SureDocs for developers
Build software that files documents straight into a brokerage's SureDocs account. Read the docs here, then sign in to manage the integrations you build.
DocsGet startedA walkthrough with curl, from a refresh token to a PDF in a brokerage's inbox.Read the guide →
ReferenceExplore the APIEvery operation, field and error, generated from the code that serves them.Browse the reference →
Sign inManage your integrationsRegister an integration, copy its client id, issue its refresh token and see which brokerages have granted it access.Your integrations →
What SureDocs does
SureDocs collects the documents that insurers issue and files them with the brokerage they belong to. The APIs described here let your software send documents to a brokerage's SureDocs account, on that brokerage's behalf.
They are server-to-server APIs, served from https://api.suredocs.ie. There is no browser access: your server holds
your credentials and calls us.
Where to start
- Getting started walks through the whole flow with
curl, from a refresh token to a PDF in a brokerage's inbox. - Authentication is the exact request and response for getting an access token, every error, and how to store your credentials.
- Versioning and deprecation says what will and will not change under you, and how much notice you get.
- Rate limits gives the numbers, the headers and what to do when you are refused.
- API reference describes every operation, its fields and its errors. It is generated from the code that serves them.
Conventions
- Requests and responses are JSON, encoded as UTF-8, except the token endpoint, which also takes a form.
- Product API field names are camelCase. The token endpoint uses the snake_case names OAuth defines.
- Timestamps are RFC 3339 strings in UTC, such as
2026-09-19T14:03:00Z. - Every response carries a
Request-Idheader. Quote it when you report a problem. - Identifiers we return are opaque strings. Store them and compare them, and never parse them.
- Ignore response fields you do not recognise, and treat an unrecognised value in a response enum as you would an unrecognised HTTP status. We add these without a new version. See Versioning and deprecation.
- Nothing personal goes in a URL. A name, an email address or a filename is sent in the body.