> ## Documentation Index
> Fetch the complete documentation index at: https://docs.go.aiinsurance.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Get Configuration Metadata
> Returns lightweight metadata about the company's FMV1 configuration — the
latest stored snapshot's **`version` + `contentHash`** plus
**last-modified** and **last-imported** timestamps — **without** the full
configuration body. Use it for cheap staleness checks and compare-and-set
workflows: compare the `contentHash` against a previously seen value to
decide whether the configuration CONTENT has changed before pulling the
full **export** payload. Every configuration write stores a new snapshot,
so any configuration change is reflected here.
The metadata reads the configuration state from the database (resolved from
the API key's tenant), so the request needs **no body** — POST an empty
object.
**Required permission:** `company.configuration:export`
This endpoint requires an API key created with the **FMV1_CONFIGURATION_MANAGER** role.
See [Authentication](/api-reference/authentication) for how to create API keys with specific roles.
## OpenAPI
````yaml /openapi/generated-external-api.yaml post /api/v1/companies/{companyId}/configuration/metadata
openapi: 3.0.3
info:
title: AI Insurance External API
description: External API for AI Insurance platform
version: 1.0.0
contact:
email: support@aiinsurance.io
servers:
- url: https://go.aiinsurance.io
description: Production
security:
- ApiKeyAuth: []
paths:
/api/v1/companies/{companyId}/configuration/metadata:
post:
tags:
- FMV1 Configuration
summary: Get Configuration Metadata
description: >
Returns lightweight metadata about the company's FMV1 configuration —
the
latest stored snapshot's **`version` + `contentHash`** plus
**last-modified** and **last-imported** timestamps — **without** the
full
configuration body. Use it for cheap staleness checks and
compare-and-set
workflows: compare the `contentHash` against a previously seen value to
decide whether the configuration CONTENT has changed before pulling the
full **export** payload. Every configuration write stores a new
snapshot,
so any configuration change is reflected here.
The metadata reads the configuration state from the database (resolved
from
the API key's tenant), so the request needs **no body** — POST an empty
object.
**Required permission:** `company.configuration:export`
This endpoint requires an API key created with the
**FMV1_CONFIGURATION_MANAGER** role.
See [Authentication](/api-reference/authentication) for how to create
API keys with specific roles.
operationId: getFmv1ConfigurationMetadata
parameters:
- $ref: '#/components/parameters/companyId'
requestBody:
required: false
content:
application/json:
schema:
type: object
description: >-
No input is required; the metadata is read from the database. An
empty object is accepted.
examples:
default:
summary: Read the configuration metadata
value: {}
responses:
'200':
description: Configuration metadata returned successfully
content:
application/json:
schema:
$ref: '#/components/schemas/ConfigurationMetadataResponse'
examples:
success:
summary: Metadata for a company with imported config
value:
version: 7
contentHash: >-
5bdcf0bb62622f29da8ed6d7ed2c0300ff1b934f5b865874b4022541e102721f
lastModifiedAt: '2026-06-25T18:32:10.114Z'
lastImportedAt: '2026-06-20T09:15:00.000Z'
neverImported:
summary: Metadata for a company that has never imported config
value:
version: null
contentHash: null
lastModifiedAt: null
lastImportedAt: null
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'500':
$ref: '#/components/responses/InternalServerError'
security:
- BearerAuth: []
- ApiKeyAuth: []
components:
parameters:
companyId:
name: companyId
in: path
required: true
schema:
type: string
format: uuid
description: Company identifier
schemas:
ConfigurationMetadataResponse:
type: object
description: >-
Lightweight FMV1 configuration metadata for staleness checks — version
identity and timestamps, WITHOUT the full configuration blob.
required:
- version
- contentHash
- lastModifiedAt
- lastImportedAt
properties:
version:
type: integer
nullable: true
description: >-
The monotonic version of the latest stored configuration snapshot
(starts at 1; a new snapshot is stored on every configuration
import). `null` when no snapshot has been stored for the company
yet. Pair it with `contentHash` to identify exactly which
configuration state you observed.
