Consume the 0.1.0 API deliberately.

Reference Surfaces

Scoped OpenAPI Bundles

Use the full contract for complete code generation. Use scoped bundles when an AI agent or API tool needs one resource family without loading the entire API surface.

Use the bundle manifest to inspect bundle dependencies, safe-read counts, restricted mutation counts, generated collection links, and first-flow candidates.

Product To Policy Prerequisites

Policy and quote creation can trigger premium calculation. Premium calculation requires an active pricing ruleset binding for the product and effective date. Do not create a product and then jump directly to POST /v1/policies or POST /v1/quotes unless the pricing binding already exists.

1. Create the product with POST /v1/covers.
2. Activate the product with POST /v1/covers/{id}/activate.
3. Create the pricing ruleset with POST /v1/rulesets.
4. Add pricing rules with POST /v1/rulesets/{id}/rules.
5. Deploy the ruleset so a version is available for binding.
6. Bind the deployed ruleset to the product with POST /v1/covers/{id}/pricing-rules.
7. Use ruleset_type: premium_rating, the deployed ruleset_version, and an effective_from date that covers the quote or policy effective date.
8. Create the quote or policy only after that binding exists.

If the binding is missing, the intended public error is a structured 422 PRICING_RULESET_NOT_FOUND_AS_OF. Direct policy and bind policy paths share that precondition posture in the current contract; include the correlation id in feedback if a tenant still observes a different policy-path error after deployment.

CEL Numeric Types

Axiom evaluates rules with Google cel-go. CEL is type-strict: int, uint, and double are different numeric types. JSON request facts may bind integer-looking values as double, so comparisons such as applicant.age >= 18 are valid, but integer-only operators such as modulo require explicit conversion.

int(applicant.age) % 5 == 0
cover.sum_insured * 0.15 <= 250000.0

A CEL message such as no such overload: _%_ means the expression or fact shape has a numeric type mismatch. It should be fixed by using int(), uint(), or double() deliberately.

API Tool Collections

Postman and Insomnia collections are generated from the same public OpenAPI 0.1.0 contract as the browsable reference. Use the full collection for broad exploration, or a scoped collection when you want a smaller import for one resource family.

Collection variables use placeholders for base_url, access_token, tenant_id, tenant_context, and correlation_id. Use tenant_id from GET /v1/me/tenants, then mint tenant_context before making tenant-scoped calls.

Auth And Tenant Context

The public alpha path uses a bearer token from the issued auth realm plus a server-minted tenant context. The tenant context is sent as X-Tenant-Context and should be handled by your backend.

Authorization: Bearer <jwt>
X-Tenant-Context: <server-minted tenant context>
X-Correlation-ID: <support trace id>

API-key authentication is not presented as the public alpha tenant integration path. Use only the auth method supplied in the issued access pack.

The generated alpha auth, tenant-context, and retry contract is the public policy source for which protocol details are public, which access-pack fields remain private, how tenant context is treated as server-minted authority, and which retry behaviour SDKs and agents may assume during developer preview.

Webhook Receivers

Webhook registration is an admitted-alpha transport configuration surface. It records where Axiom may send outbound deliveries and how those deliveries are authenticated. Event subscription catalogues, stable event identities, and stable event schemas are governed separately and are not yet public self-service contracts.

Register only receiver endpoint transport settings in 0.1.0. Do not send event_types, event schemas, routing rules, ordering keys, or replay policy in the public endpoint registration payload. Treat subscription and routing needs as named integration gaps until a future governed contract publishes them.

For auth_method=hmac_sha256, verify the delivery before parsing or processing the payload.

X-Axiom-Delivery-Id: whd_...
X-Correlation-ID: <support trace id>
X-Webhook-Timestamp: <unix seconds utc>
X-Webhook-Signature: sha256=<hex hmac>

The HMAC input is the exact string X-Webhook-Timestamp + "." + raw request body bytes. Compute HMAC-SHA256 with the shared secret referenced by the issued endpoint configuration, encode it as sha256=<lowercase hex>, and compare signatures using a constant-time comparison.

• Reject missing timestamp or signature headers.
• Reject malformed timestamps, malformed signatures, and invalid hex.
• Reject stale timestamps. Use a five-minute replay window unless your issued runbook specifies a stricter tenant policy.
• Reject mismatched signatures before parsing or processing the body.
• Do not log shared secrets, bearer tokens, signatures, or raw tenant payloads.
• Return a 2xx status only after the receiver has durably accepted the delivery.

Delivery is at-least-once. Exactly-once delivery and ordered delivery are not guaranteed in the alpha public contract. The X-Axiom-Delivery-Id value is reused across retry attempts for the same delivery record and is useful as retry/support evidence, but it is not a stable canonical event id. Build receivers to tolerate duplicate, delayed, and out-of-order deliveries.

Async Ingress

POST /v1/ingress/events is an admitted-alpha conditional transport surface. A 202 Accepted response means Axiom accepted a durable boundary record for asynchronous handling; it does not mean the payload was validated, promoted, or applied to domain truth.

Event types, payload schemas, and promotion rules are not public self-service catalogues in API 0.1.0. Treat them as tenant-owned integration configuration supplied through a governed runbook or future tenant-owned catalogue. Do not infer stable event types or payload schemas from examples.

Builder Checklist

Responses And Pagination

The generated reference is authoritative for each operation response. During developer preview, some older endpoints still use the legacy envelope while newer endpoints use JSON:API-style responses. Build a backend adapter that normalises responses at your boundary instead of spreading per-endpoint differences through screen code.

Pagination is also endpoint-specific until the migration is complete. Use the parameters and response shape shown on the operation page.

Maturity Metadata

The generated OpenAPI contract includes x-axiom-public-maturity on public tags and operations. Use it to distinguish what is available during developer preview from what still requires an issued access pack or later contract commitment.

Limits And Uploads

Rate-limit headers are exposed when the API applies throttling. Numeric limits are issued with the alpha access pack when they are committed for that integration; do not tune production retry behaviour from guesswork.

Upload size, file count, and media-type limits are not yet published as stable public commitments for every multipart operation. Treat upload behaviour as an integration gap until the relevant operation states its constraints in the generated reference or issued runbook.

Preview Boundaries

• Do not assume self-service credentials exist during alpha.
• Do not treat stable SDK package documentation as available until it is published here.
• Do not infer hidden workflow capability from product language; build only from published operations.
• Do not hide missing API, configuration, or custody decisions in client code.
• Do not publish private access-pack details in public repositories, prompts, screenshots, or bug reports.