aid: iag
url: https://raw.githubusercontent.com/api-evangelist/iag/refs/heads/main/apis.yml
name: Insurance Australia Group
kind: company
description: >-
  Insurance Australia Group (IAG, ASX: IAG) is the largest general insurance
  company in Australia and New Zealand, headquartered in Sydney and operating a
  portfolio of underwriting brands rather than a single consumer-facing label.
  In Australia it trades as NRMA Insurance, CGU, WFI, Swann Insurance and the
  digital-native ROLLiN'; in New Zealand as State, AMI, NZI and Lumley. Its
  lines of business are property and casualty — home and contents, motor,
  commercial, rural and farm, compulsory third party and specialty — split
  across a Direct Insurance Australia arm and an Intermediated Insurance
  Australia arm that sells through brokers and authorised representatives. IAG
  has no public, self-serve API surface. Probing every conventional developer
  hostname on iag.com.au, cgu.com.au and nrma.com.au found no developer portal
  and no published reference documentation; docs.iag.com.au exists but
  immediately redirects to a Microsoft Entra ID sign-in and is an internal
  wall, not a portal. What the probes did confirm is a real Apigee API gateway
  fronting three brand virtual hosts — api.iag.com.au, api.cgu.com.au and
  api.nrma.com.au — each returning an Apigee ApplicationNotFound fault at the
  root, meaning proxies exist but none is discoverable or documented to the
  public. A second round of probing added a fourth brand virtual host,
  api.wfi.com.au, and a publicly resolvable non-production Apigee organisation
  at test-api.iag.com.au. IAG has also deployed MuleSoft's Anypoint API
  Experience Hub and is migrating roughly 600 APIs onto it, with a stated intent
  to make them agent aware — a substantial API estate that is entirely internal.
  Broker and partner integration in this market runs through
  human-facing trading portals — CGU's PolicyPlace quote-and-bind platform,
  the Ebix Sunrise Exchange and the Steadfast Client Trading Platform — not
  through an open API programme. IAG does run a HackerOne vulnerability
  disclosure programme, and published an RFC 9116 security.txt across seven
  brand domains until it was withdrawn in mid-2025. Australia has the legal
  machinery for open insurance and no live obligation: the Consumer Data Right
  that opened banking and energy was flagged for general insurance and then
  paused, so nothing compels IAG to publish. This record is therefore an honest
  stub: a partner-gated carrier with a private gateway and zero public
  specifications.
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
tags:
- Insurance
- Australia
- New Zealand
- Property and Casualty
- General Insurance
- Carrier
- Underwriting
- Claims
- Broker
- Partner Gated
created: '2026-07-25'
modified: '2026-07-25'
specificationVersion: '0.19'
apis: []
common:
- type: DomainSecurity
  url: security/iag-domain-security.yml
- type: Security
  name: Vulnerability disclosure policy (HackerOne)
  url: https://hackerone.com/iag
- type: VulnerabilityDisclosure
  url: security/iag-vulnerability-disclosure.yml
- type: Conformance
  url: conformance/iag-conformance.yml
- type: LLMsTxt
  url: llms/iag-llms.txt
- type: Website
  url: https://www.iag.com.au/
- type: GitHubOrganization
  url: https://github.com/InsuranceAustraliaGroup
- type: GitHubOrganization
  name: IAG Customer Labs
  url: https://github.com/iagcl
- type: LinkedIn
  url: https://www.linkedin.com/company/iag
- type: Newsroom
  url: https://www.iag.com.au/newsroom
- type: SupplierPortal
  url: https://www.iag.com.au/supplier-portal
- type: PartnerPortal
  url: https://www.cgu.com.au/eai/help
- type: Contact
  url: https://www.iag.com.au/contact-us
- type: CorporateGovernance
  name: Codes and policies
  url: https://www.iag.com.au/about-us/corporate-governance/codes-and-policies
- type: Careers
  url: https://careers.iag.com.au/
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com