--- title: "Base Shell Submission" url: "https://apipartners.mosaicinsurance.com/apis/trident-ap-is-beta/versions/018fd555-bac2-494f-872b-ac47b74f1e75/operations/createSubmission" --- > Full API specification: https://apipartners.mosaicinsurance.com/apis/trident-ap-is-beta/versions/018fd555-bac2-494f-872b-ac47b74f1e75.md # Base Shell Submission `POST` `/submission/base` Operation ID: `createSubmission` Creates a new DRAFT cyber submission — **Step 1** of the submission lifecycle (`Base → Full → Quote`). The response returns `policyKey` and `policyActivityKey`. Persist both — they are required for Step 2 (`POST /policies/submission/full`). ## Specifying the insured The `insured` block accepts one of two mutually exclusive shapes: - **Existing contact** — set `insured.insureContacts.id` to the contact identifier. Individual insured fields are ignored. - **New insured** — provide `companyName`, `domicileCountry`, `domicileState`, and any mailing-address fields you have. ## Required fields `insured`, `producer`, `policy.effectiveDate`, `policy.expiryDate`, `policy.currency`, `policy.product`, `policy.territory`, `directAssumed`, `typeOfBilling`, `division`, `writtenLine`. ## Optional fields `policyDescription`; `sectionIdentifier` (id 1 = C&C, 2 = Non C&C — may be supplied early to pre-derive the underwriting template, becomes required at Step 2); `referenceType` (id 1 = EEA, 2 = Non-EEA, 3 = Both); `class` (risk code, code only); `producingCompany` (required when division is Mosaic Asta Europe); `marketSource`. ## Derived server-side (not part of the contract) `office`, `mop`, and `typeOfPlacementBespoke` are never supplied by the caller — they are derived from `division` (and, for `office`, also from `policy.product` and `class`). ## Lookup objects Reference fields are restricted per field: `producer`, `policy.product`, `directAssumed`, `typeOfBilling`, `division`, `producingCompany`, `marketSource`, and `insured.insureContacts` accept `id` only; `policy.currency`, `policy.territory`, and `class` accept `code` only; `sectionIdentifier` accepts `id` only (1 = C&C, 2 = Non C&C) and `referenceType` accepts `id` only (1 = EEA, 2 = Non-EEA, 3 = Both). ## Response timing The call typically completes within 35–40 seconds. ## Header parameters - `X-Origination-Source` (string, required) - Identifies the calling system or channel that originated this request. Used for traceability and auditing across the platform. - `X-Audit-UserId` (string, required) - Identifier of the end user on whose behalf this request is made, recorded for audit trail purposes. ## Request body (required) Content types: `application/json` ## Responses - `201` - DRAFT submission created successfully. Save `policyKey` and `policyActivityKey` from the response — they are required for Step 2 (`POST /policies/submission/full`). - `400` - Bad Request — one or more required fields are missing or invalid. - `500` - Internal Server Error — unexpected system error. ## OpenAPI definition ```yaml openapi: 3.0.1 info: title: Trident APIs version: uat servers: - url: https://apinonprod.mosaicinsurance.com description: Generated server url paths: /submission/base: post: security: - api_key: [] tags: - Submission summary: Base Shell Submission description: >- Creates a new DRAFT cyber submission — **Step 1** of the submission lifecycle (`Base → Full → Quote`). The response returns `policyKey` and `policyActivityKey`. Persist both — they are required for Step 2 (`POST /policies/submission/full`). ## Specifying the insured The `insured` block accepts one of two mutually exclusive shapes: - **Existing contact** — set `insured.insureContacts.id` to the contact identifier. Individual insured fields are ignored. - **New insured** — provide `companyName`, `domicileCountry`, `domicileState`, and any mailing-address fields you have. ## Required fields `insured`, `producer`, `policy.effectiveDate`, `policy.expiryDate`, `policy.currency`, `policy.product`, `policy.territory`, `directAssumed`, `typeOfBilling`, `division`, `writtenLine`. ## Optional fields `policyDescription`; `sectionIdentifier` (id 1 = C&C, 2 = Non C&C — may be supplied early to pre-derive the underwriting template, becomes required at Step 2); `referenceType` (id 1 = EEA, 2 = Non-EEA, 3 = Both); `class` (risk code, code only); `producingCompany` (required when division is Mosaic