the full value is shown once. The licensee is resolved from the key itself, never from the request body, so a key can only ever touch its own tenant's records.

curl -X POST https://sovereignautoengine.com/api/public/v1/sessions \
  -H "Authorization: Bearer sae_test_…" \
  -H "content-type: application/json" \
  -d '{}'
quote

Sessions, rating, term selection, application staging and updates.

bind

Attestations, signature steps and issuance.

read

Policy header, billing, schedule, documents and amount due.

Quote to bind in 30 minutes

One sequence, in order. The session id plus the bind token returned with the rate are the credentials for every step after quoting.

POST /api/public/v1/sessions                        → session_id, filed constraints
POST /api/public/v1/quotes                         → quote_id, premium by coverage, bind_token
POST /api/public/v1/quotes/term                    → pin 6 or 12 months
POST /api/public/v1/applications                   → application_id
POST /api/public/v1/applications/{id}/update       → applicant, drivers, vehicles
POST /api/public/v1/applications/{id}/attestations → required statements accepted
POST /api/public/v1/applications/{id}/signature-step → inline or sent, per gating rule
POST /api/public/v1/applications/{id}/amount-due   → down payment and installments
POST /api/public/v1/applications/{id}/bind         → policy_number

You never send a price. Every amount is recomputed server-side from the saved quote.

Reads

GET /api/public/v1/policies                  list recent policies
GET /api/public/v1/policies/{id}             header + masked insured profile
GET /api/public/v1/policies/{id}/billing     charges, schedule, paid-to-date, next due
GET /api/public/v1/policies/{id}/documents   document artifacts
GET /api/public/v1/whoami                    which licensee and environment a key resolves to
GET /api/public/v1/health                    unauthenticated liveness probe

Webhooks

Subscribe an HTTPS endpoint per environment. Each delivery carries x-sovereign-timestamp and x-sovereign-signature: v1=…, an HMAC-SHA256 of {timestamp}.{body} using that endpoint's secret. Verify before you trust the body.

quote.createdA quote was rated and saved.
application.attestedThe buyer accepted the required statements.
signature.completedEvery required signature is on file.
policy.boundA policy was issued — from any channel, not just yours.
payment.postedCash was applied to a policy.
policy.cancelledA policy moved to cancelled.

Errors

{ "error": { "code": "insufficient_scope", "message": "…" }, "request_id": "req_…" }
401unauthenticatedMissing, malformed or revoked key.
403insufficient_scopeKey is valid but not granted that scope, or the account is not live.
404not_foundUnknown record for this licensee, or unknown route.
409no_effective_filingNothing filed and active for the requested date or state.
422validation_failedThe accept-contract rejected the payload; the reason is in the message.
429rate_limitedSlow down and retry with backoff.

Retry only 429 and 5xx, with backoff.

Sandbox and going live

Sandbox is a full tenant with its own filing, forms and pay plans — quotes and binds are real records, just not real money. Live keys unlock after the readiness check passes: real sandbox traffic, a quote and a bind completed through the API, a subscribed webhook endpoint, and a filing version effective today.

Full API referenceGet a sandbox key