Search
K
UAT APIs

Trident APIs

uatOAS 3.0

Trident APIs

The Trident APIs let you create and progress cyber insurance submissions through their full lifecycle and look up reference data used across the platform.

Authentication

All endpoints require an API key sent in the x-api-key header.

Conventions

  • All requests and responses use application/json.
  • Dates use ISO 8601 (YYYY-MM-DD).
  • Lookup objects accept any one of id, code, or description — supply whichever you have. When more than one is provided, id takes precedence.
  • Errors follow a uniform shape (code, message) and use standard HTTP status codes.

Field requirement levels

Every request field is one of three levels, derived from the XFI SOP Mandatory rules:

  • Required — listed in the schema required array; the request is rejected if absent.
  • Conditional — required only when a stated condition holds (e.g. LOB, country of origin, new contact). The condition is described in the field and carried in the machine-readable x-conditional-required extension; the field is not in required.
  • Optional — supply only if known.

Submission lifecycle

  1. Base — POST /policies/submission/base creates a new DRAFT cyber submission and returns policyKey and policyActivityKey.
  2. Full — POST /policies/submission?policyKey={policyKey}&policyActivityKey={policyActivityKey} enriches the draft with underwriting and classification data.
  3. Quote — POST /policies/quote?policyKey={policyKey}&policyActivityKey={policyActivityKey} adds pricing and section data.

A single-call orchestration of the entire lifecycle (Base + Full → Quote → Bind) is also available via POST /policies/orchestrate.

API Base URL
  • Server 1:https://apinonprod.mosaicinsurance.com

    Generated server url

Security
api_key (apiKey)

An API key is a token that you provide when making API calls. Include the token in a header parameter called x-api-key.

Example: x-api-key: 123

Additional Information
Contact Trident API Support
Proprietary License

Submission

Enrich a draft policy with underwriting and classification data.

Base Shell Submission

Creates a new DRAFT cyber submission — Step 1 of the submission lifecycle (Base → Full → Quote).

The response returns policyKey and policyActivityKey. Persist both — they are required for Step 2 (POST /policies/submission/full).

Specifying the insured

The insured block accepts one of two mutually exclusive shapes:

  • Existing contact — set insured.insureContacts.id to the contact identifier. Individual insured fields are ignored.
  • New insured — provide companyName, domicileCountry, domicileState, and any mailing-address fields you have.

Required fields

insured, producer, policy.effectiveDate, policy.expiryDate, policy.currency, policy.product, policy.territory, directAssumed, typeOfBilling, division, writtenLine.

Optional fields

policyDescription; sectionIdentifier (id 1 = C&C, 2 = Non C&C — may be supplied early to pre-derive the underwriting template, becomes required at Step 2); referenceType (id 1 = EEA, 2 = Non-EEA, 3 = Both); class (risk code, code only); producingCompany (required when division is Mosaic Asta Europe); marketSource.

Derived server-side (not part of the contract)

office, mop, and typeOfPlacementBespoke are never supplied by the caller — they are derived from division (and, for office, also from policy.product and class).

Lookup objects

Reference fields are restricted per field: producer, policy.product, directAssumed, typeOfBilling, division, producingCompany, marketSource, and insured.insureContacts accept id only; policy.currency, policy.territory, and class accept code only; sectionIdentifier accepts id only (1 = C&C, 2 = Non C&C) and referenceType accepts id only (1 = EEA, 2 = Non-EEA, 3 = Both).

Response timing

The call typically completes within 35–40 seconds.

post
https://apinonprod.mosaicinsurance.com/submission/base

Headers

X-Origination-Sourcestringrequired

Identifies the calling system or channel that originated this request. Used for traceability and auditing across the platform.

Example:S01x

X-Audit-UserIdstringrequired

Identifier of the end user on whose behalf this request is made, recorded for audit trail purposes.

Example:jsmith

Body

application/json

Shell submission payload. Required: insured, producer, policy, directAssumed, typeOfBilling, division, writtenLine. For insured, use Option A (insureContacts.id) or Option B (individual fields) — not both.

CyberSubmissionRequest

Shell submission payload — Step 1 of the submission lifecycle (Base → Full → Quote). Reference fields are restricted per field: producer, directAssumed, typeOfBilling, division, producingCompany, marketSource, and insured.insureContacts accept id only; policy.currency, policy.territory, and class accept code only; sectionIdentifier and referenceType accept id only from their fixed value sets. office, mop, and typeOfPlacementBespoke are NOT part of the contract — they are derived/defaulted server-side from division (and, for office, also policy.product and class).

insuredobjectrequired

Required. Insured details; insureContacts.id identifies an existing insured contact, otherwise supply companyName + domicile country/state.

