openapi: 3.2.0 info: title: 'NAIC Content JSON: User API' version: '1.1' summary: Anonymous read API over the NAIC's public regulatory content estate (content.naic.org), served as Drupal JSON:API. description: 'The National Association of Insurance Commissioners does not publish an OpenAPI description. It does, however, serve a live, anonymously readable JSON:API 1.1 surface at https://content.naic.org/jsonapi, generated by Drupal 11. This OpenAPI is **derived by API Evangelist from that live resource index**, not published by the NAIC. Every path below corresponds to a `links` entry in the index document fetched on 2026-07-25 (284 resource objects). Anonymous GET was verified against a sample of collections (node--article, node--page, node--committee_page, node--state_department_contact, taxonomy_term--model_laws, taxonomy_term--states, taxonomy_term--insurance_types, taxonomy_term--publications, media--document, node--newsletter), each returning HTTP 200 with `content-type: application/vnd.api+json`. Write operations are NOT described here: an anonymous `POST /jsonapi/node/article` returned HTTP 401 `No authentication credentials provided.`, and the NAIC publishes no credentialing path for the write surface. What this API exposes is the regulatory content itself: NAIC model laws and their MDL numbers, insurance topics, committees and task forces, publications, newsroom articles, CIPR research, and the state insurance department contact directory. It does NOT expose SERFF filings, the Financial Data Repository, SBS licensing records, or any of the Okta-gated regulator systems.' contact: name: NAIC Web Post email: webpost@naic.org url: https://content.naic.org/contact termsOfService: https://content.naic.org/application/terms-conditions license: name: All content (c) 1991-2025 National Association of Insurance Commissioners. All rights reserved. url: https://content.naic.org/application/terms-conditions x-derived-by: API Evangelist enrichment pipeline x-derived-from: https://content.naic.org/jsonapi x-derived-on: '2026-07-25' x-publisher-provided: false servers: - url: https://content.naic.org/jsonapi description: Production JSON:API entry point (public, anonymous read). security: [] tags: - name: user description: User entities (public fields only for anonymous callers). paths: /user/user: get: operationId: listUser summary: List user resources description: Returns a JSON:API collection document of `user--user` resource objects. Supports JSON:API sparse fieldsets, sorting, filtering, related-resource inclusion and offset pagination. Verified anonymously readable on 2026-07-25. tags: - user parameters: - $ref: '#/components/parameters/pageLimit' - $ref: '#/components/parameters/pageOffset' - $ref: '#/components/parameters/sort' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/include' - $ref: '#/components/parameters/fields' responses: '200': description: A JSON:API collection document. content: application/vnd.api+json: schema: $ref: '#/components/schemas/CollectionDocument' '400': $ref: '#/components/responses/BadRequest' '404': $ref: '#/components/responses/NotFound' /user/user/{id}: get: operationId: getUser summary: Get one user resource by UUID description: Returns a JSON:API individual document for a single `user--user` resource, addressed by its Drupal UUID. Supports sparse fieldsets and related-resource inclusion. tags: - user parameters: - $ref: '#/components/parameters/resourceId' - $ref: '#/components/parameters/include' - $ref: '#/components/parameters/fields' - $ref: '#/components/parameters/resourceVersion' responses: '200': description: A JSON:API individual document. content: application/vnd.api+json: schema: $ref: '#/components/schemas/IndividualDocument' '404': $ref: '#/components/responses/NotFound' components: parameters: pageOffset: name: page[offset] in: query required: false description: Zero-based index of the first resource object to return. Paired with the `next`/`prev` links in the response. schema: type: integer minimum: 0 default: 0 include: name: include in: query required: false description: Comma-separated relationship paths to side-load into the `included` member, e.g. `field_tags,uid`. schema: type: string pageLimit: name: page[limit] in: query required: false description: Maximum number of resource objects to return. Drupal JSON:API caps this at 50. schema: type: integer minimum: 1 maximum: 50 default: 50 example: 10 filter: name: filter in: query required: false style: deepObject explode: true description: JSON:API filter expression. Simple form `filter[field]=value`; condition form `filter[label][condition][path]=field&filter[label][condition][operator]=CONTAINS`. An unknown field returns HTTP 400 with a JSON:API error object. schema: type: object