CAA Insurance · Authentication Profile

Caa Insurance Authentication

Authentication

CAA Insurance secures its APIs with ws-federation, openIdConnect, oauth2, and session-cookie across 4 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, implicit, and deviceCode flow(s).

InsuranceCanadaProperty and CasualtyAuto InsuranceHome InsuranceCarrierBrokersPersonal LinesTelematicsPartner GatedNo Public API
Methods: ws-federation, openIdConnect, oauth2, session-cookie Schemes: 4 OAuth flows: authorizationCode, implicit, deviceCode API key in:

Security Schemes

BrokerPortalFederation ws-federation
EntraExternalIdCIAM openIdConnect
SharePointSoapSession session
CustomerPortalSession session

Source

Authentication Profile

caa-insurance-authentication.yml Raw ↑ 
generated: '2026-07-25'
method: searched
source: >-
  live probes 2026-07-25 of caabrokerportal.ca, customer.caainsurancecompany.ca
  and the Microsoft Entra External ID (CIAM) tenant discovery document at
  ccgexternalid.ciamlogin.com
note: >-
  CAA Insurance publishes no API authentication documentation because it
  publishes no API. This profile records the authentication surfaces that are
  actually observable on CAA-operated hosts: a WS-Federation / OpenID Connect
  identity provider fronting the broker portal, an application session login on
  the customer portal, and an anonymous-WSDL / authenticated-operation SOAP
  surface on the broker portal itself. No API key, bearer token, or mTLS client
  contract is offered to third-party developers.
summary:
  types: [ws-federation, openIdConnect, oauth2, session-cookie]
  api_key_in: []
  oauth2_flows: [authorizationCode, implicit, deviceCode]
  developer_facing_credential: none
schemes:
- name: BrokerPortalFederation
  type: ws-federation
  surface: https://www.caabrokerportal.ca/
  identity_provider: https://ccgexternalid.ciamlogin.com/018aba37-21fa-4b10-9382-01cdc448ba66/wsfed
  relying_party: urn:sharepoint:federation
  note: >-
    Observed on the redirect chain from http://www.caabrokerportal.ca/. The
    relying party is a SharePoint broker workspace; brokers, not developers, are
    the audience.
- name: EntraExternalIdCIAM
  type: openIdConnect
  openIdConnectUrl: https://ccgexternalid.ciamlogin.com/018aba37-21fa-4b10-9382-01cdc448ba66/v2.0/.well-known/openid-configuration
  source: well-known/caa-insurance-openid-configuration.json
  issuer: https://018aba37-21fa-4b10-9382-01cdc448ba66.ciamlogin.com/018aba37-21fa-4b10-9382-01cdc448ba66/v2.0
  authorization_endpoint: https://ccgexternalid.ciamlogin.com/018aba37-21fa-4b10-9382-01cdc448ba66/oauth2/v2.0/authorize
  token_endpoint: https://ccgexternalid.ciamlogin.com/018aba37-21fa-4b10-9382-01cdc448ba66/oauth2/v2.0/token
  device_authorization_endpoint: https://ccgexternalid.ciamlogin.com/018aba37-21fa-4b10-9382-01cdc448ba66/oauth2/v2.0/devicecode
  end_session_endpoint: https://ccgexternalid.ciamlogin.com/018aba37-21fa-4b10-9382-01cdc448ba66/oauth2/v2.0/logout
  jwks_uri: https://ccgexternalid.ciamlogin.com/018aba37-21fa-4b10-9382-01cdc448ba66/discovery/v2.0/keys
  userinfo_endpoint: https://graph.microsoft.com/oidc/userinfo
  response_types_supported: [code, id_token, code id_token, id_token token]
  token_endpoint_auth_methods_supported: [client_secret_post, private_key_jwt, client_secret_basic, self_signed_tls_client_auth]
  id_token_signing_alg_values_supported: [RS256]
  subject_types_supported: [pairwise]
  scopes_supported: [openid, profile, email, offline_access]
  mtls_bound_access_tokens: true
  mtls_token_endpoint: https://mtlsauth.microsoft.com/018aba37-21fa-4b10-9382-01cdc448ba66/oauth2/v2.0/token
  tenant_region_scope: NA
  note: >-
    Anonymously served, standards-compliant OIDC discovery for the CAA Club
    Group CIAM tenant. Client registration is not open — there is no public
    developer app registration path, so these endpoints are documentation of the
    identity model, not an integration invitation.
- name: SharePointSoapSession
  type: session
  surface: https://www.caabrokerportal.ca/_vti_bin/*.asmx
  source: wsdl/_index.yml
  note: >-
    Twenty SharePoint SOAP WSDL documents are served anonymously; every data
    operation requires an authenticated SharePoint session. The REST/OData
    sibling at /_api/web returns HTTP 403 System.UnauthorizedAccessException
    anonymously, and /_vti_bin/lists.asmx?WSDL returns 403.
- name: CustomerPortalSession
  type: session
  surface: https://customer.caainsurancecompany.ca/
  note: >-
    Next.js application login. Every route, including /.well-known/*, 307s to
    /sign-in?callbackUrl=... ; no anonymous OIDC or OAuth metadata is served.
public_api_auth:
  available: false
  note: >-
    No API key programme, no OAuth client registration, no developer
    credentials of any kind are offered by CAA Insurance.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/caa-insurance-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.