Show Child Parameters
producerobjectrequired

Required. Producer (broker) reference. Supply id (producer id only). Optionally include a contactliaison block to attach, create, or update the broker contact liaison recorded on the policy (see ContactLiaisonSubmission).

Show Child Parameters
policyobjectrequired

Required. Policy node (dates, currency, product, territory).

Show Child Parameters
directAssumedobjectrequired

Required. Business type — id only (Direct or Assumed).

* Additional properties are NOT allowed.
Show Child Parameters
typeOfBillingobjectrequired

Required. id only.

* Additional properties are NOT allowed.
Show Child Parameters
divisionobjectrequired

Required. id only.

* Additional properties are NOT allowed.
Show Child Parameters
writtenLineinteger(int32)required

Required. Written line percentage (e.g. 100).

>= 1

Example:100

policyDescriptionstring

Optional. Free-text policy description. Defaulted/derived server-side when omitted.

Example:Cyber primary 2026 renewal

sectionIdentifierobject

Optional at this step (becomes required at Step 2 — Full). Section identifier — id only (1 = C&C, 2 = Non C&C). Supply here to pre-derive the underwriting template.

* Additional properties are NOT allowed.
Show Child Parameters
referenceTypeobject

Optional. Reference type — id only (1 = EEA, 2 = Non-EEA, 3 = Both). Conditional requirement applies at Step 2 (Full) when the producing entity (derived from division) is MSSL or MEEA.

* Additional properties are NOT allowed.
Show Child Parameters
classobject

Optional. Risk class — code only (e.g. { "code": "CY" }).

* Additional properties are NOT allowed.
Show Child Parameters
producingCompanyobject

Optional. Producing company — id only. Required when division is Mosaic Asta Europe.

* Additional properties are NOT allowed.
Show Child Parameters
marketSourceobject

Optional. Market source — id only.

* Additional properties are NOT allowed.
Show Child Parameters

Response

application/json

DRAFT submission created successfully. Save policyKey and policyActivityKey from the response — they are required for Step 2 (POST /policies/submission/full).

CyberSubmissionResponse

Response object containing cyber submission details including policy information, status, and reference keys

policyStatusstringrequired

Current status of the policy

Allowed values:Quote PreparationPolicy UpdatedBoundDeclinedReferredQuote NTU

Example:Quote Preparation

policyNostringrequired

Policy number assigned to the submission. Starts with ‘Q’ for quotes, ‘P’ for policies

Match pattern:^[QP]\d{7}$

Example:Q0038456

referencestring | null

Business reference number for tracking purposes

Example:CYB-2026-001

policyKeystringrequired

Internal policy key identifier used for database references

Example:20894

policyActivityKeystring

Internal policy activity key identifier for tracking specific policy activities

Example:45632

policyActivityStatusstring

Status of the current policy activity

Allowed values:ActiveCompletedPendingCancelledQuote NTU

Example:Active

quoteNostring | null

Quote number assigned when the submission reaches quote stage.

Example:Q0021748

post/submission/base

Body

{ "insured": { "companyName": "Veritas Capital Test 2", "domicileCountry": { "code": "USA" }, "domicileState": { "code": "NJ" }, "mailingAddress1": "1123 Cedar Street", "mailingAddressCity": "Green Bay", "email": "noemail@example.com", "zipCode": "75039" }, "producer": { "id": "2000556", "contactliaison": { "firstName": "John", "lastName": "Smith", "state": { "code": "UT" }, "city": { "description": "Green Bay" }, "region": { "description": "GBR" }, "email": "john.smith@broker.com", "phoneNo": "+1-212-555-0100" } }, "policy": { "effectiveDate": "2026-01-15", "expiryDate": "2027-01-15", "currency": { "code": "USD" }, "product": { "id": "4" }, "territory": { "code": "GBR" } }, "directAssumed": { "id": "1" }, "typeOfBilling": { "id": "1" }, "division": { "id": "2" }, "writtenLine": 100, "sectionIdentifier": { "id": "1" }, "referenceType": { "id": "2" }, "class": { "code": "CY" }, "producingCompany": { "id": "2" }, "typeOfPlacementBespoke": { "id": "1" }, "policyDescription": "UAT Test" }
 
application/json