Migration guide

Collections are now a top-level resource (from 2025-01-01)

In 2025-01-01 an insurance collection lived under the product namespace: it was created at POST /insurance/collection and read under /insurance/collection/{collectionId}/... (wealth collections lived under /wealth/collection/...). In 2026-04-01 collections become a single shared, top-level resource. A collection is created at POST /collections regardless of product, and the insurance data is read from a product sub-path — GET /collections/{collectionId}/insurance/data, mirroring the Wealth API's /collections/{collectionId}/wealth/data.

Endpoint mapping

Typed request parameters

POST /collections replaces the untyped 2025-01-01 request body — a loginMethod plus an input map keyed by uppercase strings, with separate top-level consents and filter fields — with a single typed parameters array. Each entry carries a type discriminator and its own named, lower-camelCase fields.

• Credentials become typed parameters (SWEDISH_BANKID, EMAIL) instead of keys in input.
• Consents are explicit, typed parameters. The 2025-01-01 consents array only ever accepted one value, TRADE_UNION_MEMBERSHIP; supply it as a TradeUnionConsentParameter (type: TRADE_UNION_CONSENT). Listing the consent type used to imply it had been granted — the new parameter carries an explicit value boolean, so a withheld consent can be stated rather than inferred from an omission, plus an optional collectedAt timestamp recording when it was obtained. value: true is equivalent to the old array entry; value: false and an omitted parameter both mean no consent.
• Session identifiers move from inline input keys into a SessionMetadataParameter (type: SESSION_METADATA), under its attributes map with the keys sessionId, advisorHandle and externalReference.

// 2025-01-01
{
  "company": "se-lansforsakringar",
  "loginMethod": "SWEDISH_MOBILE_BANKID_OTHER_DEVICE",
  "input": { "SWEDISH_PERSONAL_NUMBER": "199001011234" }
}

// 2026-04-01
{
  "company": "se-lansforsakringar",
  "loginMethod": "SWEDISH_MOBILE_BANKID_OTHER_DEVICE",
  "parameters": [
    { "type": "SWEDISH_BANKID", "personalNumber": "199001011234" }
  ]
}

Login methods (Sweden)

loginMethod stays a top-level field and the Swedish values are unchanged from 2025-01-01; read the methods a company accepts from loginMethods on GET /companies/availability. Only the shape of the credential payload changes — each method now carries its credential in a typed parameter rather than in the input map:

All Swedish BankID variants — including the _TEST (BankID sandbox) and _MOCK (deterministic, short-circuited) flows — reuse the same SwedishBankIdParameter (type: SWEDISH_BANKID); switch environments by changing only the loginMethod.

Steps

1. Repoint the base path. Replace /insurance/collection with /collections, and read data from /collections/{collectionId}/insurance/data instead of /insurance/collection/{collectionId}/data. Status, supplement-info and deletion keep the same suffixes under the new prefix.
2. Convert the request body. Move each input key into a typed entry in the parameters array (e.g. SWEDISH_PERSONAL_NUMBER → { "type": "SWEDISH_BANKID", "personalNumber": … }).
3. Move consents and session data into parameters. Replace the consents array with a TRADE_UNION_CONSENT parameter carrying an explicit value, and move SESSION_ID / ADVISOR_HANDLE / EXTERNAL_REFERENCE into a SESSION_METADATA parameter's attributes as sessionId / advisorHandle / externalReference.