example: 7
contentHash:
type: string
nullable: true
description: >-
sha256 (lowercase hex) of the canonical serialized configuration for
the latest stored snapshot. Content-stable — two equal hashes mean
the configuration CONTENT is identical, so this is the token to use
for compare-and-set workflows (re-importing identical content stores
a new `version` but the SAME `contentHash`). `null` when no snapshot
has been stored for the company yet. Every configuration write
stores a new snapshot, so any configuration change is reflected
here.
example: 5bdcf0bb62622f29da8ed6d7ed2c0300ff1b934f5b865874b4022541e102721f
lastModifiedAt:
type: string
format: date-time
nullable: true
description: >-
ISO 8601 timestamp of the last configuration change — the latest
stored snapshot's creation time — or `null` when the company has no
configuration yet.
example: '2026-06-25T18:32:10.114Z'
lastImportedAt:
type: string
format: date-time
nullable: true
description: >-
ISO 8601 timestamp of the most recent onboarding configuration
import, or `null` when the company has never imported a
configuration.
example: '2026-06-20T09:15:00.000Z'
ErrorResponse:
type: object
description: Standard error response for all external API endpoints
required:
- error
properties:
error:
type: object
required:
- code
- message
properties:
code:
type: string
description: Machine-readable error code
example: VALIDATION_ERROR
message:
type: string
description: Human-readable error message
example: 'submissionId: Required field is missing'
userMessages:
type: array
description: >-
Clean, verbatim-displayable messages — one entry per failure,
free of error-code tags, field paths, and internal noise.
Suitable for showing to end users as-is.
items:
type: string
example:
- Exposures of type 'company' require an address
details:
type: array
description: Additional details for validation errors (field-level errors)
items:
type: object
properties:
field:
type: string
description: The field that caused the error
example: submissionId
message:
type: string
description: Description of the field error
example: Required field is missing
responses:
Unauthorized:
description: Unauthorized - Invalid or missing API key
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
missingApiKey:
summary: Missing API key
value:
error:
code: AuthenticationError
message: API key authentication required
userMessages:
- API key authentication required
invalidApiKey:
summary: >-
Invalid API key (e.g. unknown key, or a Bearer token used
instead of an API key)
value:
error:
code: AuthenticationError
message: Invalid API key
userMessages:
- Invalid API key
Forbidden:
description: Forbidden - Insufficient permissions
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
insufficientPermissions:
summary: Insufficient permissions
value:
error:
code: AuthorizationError
message: User is not authorized to perform the requested action
userMessages:
- User is not authorized to perform the requested action
companyMismatch:
summary: A valid API key naming another company in the URL
value:
error:
code: AuthorizationError
message: API key is not scoped to the requested company
userMessages:
- API key is not scoped to the requested company
InternalServerError:
description: Internal Server Error - Unexpected error occurred
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
internalError:
summary: Unexpected server error
value:
error:
code: UncaughtActionError
message: Uncaught error occurred in
userMessages:
- An unexpected error occurred. Please try again later.
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: Authorization
description: >-
API key authentication. Send your raw API key as the `Authorization`
header value with NO scheme prefix — `Authorization: YOUR-API-KEY`. Do
NOT prefix it with `Bearer ` or `ApiKey `, and do not use an `X-API-Key`
header; those are not accepted.
BearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: >-
User-principal OAuth 2.0 Bearer authentication. Send a user-scoped Auth0
access token (audience = the app API audience) as `Authorization: Bearer
`. The request resolves to the user's identity and is authorized by
their Role on the `{companyId}` in the path — the same role-based
permissions the web app enforces. This is the path the MCP connector
uses to act on a user's behalf; endpoints that accept it list both
`BearerAuth` and `ApiKeyAuth`.
````