Authentication
All API requests require a bearer token issued when your membership is approved. Pass it in the Authorization header.
Authorization: Bearer ibp_live_xxxxxxxxxxxxxxxxxxxxxxxx
Keep your API key secret. Rotate it any time from your member dashboard. Test keys prefixed ibp_test_ work against sandbox data and never produce billable output.
Base URL
https://api.insuranceblueprint.org/v1
All requests and responses use JSON (Content-Type: application/json). Dates are ISO 8601 (YYYY-MM-DD). Monetary values are decimal strings.
Errors
| Status | Code | Meaning |
|---|---|---|
400 | invalid_data | Request body failed schema validation. Check errors[] in the response. |
401 | unauthorized | Missing or invalid API key. |
403 | forbidden | Your membership doesn't include this form type. |
404 | not_found | The requested form or resource doesn't exist. |
429 | rate_limited | Too many requests. See Retry-After header. |
500 | server_error | Something went wrong on our end. Retrying is safe. |
Generate a Form
Render an insurance form from structured data. Returns a URL to the rendered form and optionally an inline HTML or base64 PDF.
Request parameters
| Field | Type | Description |
|---|---|---|
form_type required |
string |
IBP form type. POI or COI are live. See forms library for all values. |
output_format required |
enum |
pdf, html, or json. Use json to get the validated data back without rendering. |
output_target optional |
enum |
desktop (default), phone, or print. Controls layout and typography optimizations. |
data required |
object |
Form data object. Must conform to IBP-DM-001 for the given form_type. |
webhook_url optional |
string |
If set, the response is delivered asynchronously via POST to this URL instead of inline. |
Code examples
curl -X POST https://api.insuranceblueprint.org/v1/forms/generate \ -H "Authorization: Bearer ibp_live_xxxx" \ -H "Content-Type: application/json" \ -d '{ "form_type": "POI", "output_format": "pdf", "output_target": "print", "data": { "policy_number": "IBP-2026-PA-00142", "effective_date": "2026-01-01", "expiration_date": "2027-01-01", "issuer": { "name": "Acme Insurance Company", "naic_code": "12345" }, "named_insured": { "name": "John A. Smith", "address": { "street": "456 Elm Avenue", "city": "Springfield", "state": "MO", "zip": "65801" } }, "vehicles": [{ "year": 2022, "make": "Toyota", "model": "Camry", "vin": "4T1B11HK1NU123456" }], "coverages": [ { "coverage_type": "BI", "limit_per_occurrence": 100000, "limit_aggregate": 300000 }, { "coverage_type": "PD", "limit_per_occurrence": 100000 }, { "coverage_type": "COMP", "deductible": 500 }, { "coverage_type": "COLL", "deductible": 500 } ] } }'
const response = await fetch('https://api.insuranceblueprint.org/v1/forms/generate', { method: 'POST', headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' }, body: JSON.stringify({ form_type: 'POI', output_format: 'pdf', output_target: 'print', data: { policy_number: 'IBP-2026-PA-00142', effective_date: '2026-01-01', expiration_date: '2027-01-01', issuer: { name: 'Acme Insurance Company', naic_code: '12345' }, named_insured: { name: 'John A. Smith', address: { street: '456 Elm Avenue', city: 'Springfield', state: 'MO', zip: '65801' } }, vehicles: [{ year: 2022, make: 'Toyota', model: 'Camry', vin: '4T1B11HK1NU123456' }], coverages: [ { coverage_type: 'BI', limit_per_occurrence: 100000, limit_aggregate: 300000 }, { coverage_type: 'PD', limit_per_occurrence: 100000 }, { coverage_type: 'COMP', deductible: 500 }, { coverage_type: 'COLL', deductible: 500 } ] } }) }); const { form_url, form_id } = await response.json(); console.log('Form ready:', form_url);
