Migration guide

Collections are now a top-level resource

In 2025-01-01 an insurance collection lived under the product namespace: it was created at POST /insurance/collection and read under /insurance/collection/{collectionId}/.... In 2026-04-01 collections become a top-level resource. A collection is created at POST /collections, and the insurance data is read from GET /collections/{collectionId}/insurance/data.

Endpoint mapping

Typed request parameters

POST /collections replaces the untyped 2025-01-01 request body — a loginMethod plus an input map keyed by uppercase strings, with a separate top-level consents field — with a single typed parameters array. Each entry carries a type discriminator and its own named, lower-camelCase fields.

• Credentials become typed parameters (SWEDISH_BANKID, EMAIL) instead of keys in input.
• Consents are explicit, typed parameters. The 2025-01-01 consents array only ever accepted one value, TRADE_UNION_MEMBERSHIP; supply it as a TradeUnionConsentParameter (type: TRADE_UNION_CONSENT). Listing the consent type used to imply it had been granted — the new parameter carries an explicit value boolean, so a withheld consent can be stated rather than inferred from an omission, plus an optional collectedAt timestamp recording when it was obtained. value: true is equivalent to the old array entry; value: false and an omitted parameter both mean no consent.
• Session identifiers move from inline input keys into a SessionMetadataParameter (type: SESSION_METADATA), under its attributes map with the keys sessionId, advisorHandle and externalReference.

// 2025-01-01
{
  "company": "se-lansforsakringar",
  "loginMethod": "SWEDISH_MOBILE_BANKID_OTHER_DEVICE",
  "input": { "SWEDISH_PERSONAL_NUMBER": "199001011234" }
}

// 2026-04-01
{
  "company": "se-lansforsakringar",
  "loginMethod": "SWEDISH_MOBILE_BANKID_OTHER_DEVICE",
  "parameters": [
    { "type": "SWEDISH_BANKID", "personalNumber": "199001011234" }
  ]
}

Login methods (Sweden)

loginMethod must still be sent as a top-level field (a LOGIN_METHOD entry in parameters is ignored), and the Swedish values are unchanged from 2025-01-01; read the methods a company accepts from loginMethods on GET /companies/availability. Only the shape of the credential payload changes — each method now carries its credential in a typed parameter rather than in the input map:

All Swedish BankID variants — including the _TEST (BankID sandbox) and _MOCK (deterministic, short-circuited) flows — reuse the same SwedishBankIdParameter (type: SWEDISH_BANKID); switch environments by changing only the loginMethod.

Response changes

• insuredMovablesAmount on InsuranceFarm changes from an integer to a MonetaryAmount object with amount and currency fields, matching insuredMovablesAmount on the other property insurance types.
• A new collection status value, AUTHENTICATION_ERROR, is returned for a sign-in failure that doesn't match a more specific status, for example when the chosen login method can't be used at the company. In 2025-01-01 these were reported as FAILED.

Steps

1. Repoint the endpoints. Replace /insurance/collection with /collections. Status, supplement-info and deletion keep the same suffixes under the new prefix. Data and policy documents also gain an /insurance/ segment: read data from /collections/{collectionId}/insurance/data and documents from /collections/{collectionId}/insurance/policy/{policyId}/document/{documentId}.
2. Convert the request body. Move each input key into a typed entry in the parameters array (e.g. SWEDISH_PERSONAL_NUMBER → { "type": "SWEDISH_BANKID", "personalNumber": … }).
3. Move consents and session data into parameters. Replace the consents array with a TRADE_UNION_CONSENT parameter carrying an explicit value, and move SESSION_ID / ADVISOR_HANDLE / EXTERNAL_REFERENCE into a SESSION_METADATA parameter's attributes as sessionId / advisorHandle / externalReference.
4. Update response handling. Read insuredMovablesAmount on farm insurance as .amount / .currency, and handle the AUTHENTICATION_ERROR status.