openapi: 3.2.0
info:
  title: 'NAIC Content JSON: Discovery API'
  version: '1.1'
  summary: Anonymous read API over the NAIC's public regulatory content estate (content.naic.org), served as Drupal JSON:API.
  description: 'The National Association of Insurance Commissioners does not publish an OpenAPI description. It does, however, serve a live, anonymously readable JSON:API 1.1 surface at https://content.naic.org/jsonapi, generated by Drupal 11.


    This OpenAPI is **derived by API Evangelist from that live resource index**, not published by the NAIC. Every path below corresponds to a `links` entry in the index document fetched on 2026-07-25 (284 resource objects). Anonymous GET was verified against a sample of collections (node--article, node--page, node--committee_page, node--state_department_contact, taxonomy_term--model_laws, taxonomy_term--states, taxonomy_term--insurance_types, taxonomy_term--publications, media--document, node--newsletter), each returning HTTP 200 with `content-type: application/vnd.api+json`. Write operations are NOT described here: an anonymous `POST /jsonapi/node/article` returned HTTP 401 `No authentication credentials provided.`, and the NAIC publishes no credentialing path for the write surface.


    What this API exposes is the regulatory content itself: NAIC model laws and their MDL numbers, insurance topics, committees and task forces, publications, newsroom articles, CIPR research, and the state insurance department contact directory. It does NOT expose SERFF filings, the Financial Data Repository, SBS licensing records, or any of the Okta-gated regulator systems.'
  contact:
    name: NAIC Web Post
    email: webpost@naic.org
    url: https://content.naic.org/contact
  termsOfService: https://content.naic.org/application/terms-conditions
  license:
    name: All content (c) 1991-2025 National Association of Insurance Commissioners. All rights reserved.
    url: https://content.naic.org/application/terms-conditions
  x-derived-by: API Evangelist enrichment pipeline
  x-derived-from: https://content.naic.org/jsonapi
  x-derived-on: '2026-07-25'
  x-publisher-provided: false
servers:
- url: https://content.naic.org/jsonapi
  description: Production JSON:API entry point (public, anonymous read).
security: []
tags:
- name: discovery
  description: The JSON:API entry point.
paths:
  /:
    get:
      operationId: getResourceIndex
      summary: Get the JSON:API resource index
      description: 'Returns the JSON:API entry point: a document whose `links` member lists every exposed resource type and its collection URL (284 resource objects observed on 2026-07-25). This index is the machine-readable contract NAIC actually publishes; this OpenAPI is derived from it.'
      tags:
      - discovery
      responses:
        '200':
          description: The JSON:API resource index.
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/ResourceIndex'
components:
  schemas:
    Links:
      type: object
      description: JSON:API links object. Collections carry `self` and, when more records exist, `next`/`prev`.
      additionalProperties:
        oneOf:
        - type: string
          format: uri
        - type: object
          properties:
            href:
              type: string
              format: uri
            meta:
              type: object
    JsonApiObject:
      type: object
      description: The `jsonapi` top-level member, present on every response.
      properties:
        version:
          type: string
          const: '1.1'
        meta:
          type: object
    ResourceIndex:
      type: object
      required:
      - jsonapi
      - links
      properties:
        jsonapi:
          $ref: '#/components/schemas/JsonApiObject'
        data:
          type: array
          items: {}
        links:
          $ref: '#/components/schemas/Links'
          description: One entry per exposed resource type, keyed `entity--bundle`.
externalDocs:
  description: JSON:API v1.1 specification
  url: https://jsonapi.org/format/1.1/
x-security-note: The read surface described here requires no credentials — an empty root `security` array is the accurate statement, verified by anonymous HTTP 200 responses. The write surface returns HTTP 401 'No authentication credentials provided.' and the NAIC documents no public credentialing path for it, so no securityScheme is asserted here.