Application Boundary
Your backend owns Axiom credentials, bearer tokens, tenant context, retries, correlation IDs, and response normalisation. Browser and mobile clients should call your backend instead of storing Axiom credentials or tenant-context material directly.
Base URL
https://api.afr-dev.axiom.express
API family
/v1
Contract version
0.1.2
Runtime owner
your backend
Golden Path
- Check API health and attach a correlation ID.
- Read OpenID discovery from the issued realm.
- Request a bearer token using the issued grant and credentials.
- Discover admitted tenants with
GET /v1/me/tenants. - Mint tenant context with
POST /v1/me/tenant-context. - Search or load the party record needed by the application.
- List policies for that party and open the selected policy.
- Read premium or payment information when required by the screen.
- Read audit or evidence references where the contract exposes them.
- Render unavailable workflow data as explicit application gaps.
Copy-Paste Skeleton
Replace the placeholders with values from the issued access pack and response payloads. The generated API reference remains the source for exact response schemas.
export AXIOM_API_BASE="https://api.afr-dev.axiom.express"
export AXIOM_AUTH_REALM="<issued realm>"
export AXIOM_CLIENT_ID="<issued client id>"
export AXIOM_CLIENT_SECRET="<issued client secret if required>"
export AXIOM_GRANT_TYPE="<issued grant type>"
export AXIOM_SCOPES="<issued scopes if required>"
export AXIOM_SOURCE_SYSTEM="<issued or selected source system>"
export AXIOM_CORRELATION_ID="policy-lookup-<correlation id>"
curl -fsS "${AXIOM_API_BASE}/v1/health" \
-H "X-Correlation-ID: ${AXIOM_CORRELATION_ID}"
curl -fsS "https://auth.afr-dev.axiom.express/realms/${AXIOM_AUTH_REALM}/.well-known/openid-configuration"
curl -fsS -X POST "<token endpoint from discovery>" \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "grant_type=${AXIOM_GRANT_TYPE}" \
--data-urlencode "client_id=${AXIOM_CLIENT_ID}"
# Add only when required by the issued access pack:
# --data-urlencode "client_secret=${AXIOM_CLIENT_SECRET}"
# --data-urlencode "scope=${AXIOM_SCOPES}"
curl -fsS "${AXIOM_API_BASE}/v1/me/tenants" \
-H "Authorization: Bearer <jwt>" \
-H "X-Correlation-ID: ${AXIOM_CORRELATION_ID}"
curl -fsS -X POST "${AXIOM_API_BASE}/v1/me/tenant-context" \
-H "Authorization: Bearer <jwt>" \
-H "Content-Type: application/json" \
-H "X-Correlation-ID: ${AXIOM_CORRELATION_ID}" \
-d '<tenant selection payload>'
curl -fsS "${AXIOM_API_BASE}/v1/parties?source_system=${AXIOM_SOURCE_SYSTEM}&external_id=<party external reference>" \
-H "Authorization: Bearer <jwt>" \
-H "X-Tenant-Context: <server-minted tenant context>" \
-H "X-Correlation-ID: ${AXIOM_CORRELATION_ID}"
curl -fsS "${AXIOM_API_BASE}/v1/policies?party_id=<party identifier>" \
-H "Authorization: Bearer <jwt>" \
-H "X-Tenant-Context: <server-minted tenant context>" \
-H "X-Correlation-ID: ${AXIOM_CORRELATION_ID}"
curl -fsS "${AXIOM_API_BASE}/v1/policies/<policy identifier>" \
-H "Authorization: Bearer <jwt>" \
-H "X-Tenant-Context: <server-minted tenant context>" \
-H "X-Correlation-ID: ${AXIOM_CORRELATION_ID}"
curl -fsS "${AXIOM_API_BASE}/v1/premiums?policy_id=<policy identifier>" \
-H "Authorization: Bearer <jwt>" \
-H "X-Tenant-Context: <server-minted tenant context>" \
-H "X-Correlation-ID: ${AXIOM_CORRELATION_ID}"Screen Data Map
| Application panel | API surface | Handling in 0.1.2 |
|---|---|---|
| Identity summary | GET /v1/parties and GET /v1/parties/{id} |
Use available party fields and keep local labels tenant-neutral. |
| Contact details | GET /v1/parties/{id}/contacts |
Render as read-only context for early application screens. |
| Policy list | GET /v1/policies |
Filter only by parameters documented in the generated reference. |
| Policy detail | GET /v1/policies/{id} |
Show policy, version, cover, and status fields exposed by the contract. |
| Premium and payments | /v1/premiums and /v1/payments surfaces |
Use minor-unit money values. Do not convert amounts through floating-point arithmetic. |
| Audit and evidence | Audit or evidence operations exposed by OpenAPI | Display only the references the API returns; keep missing provenance as an explicit gap. |
Do Not Hide Gaps
- Do not invent missing policy, premium, party, or evidence fields in the client.
- Do not use tenant names, local workflow labels, or product catalogue values as platform truth.
- Do not store bearer tokens or tenant context in public browser storage.
- Do not make mutating workflow calls until the relevant authority and request contract are documented.
- Do not smooth over endpoint response differences in screen code; normalise at the backend boundary.
Next Reference
Use this recipe together with the quickstart and generated OpenAPI reference. When a needed operation is unavailable, record the missing application behaviour as an API or configuration gap before building around it.