Release notes

You can now retrieve and list your quote requests and policies with only your X-API-KEY. Send neither X-USER-EMAIL nor X-USER-NAME and you no longer need to know which broker a record belongs to, so the quoteRequestId or policyId in a webhook is enough to look it up. Requests that send both user headers work as before.

• quoteRequest and policy return a record only if your API partner submitted it. Any other record returns an unauthorized error, even if it belongs to a brokerage you work with.
• quoteRequests and policies require a brokerageId for a brokerage linked to your API partner, and list only that brokerage's records that your API partner submitted.
• Other queries still need both user headers. Mutations always require both user headers so that every change is attributed to a broker. A mutation sent with only your API key is rejected.

See Authentication.

You can now choose which webhook events your partner receives, in the Developer Portal. Every event type is on by default, except Renewal Solicitation Open, which we turn on when your partner is enrolled in renewal webhooks. Your other existing webhooks are unchanged.

• An event your partner is not subscribed to is skipped, not retried. Subscriptions are checked when the webhook is sent, so a change also applies to webhooks that were already queued.
• New event types we add later are opt-in. You receive one only after you subscribe to it.
• Test Webhook in the sandbox respects your subscriptions, and can now send Policy Issued.

See Event subscriptions.

Added the Agent setup page. Copy its prompt into your AI coding agent and the agent installs the Corvus API skill, which points it at these docs. You can read the skill first: View SKILL.md.

The skill carries a Last updated date, 2026-11-10 for this release. Changes to the skill are recorded in these release notes.

quote_ready payloads now include documentsReady, a boolean that tells you which stage the quote is in. Existing keys are unchanged.

• false means the rated quote options are available, but the quote document is not ready to download yet.
• true means the quote document is ready to download. Query the quote request for the quote document once you receive this.

The two Quote Ready events for a quote were previously identical apart from timestamp. Use documentsReady to tell them apart. See Quote Ready.

The sandbox environment has moved to new infrastructure. Production is unaffected.

• Sandbox API keys have changed. Get your new key from the sandbox Developer Portal (see Authentication).
• Sandbox data has been reset. Accounts, API keys, clients, quotes, policies, and submissions created before this date are no longer available.
• Endpoints are unchanged. Continue to send sandbox requests to https://api-sandbox.corvusinsurance.com/q.
• Sandbox webhooks now originate from new IP addresses. Update your sandbox allowlist (see Subscribe to webhooks).

Webhook documentation updates:

• All webhook payloads include brokerageId.
• Renewal Quote Ready payloads include expiringPolicyNumber.
• Documented the Policy Non-Renewal event, delivery and retry behavior, and the apiPartner query.

Changes to the Smart Cyber optionalData array:

• Removed extra key values emailFilter, emailFilterVendor, and vpnAndMfa

Changes to the natureOfBusiness optional datum:

• Smart Cyber: must be a 6-digit NAICS code, i.e., "541511". Nature of business names are no longer supported, and the Smart Cyber Nature of Business list has been removed (see Update Quote Request (Smart Cyber)).
• Smart Tech E+O: accepts either a 6-digit NAICS code or a nature of business name (see Smart Tech E+O Nature of Business).

The endorsementCoverages field is now the recommended way to retrieve endorsements for all product lines, including Smart Cyber, Cyber Retail, and Tech E&O. This field returns a flat list of endorsements with a consistent shape:

• code — unique form code identifying the endorsement
• name — human-readable name of the endorsement
• details — JSON object containing endorsement-specific values such as limits and deductibles; returns {} when the endorsement has no configurable fields

The legacy endorsements connection is deprecated and should no longer be used. Migrate your integration to use endorsementCoverages instead. Updated sample queries are available in Get Quote Request (Smart Cyber) and Get Quote Request (Tech E&O).

The Developer Portal is available to API partners by invitation (see Developer Portal). In the portal you can:

• View and regenerate your API key. Regenerating takes effect immediately and also changes the key used to sign webhooks.
• View and edit your webhook URL.
• In the sandbox, send test webhooks, seed renewal data, bind and issue quoted submissions (Bind & Issue), and start renewals for bound or issued policies (Start Renewal).

Security controls are now sent and returned as structured objects:

• Smart Cyber: cyberApplicationControls (see Update Quote Request (Smart Cyber)).
• Smart Tech E+O: techEoApplicationControls, which also carries the largest contracts answers in largestContracts (see Update Quote Request (Smart Tech E+O)).

Corvus now returns mocked results for scans within the sandbox environment of the API. In other words, any standard url given in the sandbox environment will return an example, passing Corvus scan result after a slight delay. Quotes and policies submitted via the API should still have access to the same information made available via the scan (ex. the cyberRiskScore in GetQuoteRequest), but these values will be based on an example url rather than evaluated on the url provided in the API request.

