# CAA Insurance

> CAA Insurance Company is a Canadian personal-lines property and casualty carrier, underwriting since 1974 as part of CAA Club Group (the CAA South Central Ontario federation), head office at 60 Commerce Valley Drive East, Thornhill, Ontario. It writes auto (including the MyPace pay-as-you-drive product and CAA Connect telematics) and property (home, condo, tenant) insurance in BC, SK, MB, ON, NB, NS, and PE, direct-to-consumer and through independent brokers. **CAA Insurance publishes no public API and no developer portal.** This file is generated by API Evangelist from the artifacts in this repository; it is not published by CAA Insurance.

## API posture

- No public developer portal, no self-serve API program, no OpenAPI/Swagger, no GraphQL, no gRPC, no AsyncAPI, and no webhook catalog (verified 2026-07-25).
- Every developer host (developer./developers./docs./api. on both caainsurancecompany.com and .ca) fails DNS; every developer path (/developers, /api, /partners, /integrations) returns 404.
- Quote, bind, issue, and FNOL exist only as human web applications or broker/phone channels — none is exposed as an API.
- No ACORD, CSIO, NGDS, or IVANS reference appears on any public CAA Insurance page. Canada has no open-insurance mandate: OSFI supervises prudentially, FSRA/AMF handle market conduct, and Consumer-Driven Banking excludes insurance.

## The one machine-readable surface

- [SharePoint SOAP WSDLs (CAA Broker Portal)](https://www.caabrokerportal.ca/_vti_bin/sites.asmx?WSDL): the broker portal runs Microsoft SharePoint 16.0.0.5552 and serves 20 WSDL 1.1 documents (199 operations) anonymously at `/_vti_bin/<service>.asmx?WSDL`. These are Microsoft product contracts for document/list/site collaboration — there is no insurance operation among them — and every data call requires an authenticated session. Harvested verbatim to `wsdl/`.
- [SharePoint REST/OData](https://www.caabrokerportal.ca/_api/web): present, returns HTTP 403 `System.UnauthorizedAccessException` anonymously.
- [OpenID Connect discovery](https://ccgexternalid.ciamlogin.com/018aba37-21fa-4b10-9382-01cdc448ba66/v2.0/.well-known/openid-configuration): the Microsoft Entra External ID (CIAM) tenant that authenticates the broker portal over WS-Federation (`wtrealm=urn:sharepoint:federation`). Scopes: openid, profile, email, offline_access. Client registration is not open to third parties.

## Human surfaces

- [Website](https://caainsurancecompany.ca/)
- [About](https://caainsurancecompany.ca/about)
- [Broker program microsite](https://broker.caainsurance.com/) — marketing and business development only; no technical connectivity documented.
- [Broker portal (login wall)](https://www.caabrokerportal.ca/)
- [Customer self-service portal](https://customer.caainsurancecompany.ca/)
- [Auto quote application](https://car-insurance.caainsurancecompany.com/auto/intro)
- [Property quote application](https://property-insurance.caainsurancecompany.com/property/intro)
- [Claims and inquiries](https://caainsurancecompany.ca/claims-and-inquires)
- [Blog](https://caainsurancecompany.ca/blog)
- [Privacy](https://caainsurancecompany.ca/privacy)
- [Terms of use](https://caainsurancecompany.ca/terms-of-use)

## Artifacts in this repository

- [apis.yml](https://raw.githubusercontent.com/api-evangelist/caa-insurance/refs/heads/main/apis.yml) — APIs.json index for the company
- [review.yml](https://raw.githubusercontent.com/api-evangelist/caa-insurance/refs/heads/main/review.yml) — full API Evangelist review with every probe and status
- [wsdl/_index.yml](https://raw.githubusercontent.com/api-evangelist/caa-insurance/refs/heads/main/wsdl/_index.yml) — the 20 harvested SharePoint WSDLs and their 199 operations
- [authentication/caa-insurance-authentication.yml](https://raw.githubusercontent.com/api-evangelist/caa-insurance/refs/heads/main/authentication/caa-insurance-authentication.yml) — WS-Federation, OIDC, and session surfaces
- [scopes/caa-insurance-scopes.yml](https://raw.githubusercontent.com/api-evangelist/caa-insurance/refs/heads/main/scopes/caa-insurance-scopes.yml) — the identity scopes (no business scopes exist)
- [well-known/caa-insurance-well-known.yml](https://raw.githubusercontent.com/api-evangelist/caa-insurance/refs/heads/main/well-known/caa-insurance-well-known.yml) — every /.well-known/ path probed, with status
- [conformance/caa-insurance-conformance.yml](https://raw.githubusercontent.com/api-evangelist/caa-insurance/refs/heads/main/conformance/caa-insurance-conformance.yml) — standards conformed to and, more importantly, not
- [conventions/caa-insurance-conventions.yml](https://raw.githubusercontent.com/api-evangelist/caa-insurance/refs/heads/main/conventions/caa-insurance-conventions.yml) — observed request/response semantics
- [errors/caa-insurance-problem-types.yml](https://raw.githubusercontent.com/api-evangelist/caa-insurance/refs/heads/main/errors/caa-insurance-problem-types.yml) — observed error envelopes
- [security/caa-insurance-domain-security.yml](https://raw.githubusercontent.com/api-evangelist/caa-insurance/refs/heads/main/security/caa-insurance-domain-security.yml) — TLS/HSTS/DNSSEC/CAA/SPF/DMARC probe results

## Notes for agents

- There is nothing to integrate with programmatically. Do not attempt to call the broker portal SOAP or OData endpoints: they are gated and intended for authenticated CAA brokers only.
- No security.txt, no vulnerability disclosure programme, and no trust center were found on any CAA host as of 2026-07-25.