Update Quote Request

Id of the Quote Request to update (see Create Quote Request)

The SUBMIT action should be used for saving the quote request values and submitting it for quoting. This action will only update optionalData and limits if the quote request has a status of INCOMPLETE.

The RESUBMIT action may be used to modify values and re-quote. However the previous quote data will be overwritten. This action is only available to auto-quote eligible quote requests with a status of SUBMITTED or QUOTES_SHARED, or to referred quotes with a status of SUBMITTED up until an underwriter begins work rating the submission. A quote that is auto-quote eligible may be updated as many times up until a bind is requested. A quote that has been referred cannot be resubmitted once an underwriter picks it up for review. If an underwriter has begun reviewing a submission or has shared the quote and the RESUBMIT action is used, the following error will be returned: Cannot resubmit a quote request unless its application type is 'form' or 'broker_api'. If a broker would like to update their submission at this point, they need to reach out to the underwriter directly. You may query the underwriter contact details by adding the underwriter name and email variables to the getQuoteRequest call.

query GetQuoteRequest($id: ID!) {
  quoteRequest(id: $id) {
    applicationSignatureUrl
    client {
      name
    }
    declineLossReason
    policyFeeCents
    quoteData(first: 5) {
      edges {
        node {
          id
        }
      }
    }
    status
    subjectivities(first: 5) {
      edges {
        node {
          id
        }
      }
    }
    underwriter {
      name
      email
    }
  }
}

Coverage start date

Format must be YYYY-MM-DD

To request more than one coverage option, add one entry for each option here. Do not create a new client and quote request for each option.

Must be an array with a length of between 1 and 3 values composed of the following keys:

Must be an integer representing the limit in cents.

Must be an integer representing the deductible in cents.

Boolean value indicating whether coverage for Certified Acts of Terrorism should be included for the insured. Defaults to True.

true - include TRIA coverage

false - waive TRIA coverage

** If TRIA coverage is waived, insured must sign TRIA exclusion waiver (included in quote documents) prior to policy issuance.

Boolean value to signify if submission is for a non-bindable indication quote.

true - this submission is an indication

false - this submission is a request for a bindable quote

A message to the underwriter about this submission, up to 10,000 characters. A non-blank message also sends Corvus an email notification about the update.

The date by which you need the quote. Format must be YYYY-MM-DD.

If omitted, the existing due date is kept.

Updates the client's primary website, up to 255 characters. Use the same formats as createClient (see Create Client).

Responses to Cyber application questions.

Does the Applicant collect, capture, purchase, receive through trade, or otherwise obtain biometric data (biometric data is data related to body measurements and calculations related to human characteristics and includes, but is not limited to, fingerprints, iris or retina scans, voiceprints, sleep/health/exercise data, DNA or biological markers)?

Must be a boolean representing the answer to this question.

true - maps to yes

false - maps to no

Is the applicant involved in any services related to Cannabis, CBD, Firearms, Gambling, Gig Economy, Fintech, or Adult Content?

Must be a boolean representing the answer to this question.

true - maps to yes

false - maps to no

Despite its name, this field is required for a submission.

Must be a JSON array composed of one object for each of the following keys with their respective values and types:

Must be one of the 50 states, fully spelled out, or "District of Columbia".

Must be a 6-digit NAICS code formatted as an integer string, i.e., "541511".

Deprecated: Nature of Business name is no longer supported.

Projected gross annual revenue (next 12 months)

In dollars, formatted as an integer string, i.e. "1000000000"

These values are not required in the request, but may be necessary to quote or bind depending on client details. Responding to them can help prevent a subjectivity and expedite the submission process.

8. Does the Applicant collect, capture, purchase, receive through trade, or otherwise obtain biometric data (biometric data is data related to body measurements and calculations related to human characteristics and includes, but is not limited to, fingerprints, iris or retina scans, voiceprints, sleep/health/exercise data, DNA or biological markers)?

9. Do you have email filtering in place?

9b. Do you use an advanced email security solution that includes features such as URL and attachment sandboxing. (Secure Email Gateway). If so, provide the name of the vendor.

10. Do you have a backup solution in place?

10a. If so, how frequently do you back up systems and data?

BackupFrequency is an enum with the following values:

CONTINUOUS_BACKUPS, DAILY, LESS_THAN_MONTHLY, MONTHLY, NEVER, UNANSWERED, UNCERTAIN, WEEKLY

10b. Which of the following are in place for your backup solution(s)? (Select ALL that apply))

BackupSolutionQuestionInput is an object with the following Boolean fields:

Backup servers and user accounts use unique credentials

Backup servers are not joined to a Windows domain

Backup servers are segmented from the rest of the network

Cloud based backups

Backup solution with immutable backups

MFA required for access to backups

Multiple copies of backups stored in 2 or more geographical locations

Copy of backups are kept offline or air-gapped

11a. MFA enforced to secure all remote access to your network.

11b. MFA enforced to secure internal use of privileged accounts (administrator accounts, service accounts, etc.)