If a specific scan result (ex. a scan returned with a vulnerability) is required, a list of test urls are available to fit these scenarios: Create Client: Test Domains.

Submissions sent via the updateQuoteRequest mutation now evaluate the Aggregate/Deductible (A/D) requested and adjust them to be favorable for Auto Quoting.

Details

This check evaluates each requested A/D ($10 Million / $5000) for Auto Quote (AQ) eligibility. If it is not something that we are authorized to AQ, we will adjust the Limit or Retention to the next closest AQ eligible value. A Subjectivity is added to the Submission when this is applied indicating the originally requested A/D was changed.

This will yield a higher ratio of Auto Quote Eligible submissions.

The following subjectivity will be included on the submission if any changes are made to the requested A/D:

Please note the limit and/or retention requested do not fit our current auto-quoting eligibility. We have offered the closest available option(s). Please contact your underwriter with any questions.

Example

A submission is sent with a limit that we will not Auto Quote, ($10 Million / $5000), and a ($1 Million / $5000) A/D. Previously, this request would have required intervention from an Underwriter. (eg. "isAutoQuoteEligible": false).

# limits -> [{"aggregateCents": 1000000000, "deductibleCents": 500000}, {"aggregateCents": 100000000,"deductibleCents": 500000}]mutation UpdateQuoteRequest($id: ID!, $action: Action!, $brokerQuoteRequestInfo: BrokerQuoteRequestInput!) {    updateQuoteRequest(id: $id, action: $action, brokerQuoteRequestInfo: $brokerQuoteRequestInfo) {        isAutoQuoteEligible        brokerAutoQuoteIneligibleReasons        status        limits {            aggregateCents            deductibleCents        }    }}

{    "data": {        "updateQuoteRequest": {            "brokerAutoQuoteIneligibleReasons": null,            "id": "sVtcvJXZR9i4obxgipTF3g",            "isAutoQuoteEligible": true,            "limits": [                {                    "aggregateCents": 100000000,                    "deductibleCents": 500000                },                {                    "aggregateCents": 200000000,                    "deductibleCents": 2500000                }            ],            "status": "SUBMITTED"        }    }}

There are no results for brokerAutoQuoteIneligibleReasons and isAutoQuoteEligible is true. Additionally, the AQ Eligible limit/retention ($1 Million / $5000) is unchanged. The pair that was not AQ Eligible was adjusted to the closest AQ Eligible pair ($10 Million / $5000) → ($2 Million / $25000).

API version v2.0 transitions quote status from SUBMITTED to QUOTES_SHARED immediately after the quote has been rated, without waiting for the PDF quote letter to finish generating. The PDF quote letter will continue to generate asynchronously. Now, quote request details will be available prior to PDF generation.

Ensure that your system is setup to support version v2.0

1. If using Webhooks:

   • The quote ready webhook will be triggered twice: The first time once rating is complete, and the second time once the quote documents are generated.

     Once the first webhook triggers, you may retrieve the underlying quote data to show it on your platform. Once the second webhook triggers, you may retrieve the data again; this time, it will include the generated quote documents.

     The quoteRequest { quoteData { edges { node { upload { url } } } } } will be null for the first trigger, and will contain the pre-signed url once the quote documents are finished generating.

     Since 11-06-2026, the documentsReady key in the webhook payload is false for the first trigger and true once the quote documents are ready, so you can tell the two apart.

2. If Polling:

   • Now that the quote_request.status field will change to QUOTES_SHARED as soon as rating is complete, you must poll twice: first for the initial quote data and second for the PDF quote documents.

     First, watch the status and when it changes to QUOTES_SHARED you may render the data in your platform. When the quote status changes to QUOTES_SHARED, you may fetch the quote details and render the data in your platform. Continue polling and watch for the quoteRequest { quoteData { edges { node { upload { url } } } } }. It will return either a url to the quote documents, or null.

How to upgrade to Version v2.0

1. Include the header X-API-VERSION: v2.0

Update question set for the Smart Cyber and Smart Tech E+O applications.

Changes to the optionalData array:

Reworded Questions

• grossAnnualRevenue
• numberOfPiiRecords
• formalBackups
• pciCompliantPayments
  • Removed extra key values pciCompliance and creditCardTransactions
• encryptPos
• multiFactorAccess
• multiFactorAuthenticationEmails
• interruptions
• vpnAndMfa

New Questions

• paymentRequestValidation

Changed Answer Values

• Remove answer option multiFactorAccess
• Remove answer option multiFactorAuthenticationEmails

Removed Questions

• multiFactorAuthenticationBackups
• encryptDevices
• claimsAmount
• segregatedBackups