Build on Indemnia

Get your app approved

Indemnia approves each app before people can connect it. Until then, people who try to connect see that your app isn't approved yet, and every request answers 403 client_blocked.

1. Register your app through OAuth dynamic client registration (step 2 under REST below). Keep the client_id it returns.
2. Send us the form below. We'll email you when your app is approved. Nothing changes in your code: the next request goes through.

Claude, ChatGPT and Cursor are already approved.

Connect an AI assistant

Add Indemnia as a remote MCP server. The assistant signs the person in and asks for their permission the first time it connects.

The server is named indemnia. Tool names are stable within a version, and each tool's description says when to use it.

Call the REST API

There are no API keys. Your app gets an access token for one person through OAuth 2.1 with PKCE, and sends it as a Bearer token.

1. Read /.well-known/oauth-protected-resource. It names the authorization server and the scopes.
2. Register your app at the authorization server's registration endpoint, then get it approved.
3. Send the person through the authorization code flow with PKCE. They sign in to Indemnia and choose what your app may do.
4. Call the API with the access token. Refresh it when it expires; tokens last an hour.

curl https://www.indemnia.ai/api/v1/households \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Every endpoint, with its inputs and outputs, is in the OpenAPI 3.1 document at /api/v1/openapi.json. Lists page with an opaque cursor and a limit of up to 200. Send an Idempotency-Key header on changes you might retry.

Permissions

When someone connects your app, they choose what it may do. Reading and changing are on by default; deleting and bulk changes are off until they turn them on. They can also limit your app to some of their households, and remove it at any time in Settings → Connected apps.

Areas: household, inventory, receipts, email, coverage, claims, reports, exports, notifications, support. A request outside what the person allowed answers 403 forbidden_scope.

Limits

Each person's connection to your app has its own window, reset every minute. The limit depends on the person's Indemnia plan.

Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. Past the limit you get 429 rate_limited with Retry-After in seconds. Separately, more than 1,200 requests a minute from one IP address are refused at the edge.

Errors

Errors are JSON problem details (RFC 9457) with a stable code, a hint that says what to do next, and a request_id to quote if you contact us.

{
  "type": "https://api.indemnia.ai/problems/client_blocked",
  "title": "App not allowed",
  "status": 403,
  "code": "client_blocked",
  "detail": "Indemnia hasn't approved this app yet.",
  "hint": "Ask the app's developer to request access at indemnia.ai/developers.",
  "request_id": "5f0c2a7e-3b1d-4c8a-9e2f-7d6b1a0c4e93"
}

The OpenAPI document lists every code.

Versions

The version is in the path: /api/v1. Within a version we only add things: new endpoints, new optional inputs, new fields. Before we remove anything, its responses carry Deprecation and Sunset headers well before it goes, with a link to what replaces it.