import requests payload = { "form_type": "POI", "output_format": "pdf", "output_target": "print", "data": { "policy_number": "IBP-2026-PA-00142", "effective_date": "2026-01-01", "expiration_date": "2027-01-01", "issuer": {"name": "Acme Insurance Company", "naic_code": "12345"}, "named_insured": { "name": "John A. Smith", "address": {"street": "456 Elm Avenue", "city": "Springfield", "state": "MO", "zip": "65801"} }, "vehicles": [{"year": 2022, "make": "Toyota", "model": "Camry", "vin": "4T1B11HK1NU123456"}], "coverages": [ {"coverage_type": "BI", "limit_per_occurrence": 100000, "limit_aggregate": 300000}, {"coverage_type": "PD", "limit_per_occurrence": 100000}, {"coverage_type": "COMP", "deductible": 500}, {"coverage_type": "COLL", "deductible": 500} ] } } r = requests.post( "https://api.insuranceblueprint.org/v1/forms/generate", headers={"Authorization": f"Bearer {api_key}"}, json=payload ) r.raise_for_status() form_url = r.json()["form_url"] print(f"Form ready: {form_url}")
Response
{
"form_id": "frm_01j9xyz",
"form_type": "POI",
"schema_version": "1.0.0",
"created_at": "2026-08-21T14:22:11Z",
"form_url": "https://cdn.ibp.org/forms/frm_01j9xyz.pdf",
"expires_at": "2026-09-21T14:22:11Z", // CDN URL TTL
"data": { /* validated IBP-DM-001 payload echoed back */ }
}
Parse a Form
Submit a completed insurance form — as a PDF, image, or filled HTML — and receive structured JSON conforming to IBP-DM-001. Use this to ingest forms from any source into your system.
Request parameters
| Field | Type | Description |
|---|---|---|
form_type optional |
string |
Hint the parser with the expected form type. If omitted, the API infers it from the document. |
source_url required* |
string |
URL of the form PDF or image. Mutually exclusive with source_base64. |
source_base64 required* |
string |
Base64-encoded PDF or image. Mutually exclusive with source_url. Max 10 MB. |
source_mime optional |
string |
MIME type of the source (application/pdf, image/jpeg, image/png). Required with source_base64. |
* Provide exactly one of source_url or source_base64.
Code examples
curl -X POST https://api.insuranceblueprint.org/v1/forms/parse \ -H "Authorization: Bearer ibp_live_xxxx" \ -H "Content-Type: application/json" \ -d '{ "form_type": "POI", "source_url": "https://your-system.com/uploads/poi-scan.pdf" }'
const response = await fetch('https://api.insuranceblueprint.org/v1/forms/parse', { method: 'POST', headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' }, body: JSON.stringify({ form_type: 'POI', source_url: 'https://your-system.com/uploads/poi-scan.pdf' }) }); const { data, confidence } = await response.json(); // data conforms to IBP-DM-001 console.log('Insured:', data.named_insured.name); console.log('Confidence:', confidence); // 0.0 – 1.0
r = requests.post(
"https://api.insuranceblueprint.org/v1/forms/parse",
headers={"Authorization": f"Bearer {api_key}"},
json={
"form_type": "POI",
"source_url": "https://your-system.com/uploads/poi-scan.pdf"
}
)
result = r.json()
data = result["data"] # IBP-DM-001 payload
confidence = result["confidence"] # 0.0 – 1.0
Response
{
"parse_id": "prs_01j9xyz",
"form_type": "POI",
"confidence": 0.97, // overall extraction confidence
"created_at": "2026-08-21T14:31:08Z",
"data": {
"form_type": "POI",
"schema_version": "1.0.0",
"policy_number": "IBP-2026-PA-00142",
"effective_date": "2026-01-01",
// ... full IBP-DM-001 fields
},
"field_confidence": {
"policy_number": 0.99,
"vin": 0.95,
"effective_date":0.98
}
}
Validate Data
Check a data payload against IBP-DM-001 without rendering a form. Returns field-level validation errors. Useful for pre-flight checks before calling /generate.
