Travel Insured Partner Documentation

Travel Insured provides account-specific environment values, access policy, and credentials through the secure onboarding channel. Use only the values assigned to your account and environment.

Configuration Values

Value	Purpose	Source	Handling
`graphqlBaseUrl`	GraphQL service endpoint	Travel Insured	Configure the assigned HTTPS value separately per environment
`productQuoteApiBaseUrl`	Product Quote Card token and quote API base URL	Travel Insured	Use only for an enabled embedded quote integration
`productQuoteCardScriptUrl`	Versioned Product Quote Card browser bundle	Travel Insured	Load only from the assigned HTTPS origin and apply the approved CSP
`paymentAppBaseUrl`	Embedded payment session API and hosted widget base URL	Travel Insured	Use only for an enabled staged embedded-payment integration
`agencyNumber`	Partner agency attribution	Travel Insured	Keep in environment-specific server configuration
`agentId`	Agent attribution for applicable requests	Travel Insured	Treat as optional unless assigned and required for the account
Allowed partner origins	Browser origins authorized for an enabled embedded component	Partner and Travel Insured	Register exact HTTPS origins; do not use wildcard production origins

Do not infer production hosts from sandbox names. Travel Insured supplies each enabled endpoint, component URL, origin policy, and account capability through onboarding.

Partner Credentials

Credential	Contract	Handling
`apiToken`	`Authorization: ApiKey {apiToken}` for server-to-server partner API calls	Sensitive; approved server-side secret store only
`accessKey`	`x-api-key: {accessKey}` for server-to-server partner API calls	Sensitive; approved server-side secret store only

Product Quote Card browser requests use only the short-lived embedToken issued by the partner backend. The long-lived partner credentials must never be returned to the browser. Separate sandbox and production credentials, restrict access by environment, and rotate them through the approved Travel Insured process.

Runtime Identifiers

Runtime identifiers come from successful API responses or approved browser handoffs; they are not environment configuration.

Identifier	Source	Use
`embedToken`	Embed-token endpoint	Short-lived authorization for the enabled browser component
`quoteNumber`	Quote response	Re-rate, selection, purchase, and support correlation
`productId`, `productCode`	Quote response	Select only a product returned for the current quote
`productCoverageId`, `productCoverageLimitId`	Quote response	Submit only response-derived coverage selections supported by the downstream contract
`planGuid`	Purchase staging response	Create an embedded payment session for the staged purchase
`modificationPlanGuid`	Modification staging response	Finalize only an enabled zero-amount staged modification; do not use with the purchase payment-session endpoint
`paymentSessionId`	Embedded payment-session response	Mount the widget and poll authoritative purchase status from the backend
`planNumber`	Direct result or `Bound` payment-session status	Search, display, and servicing after authorization

Persist identifiers on the trusted server only for their documented lifetime and purpose. Scope them to the authenticated user, partner tenant, environment, and workflow. Browser-provided identifiers remain untrusted.

Sample Data

Use synthetic names, contact details, addresses, trips, policies, and payment values approved for the target environment. Documentation dates are examples, not configuration. Replace them with valid future ISO YYYY-MM-DD dates while preserving the required ordering. Never copy production customer or card data into sandbox requests, logs, screenshots, or evidence packages.

Configure and Connect

Obtain sandbox access from Travel Insured.
Store apiToken and accessKey in an approved server-side secret store.
Configure only the assigned sandbox API and enabled component URLs; keep production configuration separate.
Prepare synthetic data with valid future ISO YYYY-MM-DD dates.
Send the documented connectivity request from your backend or preferred API client.
Confirm the response without logging credentials or sensitive payloads.
Continue through the prescribed online workflow using synthetic data.

Validation

Confirm the endpoint uses HTTPS.
Confirm secrets are absent from source, browser bundles, logs, analytics, and test artifacts.
Confirm failures do not echo header values.
Confirm each environment has separate configuration.
Escalate any credential exposure through the approved security incident process.

Continue with Quote to Purchase and Testing & Certification Readiness.