Insurance Australia Group

aid: iag
url: https://raw.githubusercontent.com/api-evangelist/iag/refs/heads/main/apis.yml
name: Insurance Australia Group
kind: company
description: 'Insurance Australia Group (IAG, ASX: IAG) is the largest general insurance company in Australia and New Zealand,
  headquartered in Sydney and operating a portfolio of underwriting brands rather than a single consumer-facing label. In
  Australia it trades as NRMA Insurance, CGU, WFI, Swann Insurance and the digital-native ROLLiN''; in New Zealand as State,
  AMI, NZI and Lumley. Its lines of business are property and casualty — home and contents, motor, commercial, rural and farm,
  compulsory third party and specialty — split across a Direct Insurance Australia arm and an Intermediated Insurance Australia
  arm that sells through brokers and authorised representatives. IAG has no public, self-serve API surface. Probing every
  conventional developer hostname on iag.com.au, cgu.com.au and nrma.com.au found no developer portal and no published reference
  documentation; docs.iag.com.au exists but immediately redirects to a Microsoft Entra ID sign-in and is an internal wall,
  not a portal. What the probes did confirm is a real Apigee API gateway fronting three brand virtual hosts — api.iag.com.au,
  api.cgu.com.au and api.nrma.com.au — each returning an Apigee ApplicationNotFound fault at the root, meaning proxies exist
  but none is discoverable or documented to the public. A second round of probing added a fourth brand virtual host, api.wfi.com.au,
  and a publicly resolvable non-production Apigee organisation at test-api.iag.com.au. IAG has also deployed MuleSoft''s Anypoint
  API Experience Hub and is migrating roughly 600 APIs onto it, with a stated intent to make them agent aware — a substantial
  API estate that is entirely internal. Broker and partner integration in this market runs through human-facing trading portals
  — CGU''s PolicyPlace quote-and-bind platform, the Ebix Sunrise Exchange and the Steadfast Client Trading Platform — not
  through an open API programme. IAG does run a HackerOne vulnerability disclosure programme, and published an RFC 9116 security.txt
  across seven brand domains until it was withdrawn in mid-2025. Australia has the legal machinery for open insurance and
  no live obligation: the Consumer Data Right that opened banking and energy was flagged for general insurance and then paused,
  so nothing compels IAG to publish. This record is therefore an honest stub: a partner-gated carrier with a private gateway
  and zero public specifications.'
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
tags:
- Insurance
- Australia
- New Zealand
- Property and Casualty
- General Insurance
- Carrier
- Underwriting
- Claims
- Broker
- Partner Gated
created: '2026-07-25'
modified: '2026-07-25'
specificationVersion: '0.19'
apis: []
common:
- type: DomainSecurity
  url: security/iag-domain-security.yml
- type: Security
  name: Vulnerability disclosure policy (HackerOne)
  url: https://hackerone.com/iag
- type: VulnerabilityDisclosure
  url: security/iag-vulnerability-disclosure.yml
- type: Conformance
  url: conformance/iag-conformance.yml
- type: LLMsTxt
  url: llms/iag-llms.txt
- type: Website
  url: https://www.iag.com.au/
- type: GitHubOrganization
  url: https://github.com/InsuranceAustraliaGroup
- type: GitHubOrganization
  name: IAG Customer Labs
  url: https://github.com/iagcl
- type: LinkedIn
  url: https://www.linkedin.com/company/iag
- type: Newsroom
  url: https://www.iag.com.au/newsroom
- type: SupplierPortal
  url: https://www.iag.com.au/supplier-portal
- type: PartnerPortal
  url: https://www.cgu.com.au/eai/help
- type: Contact
  url: https://www.iag.com.au/contact-us
- type: CorporateGovernance
  name: Codes and policies
  url: https://www.iag.com.au/about-us/corporate-governance/codes-and-policies
- type: Careers
  url: https://careers.iag.com.au/
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com