// Request { "form_type": "POI", "data": { /* ... */ } } // Response — valid { "valid": true, "errors": [] } // Response — invalid { "valid": false, "errors": [ { "field": "vehicles[0].vin", "message": "VIN must be 17 characters" }, { "field": "effective_date", "message": "Required field is missing" } ] }
Webhooks
Register an HTTPS endpoint in your member dashboard. IBP will POST event payloads to it as forms are generated, submitted, or parsed. All deliveries include a signature for verification.
| Field | Type | Description |
|---|---|---|
url required |
string |
Your HTTPS endpoint. Must return 2xx within 10 seconds. |
events required |
string[] |
List of events to subscribe to. Use ["*"] for all events. |
form_types optional |
string[] |
Filter events to specific form types. Omit to receive all types. |
Webhook Events
| Event | Triggered when |
|---|---|
form.generated | A form was successfully rendered from data via /generate. |
form.parsed | A completed form was successfully parsed via /parse. |
form.submitted | A form rendered by IBP was completed and submitted by an end user. |
form.expired | A CDN-hosted form URL expired. |
validation.failed | A /generate or /parse call was rejected due to schema errors. |
Payload shape
{
"id": "evt_01j9abc",
"event": "form.generated",
"api_version":"2026-08-21",
"created_at": "2026-08-21T14:22:11Z",
"form_type": "POI",
"form_id": "frm_01j9xyz",
"outputs": {
"pdf_url": "https://cdn.ibp.org/forms/frm_01j9xyz.pdf",
"html_url": "https://cdn.ibp.org/forms/frm_01j9xyz.html"
},
"data": { /* full IBP-DM-001 payload */ }
}
Webhook Security
Every webhook delivery includes an IBP-Signature header. Verify it before processing the payload.
const crypto = require('crypto'); function verifyWebhook(rawBody, signature, secret) { const expected = 'sha256=' + crypto .createHmac('sha256', secret) .update(rawBody) .digest('hex'); return crypto.timingSafeEqual( Buffer.from(signature), Buffer.from(expected) ); }
import hmac, hashlib def verify_webhook(raw_body: bytes, signature: str, secret: str) -> bool: expected = "sha256=" + hmac.new( secret.encode(), raw_body, hashlib.sha256 ).hexdigest() return hmac.compare_digest(signature, expected)
Data Model: POI
Fields required and optional for form_type: "POI" (Personal Auto Proof of Insurance). Full schema: IBP-DM-001.
| Field | Type | Required | Notes |
|---|---|---|---|
policy_number | string | yes | Carrier-issued policy number |
effective_date | date | yes | ISO 8601 date |
expiration_date | date | yes | ISO 8601 date |
issuer.name | string | yes | Carrier name as licensed |
issuer.naic_code | string | opt | NAIC company code |
named_insured.name | string | yes | |
named_insured.address | AddressModel | opt | Street, city, state, zip |
vehicles[].year | integer | yes | 4-digit model year |
vehicles[].make | string | yes | |
vehicles[].model | string | yes | |
vehicles[].vin | string | yes | 17-character VIN |
coverages[].coverage_type | enum | yes | BI, PD, COMP, COLL, UM, UIM |
coverages[].limit_per_occurrence | decimal | opt | Required for BI, PD |
coverages[].limit_aggregate | decimal | opt | BI aggregate limit |
coverages[].deductible | decimal | opt | Required for COMP, COLL |
Data Model: COI
Fields for form_type: "COI" (Commercial Certificate of Insurance). Full schema: IBP-DM-001.
| Field | Type | Required | Notes |
|---|---|---|---|
issuer.name | string | yes | Producing agency or carrier |
named_insured.name | string | yes | |
named_insured.address | AddressModel | yes | |
certificate_holder | PartyModel | yes | Name and address of holder |
additional_insureds[] | AdditionalInsured[] | opt | |
coverages[].coverage_type | enum | yes | GL, AUTO, UMBRELLA, WC, OTHER |
coverages[].policy_number | string | yes | Per coverage line |
coverages[].effective_date | date | yes | Per coverage line |
coverages[].expiration_date | date | yes | Per coverage line |
coverages[].limit_per_occurrence | decimal | opt | |
coverages[].limit_aggregate | decimal | opt | |
description_of_operations | string | opt | Max 500 chars |
cancellation_notice_days | integer | opt | Default 30 |