API Security Group Endpoint Mapping - old

This reference lists all InsuranceNow API endpoints and their required security groups to help you configure secure, role-based API access.

Overview

Important: The 2026.2.1 release introduced DirectSalesPortalAltGroup and ServicePortalAltGroup to tighten security around portal APIs.

Each API endpoint in InsuranceNow requires one or more security groups for access. This topic lists all endpoints and their current security group assignments.

When configuring role-based API access in authority-role.xml, ensure that each role includes the security groups required by the endpoints it needs to call. Assigning unnecessary security groups violates the principle of least privilege and increases security risk.

Endpoints moved from ServicePortalGroup to ServicePortalAltGroup

Table 1. ServicePortal Endpoints Moved to ServicePortalAltGroup
Endpoint Notes
GET /applications/{systemId}/paymentSources Document access
POST /billingAccounts/{systemId}/acknowledgePayments Billing operation
GET /billingAccounts/{systemId}/billingHistories/{billingReference} Billing query
POST /billingAccounts/{systemId}/paymentSourceRequest Payment operation
GET /claims/{systemId}/contacts Claims data access
GET /customers/{systemId}/producers Customer data access
GET /customers/{systemId}/documents Document access
POST /customers/{systemId}/documents Document upload
GET /customers/{systemId}/documents/{documentId} Document retrieval
DELETE /customers/{systemId}/documents/{documentId} Document deletion
GET /customers/{systemId}/documents/{documentId}/content Document content access
POST /policies/{systemId}/paymentSourceRequest Payment operation
GET /statementAccounts/paymentPlanList Account query
Note: To regain access to these endpoints after upgrading, add ServicePortalAltGroup to your webportal user role in authority-role.xml.

Endpoints no longer accessible via ServicePortalGroup

Table 2. ServicePortal Endpoints Dropped Entirely
Endpoint Alternative
DELETE /claims/{systemId}/documents/{documentId} No replacement available. Removed from ServicePortalGroup for security reasons. Service Portal users cannot delete claim documents..
GET /clients/{clientId}/resourceLink Use ResourceLink API with appropriate security group.

Endpoints moved from DirectSalesPortalGroup to DirectSalesPortalAltGroup

Table 3. DirectSales Endpoints Moved to DirectSalesPortalAltGroup
Endpoint
GET /addresses/countries
GET /addresses/countries/{isoCd}
GET /addresses/googlePlacesApiKey
POST /addresses/isVerifiedRequest
DELETE /applications/{systemId}
GET /applications/{systemId}
PATCH /applications/{systemId}
PUT /applications/{systemId}
POST /applications/{systemId}/agentChangeRequest
GET /applications/{systemId}/documents
DELETE /applications/{systemId}/documents/{documentId}
GET /applications/{systemId}/documents/{documentId}/content
POST /applications/{systemId}/drivers
GET /applications/{systemId}/drivers
GET /applications/{systemId}/drivers/{driverId}/availableQuestions
DELETE /applications/{systemId}/drivers/{driverNumber}
GET /applications/{systemId}/drivers/{driverNumber}
PATCH /applications/{systemId}/drivers/{driverNumber}
PUT /applications/{systemId}/drivers/{driverNumber}
PATCH /applications/{systemId}/full
GET /applications/{systemId}/lines
GET /applications/{systemId}/lines/{lineCd}
PATCH /applications/{systemId}/lines/{lineCd}
PUT /applications/{systemId}/lines/{lineCd}
GET /applications/{systemId}/lines/{lineCd}/coverages
GET /applications/{systemId}/lines/{lineCd}/coverages/{coverageCd}
GET /applications/{systemId}/lines/{lineCd}/coverages/{coverageCd}/coverageItems
GET /applications/{systemId}/lines/{lineCd}/coverages/{coverageCd}/coverageItems/{sequenceNumber}
POST /applications/{systemId}/lines/{lineCd}/risks
GET /applications/{systemId}/lines/{lineCd}/risks
DELETE /applications/{systemId}/lines/{lineCd}/risks/{riskNumber}
GET /applications/{systemId}/lines/{lineCd}/risks/{riskNumber}
PATCH /applications/{systemId}/lines/{lineCd}/risks/{riskNumber}
PUT /applications/{systemId}/lines/{lineCd}/risks/{riskNumber}
GET /applications/{systemId}/lines/{lineCd}/risks/{riskNumber}/availableQuestions
GET /applications/{systemId}/lines/{lineCd}/risks/{riskNumber}/coverages/{coverageCd}
GET /applications/{systemId}/lines/{lineCd}/risks/{riskNumber}/coverages/{coverageCd}/coverageItems
GET /applications/{systemId}/lines/{lineCd}/risks/{riskNumber}/coverages/{coverageCd}/coverageItems/{sequenceNumber}
GET /applications/{systemId}/linkedQuotes
GET /applications/{systemId}/linkedQuotes/full
POST /applications/{systemId}/locations
GET /applications/{systemId}/locations
DELETE /applications/{systemId}/locations/{locationNumber}
GET /applications/{systemId}/locations/{locationNumber}
PATCH /applications/{systemId}/locations/{locationNumber}
PUT /applications/{systemId}/locations/{locationNumber}
POST /applications/{systemId}/notes
GET /applications/{systemId}/notes
DELETE /applications/{systemId}/notes/{noteId}
GET /applications/{systemId}/notes/{noteId}
POST /applications/full
GET /bankInformation/{routingNumber}
GET /coderefs/{packageKey}/{repositoryKey}
GET /policies/{systemId}/notes/{noteId}
GET /products/{productVersionId}/productSetup
GET /providers
GET /providers/{systemId}
POST /smsevents
GET /vehicleYears
Note: To regain access to these endpoints after upgrading, add DirectSalesPortalAltGroup to your webportal user role in authority-role.xml.

Endpoints no longer accessible via DirectSalesPortalGroup

The following 18 endpoints no longer have access via DirectSalesPortalGroup and must be accessed through other authorized roles:

Table 4. DirectSales Endpoints Dropped Entirely
Endpoint
POST /applications/{systemId}/approvalRequest
POST /applications/{systemId}/closeRequest
POST /applications/{systemId}/correspondences
POST /applications/{systemId}/reopenRequest
POST /applications/{systemId}/tasks
GET /correspondenceTemplates
GET /correspondenceTemplates/{templateId}
POST /policies/{systemId}/notes
GET /policies/{systemId}/notes
DELETE /policies/{systemId}/notes/{noteId}
POST /providers/{systemId}/tasks
POST /tasks
GET /tasks/{systemId}
PATCH /tasks/{systemId}
PUT /tasks/{systemId}
GET /taskTemplates
GET /taskTemplates/{systemId}

Configuring role-based access

Use this endpoint mapping to configure your role-based access in authority-role.xml:

  1. Identify all API endpoints your portal or integration calls.
  2. Find each endpoint in this mapping to determine its required security group.
  3. Add the required security group to your role's AuthorityRoleAttribute elements, setting Value='Yes'.
  4. Remove any security groups not needed for your portal's endpoints, setting Value='No'.
  5. Redeploy InsuranceNow to apply the changes.
  6. Test your portal to verify all endpoints are accessible.

Troubleshooting HTTP 403 errors

If your portal receives HTTP 403 (Forbidden) errors on API calls after upgrading to 2026.2.1:

  1. Note the endpoint that returned the error.
  2. Find the endpoint in this mapping to identify its security group.
  3. Verify that your role includes that security group in authority-role.xml.
  4. If the security group is missing, add it and redeploy InsuranceNow.
  5. Ensure users log out and log back in after redeployment to refresh their permissions.