Asta Europe); `marketSource`. ## Derived server-side (not part of the contract) `office`, `mop`, and `typeOfPlacementBespoke` are never supplied by the caller — they are derived from `division` (and, for `office`, also from `policy.product` and `class`). ## Lookup objects Reference fields are restricted per field: `producer`, `policy.product`, `directAssumed`, `typeOfBilling`, `division`, `producingCompany`, `marketSource`, and `insured.insureContacts` accept `id` only; `policy.currency`, `policy.territory`, and `class` accept `code` only; `sectionIdentifier` accepts `id` only (1 = C&C, 2 = Non C&C) and `referenceType` accepts `id` only (1 = EEA, 2 = Non-EEA, 3 = Both). ## Response timing The call typically completes within 35–40 seconds. operationId: createSubmission parameters: - $ref: "#/components/parameters/XOriginationSource" - $ref: "#/components/parameters/XAuditUserId" requestBody: description: "Shell submission payload. Required: `insured`, `producer`, `policy`, `directAssumed`, `typeOfBilling`, `division`, `writtenLine`. For `insured`, use Option A (`insureContacts.id`) or Option B (individual fields) — not both." content: application/json: schema: $ref: "#/components/schemas/CyberSubmissionRequest" examples: Option A — New Submission (new insured): summary: New submission — new or unknown insured (individual fields) description: "Use this shape when no contact identifier is available. Required: `companyName`, `domicileCountry`. Optional: `domicileState`, mailing-address fields, `zipCode`." value: insured: companyName: Veritas Capital Test 2 domicileCountry: code: USA domicileState: code: NJ mailingAddress1: 1123 Cedar Street mailingAddressCity: Green Bay email: noemail@example.com zipCode: "75039" producer: id: "2000556" contactliaison: firstName: John lastName: Smith state: code: UT city: description: Green Bay region: description: GBR email: john.smith@broker.com phoneNo: +1-212-555-0100 policy: effectiveDate: 2026-01-15 expiryDate: 2027-01-15 currency: code: USD product: id: "4" territory: code: GBR directAssumed: id: "1" typeOfBilling: id: "1" division: id: "2" writtenLine: 100 sectionIdentifier: id: "1" referenceType: id: "2" class: code: CY producingCompany: id: "2" typeOfPlacementBespoke: id: "1" policyDescription: UAT Test Option B — New Submission (existing contact): summary: New submission — insured identified by existing contact id description: Use this shape when the insured already exists in the system. Set `insured.insureContacts.id` to the contact identifier — all other insured fields are ignored. value: insured: insureContacts: id: "2089372" producer: id: "2000556" policy: effectiveDate: 2026-01-15 expiryDate: 2027-01-15 currency: code: USD product: id: "4" territory: code: GBR directAssumed: id: "1" typeOfBilling: id: "1" division: id: "2" writtenLine: 100 sectionIdentifier: id: "1" referenceType: id: "2" class: code: CY producingCompany: id: "2" typeOfPlacementBespoke: id: "1" required: true responses: "201": description: DRAFT submission created successfully. Save `policyKey` and `policyActivityKey` from the response — they are required for Step 2 (`POST /policies/submission/full`). headers: Access-Control-Allow-Origin: schema: type: string Access-Control-Allow-Methods: schema: type: string Access-Control-Allow-Headers: schema: type: string content: application/json: schema: $ref: "#/components/schemas/CyberSubmissionResponse" examples: Successful Base Submission Response: summary: DRAFT submission created — copy policyKey and policyActivityKey for Step 2 description: Successful Base Submission Response value: policyStatus: Quote Preparation policyNo: Q0038315 reference: null policyKey: "20793" policyActivityKey: "45632" "400": description: Bad Request — one or more required fields are missing or invalid. headers: Access-Control-Allow-Origin: schema: type: string Access-Control-Allow-Methods: schema: type: string Access-Control-Allow-Headers: schema: type: string content: application/json: schema: $ref: "#/components/schemas/ErrorResponse" examples: Validation Error: description: Validation Error value: error: code: VALIDATION_ERROR message: "Missing required fields: insured, policy" "500": description: Internal Server Error — unexpected system error. headers: Access-Control-Allow-Origin: schema: type: string Access-Control-Allow-Methods: schema: type: