Partner API — V2

V2 replaces the async create/poll flow from V1 with a fully synchronous request/response model: POST a quote group and get the fully rated result back in the same response — no polling required.

Authentication

Every request must include an X-SwyfftApiKey header. A request without it, or with an invalid key, is rejected with a 401 unauthorized error (see Errors below).

Rater/CRM intermediary platforms (e.g. QuoteRush) that submit on behalf of multiple agencies additionally send an X-SwyfftIntermediaryKey header. When present and valid, it sets the request's channel (e.g. QuoteRush); an invalid key fails the request rather than silently downgrading. A request with no intermediary key is treated as Direct.

Quote group lifecycle

• POST /partnerapi/v2/quote-groups creates a quote group and returns the fully rated result immediately. Repeating an identical POST for the same agency and address returns the existing quote group rather than creating a duplicate — safe to retry sequentially after a timeout. Overlapping retries (issued before the original request has completed) are not guaranteed to dedupe and may create a second quote group.
• GET /partnerapi/v2/quote-groups/{id} re-reads a previously created group. It is a plain read — there is no separate pending/processing state to poll for.
• PATCH /partnerapi/v2/quote-groups/{id}/quotes/{quoteId} applies element changes and re-rates, returning the full updated group. Changes to elements common to both rating types (e.g. year built, roof age) propagate automatically to the sibling Admitted/E&S quote in the same group.

A quote group can also come back with no bindable quotes at all — a 200 response with an empty quotes array and an errors array explaining why each rating type declined.

Errors

Errors are returned as a single JSON envelope:

{
  "error": {
    "code": "invalid_request",
    "message": "Human-readable description",
    "param": "address",
    "requestId": "..."
  }
}

param is only present when the error is attributable to a specific request field. requestId is always present and also echoed as the X-Request-Id response header — include it when reporting an issue.

error.code is one of a fixed set of values; treat it as the stable part of the contract rather than the message text:

• unauthorized — missing/invalid API key or intermediary key
• invalid_request — malformed or missing request data
• not_found — no quote group/quote matches the given id
• conflict — reserved; not currently returned by any endpoint
• unprocessable — well-formed request the API can't act on
• rate_limited — see Rate limits below
• server_error — unexpected failure; safe to retry

Rate limits

Rate limiting applies only to POST /partnerapi/v2/quote-groups (creating a new quote group) — reads and patches are not limited. The limit is checked before the get-or-create lookup, so every POST counts against it, including a repeat POST that returns an existing quote group rather than creating a new one. Default limits are 20 requests per rolling 5 minutes and 500 requests per rolling 24 hours per account; your account may have different limits configured.

Exceeding a limit returns 429 with error.code = "rate_limited" and a Retry-After header (in seconds) telling you when to try again.