curl --request POST \
--url https://go.aiinsurance.io/api/v1/companies/{companyId}/policies/{policyId}/field-value-rewrites \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"dryRun": true,
"rewrites": [
{
"path": "policy.commissionPercentage",
"expectedValue": 25,
"replacementValue": 0.25
}
]
}
'{
"status": "changed",
"fingerprint": "1da1aa47f7ab3ffca098aa966332457aceb79281532fbc8a3301b4d5a2c11f7b",
"occurrences": [
{
"surface": "policySegment",
"policyVersion": 1,
"startDate": "2025-01-01",
"path": "policy.commissionPercentage",
"valuePath": "/commissionPercentage",
"value": 0.25
}
]
}Rewrite stored Policy field values for a migration
Maintenance-only compare-and-swap rewrite of a Policy’s complete stored
history. The server maps each logical policy.* path across every stored
policy segment version and the direct or container values in its transaction
deltas, then fingerprints the canonically sorted occurrence descriptors.
A dryRun: true request returns the current and projected fingerprints plus
exact current occurrences without writing. Those reviewed fingerprints feed
an applying request. A dryRun: false request changes data only when the current fingerprint equals
expectedPreFingerprint. It atomically rewrites all matching values,
recomputes hashes for touched segments, verifies the exact reviewed
postimage, and writes one audit record. Replaying the same request after a
successful migration returns unchanged without a mutation audit row. Any other current state returns a
typed 409 with the current fingerprint and occurrences and writes nothing.
This is deliberately not a general Policy update endpoint.
Required permission: none — staff level staff (a staff user’s own
Bearer token or the platform service identity); no API key is accepted.
curl --request POST \
--url https://go.aiinsurance.io/api/v1/companies/{companyId}/policies/{policyId}/field-value-rewrites \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"dryRun": true,
"rewrites": [
{
"path": "policy.commissionPercentage",
"expectedValue": 25,
"replacementValue": 0.25
}
]
}
'{
"status": "changed",
"fingerprint": "1da1aa47f7ab3ffca098aa966332457aceb79281532fbc8a3301b4d5a2c11f7b",
"occurrences": [
{
"surface": "policySegment",
"policyVersion": 1,
"startDate": "2025-01-01",
"path": "policy.commissionPercentage",
"valuePath": "/commissionPercentage",
"value": 0.25
}
]
}Authorizations
User-principal OAuth 2.0 Bearer authentication. Send a user-scoped Auth0 access token (audience = the app API audience) as Authorization: Bearer <jwt>. The request resolves to the user's identity and is authorized by their Role on the {companyId} in the path — the same role-based permissions the web app enforces. This is the path the MCP connector uses to act on a user's behalf; endpoints that accept it list both BearerAuth and ApiKeyAuth.
Path Parameters
Company identifier
Policy identifier
Body
Response
A read-only fingerprint preview, a changed Policy history, or an already-applied no-op.