openapi: 3.2.0
info:
  title: Ki Broker Trading Platform API (observed) Users API
  version: '2026-07-25'
  summary: Observed HTTP surface of Ki's partner-gated broker trading platform.
  description: '**This is an API Evangelist DERIVED specification, not a Ki-published document.**


    Ki (Lloyd''s Syndicate 1618) publishes no developer portal, no API reference and no OpenAPI. This document was derived on 2026-07-25 from the endpoint registry that Ki''s own broker platform ships in its public JavaScript bundle at `https://app.ki-insurance.com/assets/index-DgeF7w2c.js`. Every path and every HTTP method below was observed verbatim in that bundle, together with the request helpers (`GET`/`POST`/`PUT`/`DELETE`) that call them.


    What is REAL here: path templates, HTTP methods, query-parameter names, the `Authorization: Bearer` scheme, the `application/json` content negotiation, and the 401/403/503 handling the client implements.


    What is NOT specified: request and response schemas. Ki does not publish them and they are left empty rather than invented. Path-parameter NAMES are assigned by API Evangelist because the minified bundle does not retain them.


    The API is partner-gated: access requires an Auth0 authorization-code login at `https://login.ki-insurance.com/` against audience `https://api.ki.com`. There is no self-serve signup.'
  contact:
    name: Ki Insurance
    url: https://ki-insurance.com/
  x-apievangelist-derivation:
    method: derived
    source: https://app.ki-insurance.com/assets/index-DgeF7w2c.js
    observed: '2026-07-25'
    note: Not a provider-published specification. Do not treat as a Ki contract.
  x-observed-endpoints-unmapped:
  - path: /api/user/current/logout
    registry_key: user.logout
    note: endpoint observed in the client registry; HTTP method not determinable from the minified bundle
  - path: /api/quote/{p1}/sov
    registry_key: quote.uploadSov
    note: endpoint observed in the client registry; HTTP method not determinable from the minified bundle
  - path: /api/quote/{p1}/pdf/subjectivities
    registry_key: subjectivities
    note: endpoint observed in the client registry; HTTP method not determinable from the minified bundle
  - path: /api/umr/master-line-slip
    registry_key: uniqueMarketReference.masterLineSlip
    note: endpoint observed in the client registry; HTTP method not determinable from the minified bundle
  - path: /api/indications/consents
    registry_key: indicationsConsent.list
    note: endpoint observed in the client registry; HTTP method not determinable from the minified bundle
  - path: /api/indications/affirm
    registry_key: indicationsConsent.consent
    note: endpoint observed in the client registry; HTTP method not determinable from the minified bundle
servers:
- url: https://app.ki-insurance.com
  description: Ki broker trading platform (same-origin API; partner-gated)
security:
- auth0Bearer: []
tags:
- name: Users
paths:
  /api/user:
    get:
      operationId: getUserAll
      summary: List platform users
      description: Observed in the Ki broker platform client bundle as `user.all` -> `GET /api/user`. Request and response schemas are not published by Ki and are deliberately left unspecified rather than invented.
      tags:
      - Users
      x-observed-registry-key: user.all
      x-observed-method-evidence: explicit GET helper call site
      x-observed-confidence: high
      responses:
        '200':
          description: Successful response. Ki does not publish the response schema.
          content:
            application/json:
              schema: {}
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          $ref: '#/components/responses/Maintenance'
    post:
      operationId: createUserAll
      summary: Create a platform user
      description: Observed in the Ki broker platform client bundle as `user.all` -> `POST /api/user`. Request and response schemas are not published by Ki and are deliberately left unspecified rather than invented.
      tags:
      - Users
      x-observed-registry-key: user.all
      x-observed-method-evidence: explicit POST helper call site
      x-observed-confidence: high
      responses:
        '200':
          description: Successful response. Ki does not publish the response schema.
          content:
            application/json:
              schema: {}
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          $ref: '#/components/responses/Maintenance'
      requestBody:
        required: true
        description: JSON request body. Ki does not publish the request schema.
        content:
          application/json:
            schema: {}
  /api/user-journey-events:
    post:
      operationId: createUserJourneyEvents
      summary: Submit user-journey events
      description: Observed in the Ki broker platform client bundle as `userJourneyEvents` -> `POST /api/user-journey-events`. Request and response schemas are not published by Ki and are deliberately left unspecified rather than invented.
      tags:
      - Users
      x-observed-registry-key: userJourneyEvents
      x-observed-method-evidence: explicit POST helper call site
      x-observed-confidence: high
      responses:
        '200':
          description: Successful response. Ki does not publish the response schema.
          content:
            application/json:
              schema: {}
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          $ref: '#/components/responses/Maintenance'
      requestBody:
        required: true
        description: JSON request body. Ki does not publish the request schema.
        content:
          application/json:
            schema: {}
  /api/user/bulk:
    delete:
      operationId: deleteUser
      summary: Bulk delete users
      description: Observed in the Ki broker platform client bundle as `user.deleteUser` -> `DELETE /api/user/bulk`. Request and response schemas are not published by Ki and are deliberately left unspecified rather than invented.
      tags:
      - Users
      x-observed-registry-key: user.deleteUser
      x-observed-method-evidence: explicit DELETE helper call site
      x-observed-confidence: high
      responses:
        '200':
          description: Successful response. Ki does not publish the response schema.
          content:
            application/json:
              schema: {}
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          $ref: '#/components/responses/Maintenance'
  /api/user/bulk/email:
    post:
      operationId: createUserWelcomeEmail
      summary: Send bulk welcome emails
      description: Observed in the Ki broker platform client bundle as `user.welcomeEmail` -> `POST /api/user/bulk/email`. Request and response schemas are not published by Ki and are deliberately left unspecified rather than invented.
      tags:
      - Users
      x-observed-registry-key: user.welcomeEmail
      x-observed-method-evidence: explicit POST helper call site
      x-observed-confidence: high
      responses:
        '200':
          description: Successful response. Ki does not publish the response schema.
