Insurance Australia Group

aid: iag
url: https://raw.githubusercontent.com/api-evangelist/iag/refs/heads/main/apis.yml
name: Insurance Australia Group
kind: company
description: 'Insurance Australia Group (IAG, ASX: IAG) is the largest general insurance company in Australia and New Zealand,
  headquartered in Sydney and operating a portfolio of underwriting brands rather than a single consumer-facing label. In
  Australia it trades as NRMA Insurance, CGU, WFI, Swann Insurance and the digital-native ROLLiN''; in New Zealand as State,
  AMI, NZI and Lumley. Its lines of business are property and casualty — home and contents, motor, commercial, rural and farm,
  compulsory third party and specialty — split across a Direct Insurance Australia arm and an Intermediated Insurance Australia
  arm that sells through brokers and authorised representatives. IAG has no public, self-serve API surface. Probing every
  conventional developer hostname on iag.com.au, cgu.com.au and nrma.com.au found no developer portal and no published reference
  documentation; docs.iag.com.au exists but immediately redirects to a Microsoft Entra ID sign-in and is an internal wall,
  not a portal. What the probes did confirm is a real Apigee API gateway fronting three brand virtual hosts — api.iag.com.au,
  api.cgu.com.au and api.nrma.com.au — each returning an Apigee ApplicationNotFound fault at the root, meaning proxies exist
  but none is discoverable or documented to the public. A second round of probing added a fourth brand virtual host, api.wfi.com.au,
  and a publicly resolvable non-production Apigee organisation at test-api.iag.com.au. IAG has also deployed MuleSoft''s Anypoint
  API Experience Hub and is migrating roughly 600 APIs onto it, with a stated intent to make them agent aware — a substantial
  API estate that is entirely internal. Broker and partner integration in this market runs through human-facing trading portals
  — CGU''s PolicyPlace quote-and-bind platform, the Ebix Sunrise Exchange and the Steadfast Client Trading Platform — not
  through an open API programme. IAG does run a HackerOne vulnerability disclosure programme, and published an RFC 9116 security.txt
  across seven brand domains until it was withdrawn in mid-2025. Australia has the legal machinery for open insurance and
  no live obligation: the Consumer Data Right that opened banking and energy was flagged for general insurance and then paused,
  so nothing compels IAG to publish. This record is therefore an honest stub: a partner-gated carrier with a private gateway
  and zero public specifications.'
deliveryModel:
  model: unknown
  open_source: false
  commercial: false
  callable_host: false
  label: Delivery model not determined — needs a product licence on record
  confidence: low
  source:
  - none
  generated: '2026-08-28'
  method: derived
accessModel:
  pricing: unknown
  onboarding: open
  trial: false
  try_now: false
  public: false
  gated: partner
  gated_source:
  - tag:Partner Gated
  label: Open access
  confidence: low
  try_now_blocked_by: 'gated: partner'
  probe_state: blocked
  source:
  - authentication
  - security
  generated: '2026-11-06'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
tags:
- Insurance
- Australia
- New Zealand
- Property and Casualty
- General Insurance
- Carrier
- Underwriting
- Claims
tags_raw:
- Insurance
- Australia
- New Zealand
- Property and Casualty
- General Insurance
- Carrier
- Underwriting
- Claims
created: '2026-07-25'
modified: '2026-10-20'
specificationVersion: '0.23'
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
common:
- type: GettingStarted
  url: https://docs.hackerone.com/en/articles/8509950-response-program-setup
- type: Spectral
  url: rules/iag-rules.yml
- type: JSONLD
  url: json-ld/iag-context.jsonld
- type: Vocabulary
  url: vocabulary/iag-vocabulary.yml
- type: DataModel
  url: data-model/iag-data-model.yml
- type: SecurityTxt
  url: well-known/iag-security.txt
- type: Hosts
  url: hosts/iag-hosts.yml
- type: Vendors
  url: vendors/iag-vendors.yml
- type: DomainSecurity
  url: security/iag-domain-security.yml
- type: Security
  name: Vulnerability disclosure policy (HackerOne)
  url: https://hackerone.com/iag
- type: VulnerabilityDisclosure
  url: security/iag-vulnerability-disclosure.yml
- type: Conformance
  url: conformance/iag-conformance.yml
- type: Website
  url: https://www.iag.com.au/
- type: GitHubOrganization
  url: https://github.com/InsuranceAustraliaGroup
- type: GitHubOrganization
  name: IAG Customer Labs
  url: https://github.com/iagcl
- type: LinkedIn
  url: https://www.linkedin.com/company/iag
- type: Newsroom
  url: https://www.iag.com.au/newsroom
- type: SupplierPortal
  url: https://www.iag.com.au/supplier-portal
- type: PartnerPortal
  url: https://www.cgu.com.au/eai/help
- type: Contact
  url: https://www.iag.com.au/contact-us
- type: CorporateGovernance
  name: Codes and policies
  url: https://www.iag.com.au/about-us/corporate-governance/codes-and-policies
- type: Careers
  url: https://careers.iag.com.au/
apis:
- aid: iag:iag-api-gateway
  name: Insurance Australia Group API Gateway (private)
  description: IAG runs an Apigee gateway with brand virtual hosts api.iag.com.au, api.cgu.com.au, api.nrma.com.au and api.wfi.com.au
    (plus the non-production test-api.iag.com.au). Each answers every path, including /openapi.json, /swagger.json, /api-docs
    and /graphql, with an Apigee "Unable to identify proxy" fault (HTTP 404), and docs.iag.com.au returns HTTP 401. IAG publishes
    no API documentation or machine-readable contract; the proxies behind this gateway are internal or partner-only.
  humanURL: https://www.iag.com.au/
  baseURL: https://api.iag.com.au
  tags: []
  tags_raw:
  - Partner Gated
  properties: []
x-tags-removed:
- Brokers
- Partner Gated
x-coverage:
  state: blocked
  reason: bot-challenge
  detail: www.iag.com.au answered a browser User-Agent with an HTTP 403 anti-bot challenge (also /newsroom and www.cgu.com.au/eai/help);
    identity fields were left as previously evidenced. careers.iag.com.au, both GitHub orgs, hackerone.com/iag and LinkedIn
    returned 200. Identity pass 2026-10-20 removed GettingStarted/Documentation pointers to docs.hackerone.com, which are
    HackerOne's own docs, not IAG's.
  generated: '2026-10-20'
  evidence:
  - url: https://www.iag.com.au/
    status: 403
  - url: https://www.iag.com.au/newsroom
    status: 403
  - url: https://www.cgu.com.au/eai/help
    status: 403
  - url: https://careers.iag.com.au/
    status: 200
  - url: https://github.com/InsuranceAustraliaGroup
    status: 200
  - url: https://github.com/iagcl
    status: 200
  - url: https://hackerone.com/iag
    status: 200
x-enrichment:
  date: '2026-10-20'
  status: enriched
  artifacts_added: 15
  pass: modular-v1
  engine: identity=anthropic,contract=anthropic,surfaces=anthropic,docs=anthropic,regulatory=anthropic