Authentication

API keys, the request URLs, the headers every request needs and the statuses returned when authentication fails.

The sandbox moved to new infrastructure on 10-19-2026. Sandbox API keys issued before that date no longer work. Get your new sandbox key from the sandbox Developer Portal. Production keys are unchanged.

API keys

In order to get started, you will need two different API keys:

One for our sandbox environment
One for our production environment

Please see How do I receive my API authentication credentials for more information on becoming an API partner.

Your API keys are available in the Developer Portal. Each environment has its own portal, login, and API key:

Sandbox: https://api-sandbox.corvusinsurance.com/developer
Production: https://crowbar.corvusinsurance.com/developer

Access is by invitation. Once you are invited, you will receive an email with a link to set up your Developer Portal account. After signing in, you can view your API key and the webhook URL registered for your account.

If you don't have Developer Portal access, or your invitation link has expired, contact api@corvusinsurance.com.

Request URLs

All requests will be made via HTTP POST to the following URLs

Sandbox/Testing: https://api-sandbox.corvusinsurance.com/q
Production: https://crowbar.corvusinsurance.com/q

Request headers

Authentication is provided by the following headers. All are required on every request unless marked optional. Mutations require both X-USER-EMAIL and X-USER-NAME so that every change is attributed to a specific broker. Queries do not require the user headers: send X-API-KEY alone to retrieve or list quote requests and policies (see API-key-only authentication). Other queries still need both user headers.

Request headers
Name	Type	Required	Description
X-API-KEY	string	Required	Your provided api key
X-API-VERSION	string	Optional	The API version used to make request. Available versions (v2.0). The only recognized value is `v2.0`. If the header is omitted or has any other value, the request is processed with the original API behavior.
X-USER-EMAIL	string	Optional	The email of the user making the request. This user will be the broker on the accounts you are servicing. Required for mutations. Retrieving or listing quote requests and policies does not need it: send both `X-USER-EMAIL` and `X-USER-NAME`, or neither to authenticate with your API key alone (see API-key-only authentication).
X-USER-NAME	string	Optional	The name of the user making the request. This user will be the broker on the accounts you are servicing. Required for mutations. Retrieving or listing quote requests and policies does not need it: send both `X-USER-EMAIL` and `X-USER-NAME`, or neither to authenticate with your API key alone (see API-key-only authentication).
Content-Type	string	Required	`application/json`
Accept	string	Required	`application/json`

Request examples in these docs show the GraphQL operation and its variables separately. Send them as the query and variables fields of the JSON request body. The query value is the operation as a JSON string, so newlines and quotes inside it must be escaped.

API-key-only authentication

The full section is available to partners who are signed in to the Developer Portal.

Access is by invitation. To request it, email api@corvusinsurance.com.

Authentication failures

The full section is available to partners who are signed in to the Developer Portal.

Access is by invitation. To request it, email api@corvusinsurance.com.