          content:
            application/json:
              schema: {}
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          $ref: '#/components/responses/Maintenance'
      requestBody:
        required: true
        description: JSON request body. Ki does not publish the request schema.
        content:
          application/json:
            schema: {}
  /api/user/bulk/register:
    post:
      operationId: createUserBulkUpload
      summary: Bulk register users
      description: Observed in the Ki broker platform client bundle as `user.bulkUpload` -> `POST /api/user/bulk/register`. Request and response schemas are not published by Ki and are deliberately left unspecified rather than invented.
      tags:
      - Users
      x-observed-registry-key: user.bulkUpload
      x-observed-method-evidence: explicit POST helper call site
      x-observed-confidence: high
      responses:
        '200':
          description: Successful response. Ki does not publish the response schema.
          content:
            application/json:
              schema: {}
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          $ref: '#/components/responses/Maintenance'
      requestBody:
        required: true
        description: JSON request body. Ki does not publish the request schema.
        content:
          application/json:
            schema: {}
  /api/user/consent:
    post:
      operationId: createUserConsent
      summary: Record user consent
      description: Observed in the Ki broker platform client bundle as `user.consent` -> `POST /api/user/consent`. Request and response schemas are not published by Ki and are deliberately left unspecified rather than invented.
      tags:
      - Users
      x-observed-registry-key: user.consent
      x-observed-method-evidence: explicit POST helper call site
      x-observed-confidence: high
      responses:
        '200':
          description: Successful response. Ki does not publish the response schema.
          content:
            application/json:
              schema: {}
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          $ref: '#/components/responses/Maintenance'
      requestBody:
        required: true
        description: JSON request body. Ki does not publish the request schema.
        content:
          application/json:
            schema: {}
  /api/user/current:
    get:
      operationId: getUserCurrent
      summary: Retrieve the currently authenticated user
      description: Observed in the Ki broker platform client bundle as `user.current` -> `GET /api/user/current`. Request and response schemas are not published by Ki and are deliberately left unspecified rather than invented.
      tags:
      - Users
      x-observed-registry-key: user.current
      x-observed-method-evidence: explicit GET helper call site
      x-observed-confidence: high
      responses:
        '200':
          description: Successful response. Ki does not publish the response schema.
          content:
            application/json:
              schema: {}
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          $ref: '#/components/responses/Maintenance'
  /api/user/reset-password:
    post:
      operationId: createUserResetPassword
      summary: Trigger a user password reset
      description: Observed in the Ki broker platform client bundle as `user.resetPassword` -> `POST /api/user/reset-password`. Request and response schemas are not published by Ki and are deliberately left unspecified rather than invented.
      tags:
      - Users
      x-observed-registry-key: user.resetPassword
      x-observed-method-evidence: explicit POST helper call site
      x-observed-confidence: high
      responses:
        '200':
          description: Successful response. Ki does not publish the response schema.
          content:
            application/json:
              schema: {}
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          $ref: '#/components/responses/Maintenance'
      requestBody:
        required: true
        description: JSON request body. Ki does not publish the request schema.
        content:
          application/json:
            schema: {}
  /api/user/{userId}:
    put:
      operationId: updateUserWithId
      summary: Update a user
      description: Observed in the Ki broker platform client bundle as `user.withId` -> `PUT /api/user/${e}`. Request and response schemas are not published by Ki and are deliberately left unspecified rather than invented.
      tags:
      - Users
      x-observed-registry-key: user.withId
      x-observed-method-evidence: explicit PUT helper call site
      x-observed-confidence: high
      responses:
        '200':
          description: Successful response. Ki does not publish the response schema.
          content:
            application/json:
              schema: {}
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          $ref: '#/components/responses/Maintenance'
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        description: JSON request body. Ki does not publish the request schema.
        content:
          application/json:
            schema: {}
  /api/user/{userId}/selected-cobs:
    put:
      operationId: updateUserClassOfBusiness
      summary: Update a user selected classes of business
      description: Observed in the Ki broker platform client bundle as `user.classOfBusiness` -> `PUT /api/user/${e}/selected-cobs`. Request and response schemas are not published by Ki and are deliberately left unspecified rather than invented.
      tags:
      - Users
      x-observed-registry-key: user.classOfBusiness
      x-observed-method-evidence: explicit PUT helper call site
      x-observed-confidence: high
      responses:
        '200':
          description: Successful response. Ki does not publish the response schema.
          content:
            application/json:
              schema: {}
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          $ref: '#/components/responses/Maintenance'
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        description: JSON request body. Ki does not publish the request schema.
        content:
          application/json:
            schema: {}
components:
  responses:
    Maintenance:
      description: Service unavailable. The client routes the user to the maintenance page.
    Forbidden:
      description: Forbidden. The client routes the user to the forbidden page.
    Unauthorized:
      description: Unauthorized. The client clears the session and returns the user to login.
  securitySchemes:
    auth0Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'Auth0-issued access token. The client attaches `Authorization: Bearer <token>` to every call. Issuer `https://login.ki-insurance.com/`, audience `https://api.ki.com`.'
    auth0OpenId:
      type: openIdConnect
      openIdConnectUrl: https://login.ki-insurance.com/.well-known/openid-configuration
      description: Auth0 OIDC discovery for the partner login (authorization code + PKCE).