> ## Documentation Index > Fetch the complete documentation index at: https://docs.go.aiinsurance.io/llms.txt > Use this file to discover all available pages before exploring further. # Add Policy Contact > Links an existing Directory Person to the policy as a contact. This is an administrative association change, not a transaction: it creates no policy version, changes no coverage or pricing, and is recorded in the audit log as its own operation. **Idempotent.** Linking a Person who is already a contact succeeds and changes nothing; the response is the current contact list either way. The Person must already exist in the company's Directory (create one with `POST /api/v1/companies/{companyId}/entities/person`). A missing, deleted or foreign-company Person is rejected with `404` and nothing is changed. Sending `contacts` inside policy transaction data has no effect — this endpoint is the only way to link a contact. **Required permission:** `policy.endorse` — the caller must also hold `policy.view` and `person.view`. ## OpenAPI ````yaml /openapi/generated-external-api.yaml post /api/v1/companies/{companyId}/policies/{policyId}/contacts openapi: 3.0.3 info: title: AI Insurance External API description: External API for AI Insurance platform version: 1.0.0 contact: email: support@aiinsurance.io servers: - url: https://go.aiinsurance.io description: Production security: - ApiKeyAuth: [] paths: /api/v1/companies/{companyId}/policies/{policyId}/contacts: post: tags: - Field Model Policy Transactions summary: Add Policy Contact description: > Links an existing Directory Person to the policy as a contact. This is an administrative association change, not a transaction: it creates no policy version, changes no coverage or pricing, and is recorded in the audit log as its own operation. **Idempotent.** Linking a Person who is already a contact succeeds and changes nothing; the response is the current contact list either way. The Person must already exist in the company's Directory (create one with `POST /api/v1/companies/{companyId}/entities/person`). A missing, deleted or foreign-company Person is rejected with `404` and nothing is changed. Sending `contacts` inside policy transaction data has no effect — this endpoint is the only way to link a contact. **Required permission:** `policy.endorse` — the caller must also hold `policy.view` and `person.view`. operationId: addPolicyContact parameters: - $ref: '#/components/parameters/companyId' - $ref: '#/components/parameters/policyIdPath' requestBody: required: true content: application/json: schema: type: object required: - personId properties: personId: type: string format: uuid description: The Directory Person to link examples: linkPerson: summary: Link one person value: personId: 550e8400-e29b-41d4-a716-446655440101 responses: '200': description: The policy's current contacts after the link content: application/json: schema: $ref: '#/components/schemas/PolicyContactsResponse' examples: linked: summary: Person linked (or already linked) value: contacts: - personId: 550e8400-e29b-41d4-a716-446655440101 displayName: Jane Doe '400': description: Malformed request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: invalidPersonId: summary: personId is not a UUID value: error: code: VALIDATION_ERROR message: 'personId: Invalid GUID' userMessages: - Invalid GUID details: - field: personId message: Invalid GUID '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': description: Policy or Person not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: policyNotFound: summary: Policy does not exist in this company value: error: code: NOT_FOUND message: Policy not found personNotFound: summary: Person is missing, deleted, or belongs to another company value: error: code: NOT_FOUND message: Person not found '500': $ref: '#/components/responses/InternalServerError' components: parameters: companyId: name: companyId in: path required: true schema: type: string format: uuid description: Company identifier policyIdPath: name: policyId in: path required: true schema: type: string format: uuid description: Policy identifier schemas: PolicyContactsResponse: type: object description: >- A policy's current Directory contacts. Every contacts operation answers the full current association set after the call, in a stable order. required: - contacts properties: contacts: type: array items: type: object required: - personId - displayName properties: personId: type: string format: uuid description: The linked Directory Person's `id` displayName: type: string description: >- The Person's display name as the app shows it; falls back to the `personId` when the Person has no name. ErrorResponse: type: object description: Standard error response for all external API endpoints required: - error properties: error: type: object required: - code - message properties: code: type: string description: Machine-readable error code example: VALIDATION_ERROR message: type: string description: Human-readable error message example: 'submissionId: Required field is missing' userMessages: type: array description: >- Clean, verbatim-displayable messages — one entry per failure, free of error-code tags, field paths, and internal noise. Suitable for showing to end users as-is. items: type: string example: - Exposures of type 'company' require an address details: type: array description: Additional details for validation errors (field-level errors) items: type: object properties: field: type: string description: The field that caused the error example: submissionId code: type: string description: Stable problem code for this individual validation failure example: BLANK_LIST_ELEMENT reason: type: string description: Stable reason the value violates its canonical contract example: blank-list-element expected: type: string description: The expected canonical value contract example: nonblank trimmed string message: type: string description: Description of the field error example: Required field is missing responses: Unauthorized: description: Unauthorized - Invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingApiKey: summary: Missing API key value: error: code: AuthenticationError message: API key authentication required userMessages: - API key authentication required invalidApiKey: summary: >- Invalid API key (e.g. unknown key, or a Bearer token used instead of an API key) value: error: code: AuthenticationError message: Invalid API key userMessages: - Invalid API key Forbidden: description: Forbidden - Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: insufficientPermissions: summary: Insufficient permissions value: error: code: AuthorizationError message: User is not authorized to perform the requested action userMessages: - User is not authorized to perform the requested action companyMismatch: summary: A valid API key naming another company in the URL value: error: code: AuthorizationError message: API key is not scoped to the requested company userMessages: - API key is not scoped to the requested company InternalServerError: description: Internal Server Error - Unexpected error occurred content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internalError: summary: Unexpected server error value: error: code: UncaughtActionError message: Uncaught error occurred in userMessages: - An unexpected error occurred. Please try again later. securitySchemes: ApiKeyAuth: type: apiKey in: header name: Authorization description: >- API key authentication. Send your raw API key as the `Authorization` header value with NO scheme prefix — `Authorization: YOUR-API-KEY`. Do NOT prefix it with `Bearer ` or `ApiKey `, and do not use an `X-API-Key` header; those are not accepted. ````