11c. MFA enforced for email access via webmail portal (i.e. Gmail), mailbox applications (i.e. Outlook Application) and non-corporate devices for all employees

11d. MFA enforced to secure access to all critical applications

12. How are privileged accounts secured and managed? (Select ALL that apply)

PrivilegedAccountsInput is an object with the following Boolean fields:

Administrative users use different accounts for administrative use and non-administrative use (e.g. day to day activities such as browsing and email)

Standard users do not have administrative rights to their workstations

Local administrator accounts are unique and complex on all systems

A password management vault is used to manage privileged accounts

13. What Endpoint Security Technology do you have in place? (Select ALL that apply and list the product and vendor)

EndpointSecurityVendorInput is an object with the following String fields:

Next Gen Antivirus

Endpoint Detection & Response (EDR)

Managed Detection & Response (MDR)

Extended Detection & Response (XDR)

14. What security controls are in place to protect against unauthorized access to sensitive and confidential data?

SensitiveDataAccessProtectionQuestionInput is an object with the following Boolean fields:

Least privilege access using role-based assignments

Network segmentation of servers containing sensitive data

Logging and monitoring

MFA required for all user access to systems/applications with sensitive data

Encryption at Rest (File level)

Encryption of Data in-transit

15. Do you have a Business Continuity Plan (BCP) or Disaster Recovery Plan (DRP) in place?

15a. If so, is it tested at least annually?

16. Do you have an Intrusion Detection System (IDS) or Intrusion Prevention System (IPS) in place?

17. Do you conduct penetration testing of your network at least annually?

18. Do you conduct employee security training or phishing training, for all employees, at least annually?

19. Prior to executing an electronic payment, do you verify the validity of the funds transfer request or payment change request, with the requestor, via a separate means of communication prior to transferring funds or making payment changes?

20. If the Applicant uses multimedia material provided by others, does the Applicant always obtain N/A the necessary rights, licenses, releases, and consents prior to publishing?

21. If the Applicant accepts payment cards in exchange for goods or services rendered, is the Applicant or their outsourced payment processor PCI compliant?

22. In the past three years, have you experienced any cyber security incident, data privacy incident or any multimedia liability claim?

23. Do you or any other person or organization proposed for this insurance have knowledge of any actual or alleged: security breach, privacy breach, privacy-related event or incident, breach of privacy, or multimedia incident that may reasonably be expected to give rise to a claim or to costs being incurred?

24. In the past 3 years, have you or any other organization proposed for this insurance sustained any unscheduled network outage or interruption lasting longer than 6 hours?

These values are not required in the request, but may be necessary to quote or bind depending on client details. Responding to them can help prevent a subjectivity and expedite the submission process.

Estimated amount of unique personally identifiable records stored, processed or transmitted maintained by the Applicant (including records stored by third-party providers)

Answer must be in the list of "min", "veryLow", "low", "medium", "high", "veryHigh", "max", "uncertain".

These possible answers translate to:

"min" -> 0-250,000 records

"veryLow" -> 250,001-500,000 records

"low" -> 500,001-1,000,000 records

"medium" -> 1,000,001-2,500,000 records

"high" -> 2,500,001-5,000,000 records

"veryHigh" -> 5,000,001-10,000,000 records

"max" -> 10,000,001+ records

"uncertain" -> Use if you do not have an answer to this question

Does the Applicant have formal processes for regularly backing up, archiving, restoring, and segregating sensitive data?

Answer must be in the list of "yes", "no", "uncertain".

If the Applicant accepts payment cards in exchange for goods or services rendered, is the Applicant PCI compliant?

Answer must be in the list of "yes", "no", "other", "uncertain". "Other" maps to "N/A" on our application and should be used if the question is not applicable.

If the Applicant's industry is retail, restaurant, or online retailer, do they deploy either end-to-end or point-to-point encryption technology on all of their point of sale terminals?

Answer must be in the list of "yes", "no", "uncertain".

Prior to executing an electronic payment, does the Applicant verify the validity of the funds transfer request or payment change request, with the requestor, via a separate means of communication prior to transferring funds or making payment changes?

Answer must be in the list of "yes", "no", "uncertain".

If the Applicant uses multimedia material provided by others, do they always obtain the necessary rights, licenses, releases, and consents prior to publishing?

Answer must be in the list of "yes", "no", "other", "uncertain". "Other" maps to "N/A" on our application and should be used if the question is not applicable.

Does the Applicant enforce Multi-Factor Authentication to secure and manage internal use of privileged accounts (administrator accounts, service accounts, etc.)?

Answer must be in the list of "yes", "no", "uncertain".

Does the Applicant enforce Multi-Factor Authentication (MFA) for email access via webmail portal (i.e. Gmail), mailbox applications (i.e. Outlook Application) and non-corporate devices for all employees?

Answer must be in the list of "yes", "no", "uncertain".

Has the Applicant experienced in the past three years any cyber security incident, data privacy incident or any multimedia liability claim?

Answer must be in the list of "yes", "no", "uncertain".

Comments can be optionally added if the answer to claims is "yes".

Comment must be a string.

Does the Applicant or any other person or organization proposed for this insurance have knowledge of any actual or alleged: security breach, privacy breach, privacy-related event or incident, breach of privacy, or multimedia incident that may reasonably be expected to give rise to a claim or to costs being incurred?

Answer must be in the list of "yes", "no", "uncertain".

Has the Applicant or any other organization proposed for this insurance sustained any unscheduled network outage or interruption lasting longer than six hours within the past three years?

Answer must be in the list of "yes", "no", "uncertain".

Quote request id you can use in future requests

Will be true if a quote will be generated in the next five minutes. If the attribute is false, the quote will be referred to an underwriter for manual review. If multiple limit options are submitted (e.g. $1M, $2M, and $3M) and some are eligible while others are not, the entire quote will be referred.

Specific reasons why quote is ineligible for auto-quoting. Note: since this quote request is auto-quote eligible there are no reasons available.