additionalProperties: true resourceId: name: id in: path required: true description: The resource's Drupal UUID. schema: type: string format: uuid example: 46f6505d-0014-46ce-95b8-5ba89e7f96f6 fields: name: fields in: query required: false style: deepObject explode: true description: 'Sparse fieldsets, keyed by resource type: `fields[node--article]=title,created`.' schema: type: object additionalProperties: type: string sort: name: sort in: query required: false description: Comma-separated sort fields. Prefix a field with `-` for descending order, e.g. `-created`. schema: type: string example: -created resourceVersion: name: resourceVersion in: query required: false description: Revision selector, e.g. `id:717` or `rel:working-copy`. Emitted by the API in each resource's `links` member. schema: type: string schemas: Links: type: object description: JSON:API links object. Collections carry `self` and, when more records exist, `next`/`prev`. additionalProperties: oneOf: - type: string format: uri - type: object properties: href: type: string format: uri meta: type: object Relationship: type: object properties: data: oneOf: - $ref: '#/components/schemas/ResourceIdentifier' - type: array items: $ref: '#/components/schemas/ResourceIdentifier' - type: 'null' links: $ref: '#/components/schemas/Links' JsonApiObject: type: object description: The `jsonapi` top-level member, present on every response. properties: version: type: string const: '1.1' meta: type: object ResourceObject: type: object required: - type - id description: A JSON:API resource object. `attributes` and `relationships` are bundle-specific Drupal fields; sparse fieldsets narrow them. properties: type: type: string description: Resource type in `entity--bundle` form, e.g. `node--article`. id: type: string format: uuid links: $ref: '#/components/schemas/Links' attributes: type: object additionalProperties: true relationships: type: object additionalProperties: $ref: '#/components/schemas/Relationship' IndividualDocument: type: object required: - jsonapi - data properties: jsonapi: $ref: '#/components/schemas/JsonApiObject' data: $ref: '#/components/schemas/ResourceObject' included: type: array items: $ref: '#/components/schemas/ResourceObject' links: $ref: '#/components/schemas/Links' CollectionDocument: type: object required: - jsonapi - data properties: jsonapi: $ref: '#/components/schemas/JsonApiObject' data: type: array items: $ref: '#/components/schemas/ResourceObject' included: type: array items: $ref: '#/components/schemas/ResourceObject' links: $ref: '#/components/schemas/Links' meta: type: object Error: type: object properties: title: type: string status: type: string detail: type: string code: type: string links: type: object properties: via: type: object properties: href: type: string format: uri info: type: object properties: href: type: string format: uri description: Points at the HTTP status-code definition, e.g. the RFC section for 400. ErrorDocument: type: object required: - errors description: JSON:API error document. The NAIC surface returns JSON:API error objects, not RFC 9457 problem details. properties: jsonapi: $ref: '#/components/schemas/JsonApiObject' errors: type: array items: $ref: '#/components/schemas/Error' ResourceIdentifier: type: object required: - type - id properties: type: type: string id: type: string description: The related resource's UUID, or the literal sentinel `virtual` that Drupal JSON:API emits for the synthetic root term of a taxonomy hierarchy. meta: type: object responses: BadRequest: description: Malformed query — for example an unknown filter path. content: application/vnd.api+json: schema: $ref: '#/components/schemas/ErrorDocument' examples: unknownFilterField: summary: Observed 2026-07-25 value: jsonapi: version: '1.1' errors: - title: Bad Request status: '400' detail: Invalid nested filtering. The field `nope`, given in the path `nope`, does not exist. NotFound: description: No resource matches the given identifier, or the resource type is not exposed. content: application/vnd.api+json: schema: $ref: '#/components/schemas/ErrorDocument' examples: unknownUuid: summary: Observed 2026-07-25 value: jsonapi: version: '1.1' errors: - title: Not Found status: '404' detail: The "entity" parameter was not converted for the path "/jsonapi/node/article/{entity}" externalDocs: description: JSON:API v1.1 specification url: https://jsonapi.org/format/1.1/ x-security-note: The read surface described here requires no credentials — an empty root `security` array is the accurate statement, verified by anonymous HTTP 200 responses. The write surface returns HTTP 401 'No authentication credentials provided.' and the NAIC documents no public credentialing path for it, so no securityScheme is asserted here.