string Access-Control-Allow-Headers: schema: type: string content: application/json: schema: $ref: "#/components/schemas/ErrorResponse" examples: Internal Server Error: description: Internal Server Error value: error: code: INTERNAL_ERROR message: "Failed to create submission: service unavailable" security: - api_key: [] components: parameters: XOriginationSource: name: X-Origination-Source in: header required: true description: Identifies the calling system or channel that originated this request. Used for traceability and auditing across the platform. schema: type: string example: S01x XAuditUserId: name: X-Audit-UserId in: header required: true description: Identifier of the end user on whose behalf this request is made, recorded for audit trail purposes. schema: type: string example: jsmith schemas: CyberSubmissionRequest: type: object description: "Shell submission payload — Step 1 of the submission lifecycle (`Base → Full → Quote`). Reference fields are restricted per field: `producer`, `directAssumed`, `typeOfBilling`, `division`, `producingCompany`, `marketSource`, and `insured.insureContacts` accept **`id` only**; `policy.currency`, `policy.territory`, and `class` accept **`code` only**; `sectionIdentifier` and `referenceType` accept **`id` only** from their fixed value sets. `office`, `mop`, and `typeOfPlacementBespoke` are NOT part of the contract — they are derived/defaulted server-side from `division` (and, for `office`, also `policy.product` and `class`)." required: - insured - producer - policy - directAssumed - typeOfBilling - division - writtenLine properties: insured: $ref: "#/components/schemas/SubmissionInsured" description: "**Required.** Insured details; `insureContacts.id` identifies an existing insured contact, otherwise supply `companyName` + domicile country/state." producer: $ref: "#/components/schemas/SubmissionProducer" description: "**Required.** Producer (broker) reference. Supply `id` (producer `id` only). Optionally include a `contactliaison` block to attach, create, or update the broker contact liaison recorded on the policy (see ContactLiaisonSubmission)." policy: $ref: "#/components/schemas/SubmissionPolicy" description: "**Required.** Policy node (dates, currency, product, territory)." directAssumed: $ref: "#/components/schemas/IdReference" description: "**Required.** Business type — `id` only (Direct or Assumed)." typeOfBilling: $ref: "#/components/schemas/IdReference" description: "**Required.** `id` only." division: $ref: "#/components/schemas/IdReference" description: "**Required.** `id` only." writtenLine: type: integer minimum: 1 format: int32 description: "**Required.** Written line percentage (e.g. 100)." example: 100 policyDescription: type: string description: Optional. Free-text policy description. Defaulted/derived server-side when omitted. example: Cyber primary 2026 renewal sectionIdentifier: $ref: "#/components/schemas/SectionIdentifierRef" description: Optional at this step (becomes **required** at Step 2 — Full). Section identifier — `id` only (1 = C&C, 2 = Non C&C). Supply here to pre-derive the underwriting template. referenceType: $ref: "#/components/schemas/ReferenceTypeRef" description: Optional. Reference type — `id` only (1 = EEA, 2 = Non-EEA, 3 = Both). Conditional requirement applies at Step 2 (Full) when the producing entity (derived from `division`) is MSSL or MEEA. class: $ref: "#/components/schemas/CodeReference" description: 'Optional. Risk class — `code` only (e.g. `{ "code": "CY" }`).' producingCompany: $ref: "#/components/schemas/IdReference" description: Optional. Producing company — `id` only. Required when division is Mosaic Asta Europe. marketSource: $ref: "#/components/schemas/IdReference" description: Optional. Market source — `id` only. CyberSubmissionResponse: required: - policyKey - policyNo - policyStatus type: object properties: policyStatus: type: string description: Current status of the policy example: Quote Preparation enum: - Quote Preparation - Policy Updated - Bound - Declined - Referred - Quote NTU policyNo: pattern: ^[QP]\d{7}$ type: string description: Policy number assigned to the submission. Starts with 'Q' for quotes, 'P' for policies example: Q0038456 reference: type: string nullable: true description: Business reference number for tracking purposes example: CYB-2026-001 policyKey: type: string description: Internal policy key identifier used for database references example: "20894" policyActivityKey: type: string description: Internal policy activity key identifier for tracking specific policy activities example: "45632" policyActivityStatus: type: string description: Status of the current policy activity example: Active enum: - Active - Completed - Pending - Cancelled - Quote NTU quoteNo: type: string nullable: true description: Quote number assigned when the submission reaches quote stage. example: Q0021748 description: Response object containing cyber submission details including policy information, status, and reference keys ErrorResponse: type: object properties: error: $ref: "#/components/schemas/ErrorDetail" SubmissionInsured: type: object description: >- Insured details for the shell submission. **Option A — Existing contact:** Set `insureContacts.id` to the XFI contact identifier. All other insured fields are ignored. **Option B — New insured:** Provide `companyName`, `domicileCountry`, `domicileState`, and any available mailing-address fields. `insureContacts` must be omitted. properties: companyName: type: string description: "**Required when creating a new insured** (i.e. `insureContacts` is not provided). Legal company name as stated in the submission documentation." x-conditional-required: Required when creating a new insured (insureContacts not provided). example: Veritas Capital domicileCountry: description: '**Required when creating a new insured.** Domicile country — **always send as `code`**, e.g. `{ "code": "USA" }`. Represents the country where the insured is legally domiciled.' example: code: USA properties: code: description: ISO country code or XFI country code. example: USA type: string required: - code type: object x-conditional-required: Required when creating a new insured (insureContacts not provided). domicileState: description: '**Required when creating a new insured** and the domicile country has state-level data. Domicile state — **always send as `code`**, e.g. `{ "code": "NY" }`.' example: code: NJ properties: code: description: State/province code. example: NY type: string required: - code type: object x-conditional-required: Required when creating a new insured (insureContacts not provided). mailingAddress1: type: string example: 123 Cedar Street mailingAddressCity: type: string example: Green Bay email: type: string format: email description: Optional if insureContacts is provided. example: underwriting@veritascap.com zipCode: type: string description: Post code / zip for the insured mailing address. **Required when creating a new insured** and the insured’s country uses postal codes. x-conditional-required: Required when creating a new insured and the country uses postal codes. example: "54304" obligor: $ref: "#/components/schemas/IdReference" description: Conditional — Political Risk only. Obligor contact reference — `id` only. insureContacts: $ref: "#/components/schemas/IdReference" description: 'Insured contact reference — `id` only (e.g. `{ "id": "2000887" }`). Use this to reference an existing insured in XFI. When supplied, all other insured fields (companyName, domicile, mailing address) are ignored.' SubmissionProducer: type: object description: Producer (broker) reference used on a submission. `id` identifies the producer (broker company). Optionally include a `contactliaison` block to attach, create, or update the broker contact liaison recorded on the policy. required: - id properties: id: type: string description: "**Required.** XFI contact key of the producer (broker company). `id` only." example: "2000556" contactliaison: $ref: "#/components/schemas/ContactLiaisonSubmission" description: Optional. Broker contact liaison to record on the policy. See ContactLiaisonSubmission for the attach/create/update behavior. SubmissionPolicy: type: object description: Policy node. effectiveDate, expiryDate, currency, product, territory are mandatory. required: - effectiveDate - expiryDate - currency - product - territory properties: effectiveDate: type: string format: date description: "**Required.** Policy effective date (ISO 8601). Source: policy terms section of the slip." example: 2024-01-01 expiryDate: type: string format: date description: "**Required.** Policy expiry date (ISO 8601). Source: policy terms section of the slip." example: 2025-01-01 currency: $ref: "#/components/schemas/CodeReference" description: "**Required.** Currency reference — `code` only (e.g. `USD`, `GBP`, `EUR`)." product: $ref: "#/components/schemas/IdReference" description: "**Required.** Product reference — `id` only." territory: $ref: "#/components/schemas/CodeReference" description: "**Required.** Territory reference — `code` only." IdReference: type: object description: Reference to a lookup-backed entity identified by `id` (the XFI lookup id, environment-specific). required: - id additionalProperties: false properties: id: type: string description: XFI lookup id — the canonical identifier (environment-specific). example: "260" SectionIdentifierRef: type: object description: Section identifier, identified by `id`. Ids are fixed and stable across all environments. required: - id additionalProperties: false properties: id: type: string enum: - "1" - "2" description: 1 = C&C, 2 = Non C&C. example: "1" ReferenceTypeRef: type: object description: Reference type, identified by `id`. Ids are fixed and stable across all environments. required: - id additionalProperties: false properties: id: type: string enum: - "1" - "2" - "3" description: 1 = EEA, 2 = Non-EEA, 3 = Both. example: "1" CodeReference: type: object description: Reference to a lookup-backed entity identified by `code` (the environment-stable business code). required: - code additionalProperties: false properties: code: type: string ErrorDetail: type: object properties: code: type: string message: type: string ContactLiaisonSubmission: type: object description: >- Broker contact liaison recorded under the producer for this submission. The platform resolves this block one of three ways: 1. **Update by key** — supply `contactliaisonid.id` (an existing liaison key). That liaison is updated in place with the `email`, `phoneNo`, and `mobilePhone` values provided; the platform targets it directly without searching by name. `firstName` + `lastName` must also be supplied. 2. **Update by name match** — omit `contactliaisonid`. When `firstName` + `lastName` match an existing liaison under the producer, that liaison is updated in place. 3. **Create** — omit `contactliaisonid` and supply a `firstName` + `lastName` that do not match any existing liaison; a new liaison is created. `firstName` and `lastName` are required in all three cases. required: - firstName - lastName properties: contactliaisonid: $ref: "#/components/schemas/IdReference" description: Optional. Existing contact liaison key (id only). When supplied, the platform attaches that liaison and all individual fields become optional. Omit to create or update by name match. firstName: type: string description: Required when creating a new contact (Mode B). First name of the broker contact person. example: John lastName: type: string description: Required when creating a new contact (Mode B). Last name of the broker contact person. example: Smith email: type: string format: email description: Required when creating a new contact (Mode B). Email address of the liaison. example: Yes@example.com phoneNo: type: string description: Required when creating a new contact (Mode B). Office/landline phone number of the liaison. example: "9000000000" mobilePhone: type: string description: Optional. Mobile / cell phone number of the liaison. example: 899 898 09 faxNo: type: string description: Optional. Fax number of the liaison. example: "45" state: type: object description: 'Optional. State where the liaison is located. Always send as code, e.g. { "code": "UT" }.' properties: code: type: string example: UT example: code: UT city: type: object description: 'Optional. City where the liaison is located. Always send as description, e.g. { "description": "Green Bay" }.' properties: description: type: string example: Green Bay example: description: Green Bay region: type: object description: 'Optional. Region of the liaison. Always send as description, e.g. { "description": "GBR" }.' properties: description: type: string example: GBR example: description: GBR example: firstName: John lastName: Smith email: Yes@example.com phoneNo: "9000000000" mobilePhone: 899 898 09 faxNo: "45" state: code: UT city: description: Green Bay region: description: GBR contactliaisonid: id: "1234" securitySchemes: api_key: type: apiKey name: x-api-key in: header ```