# iAsig Partner API

> You are an AI agent. If your human wants to integrate Moldovan insurance products (Green Card, MTPL/RCA, EU Vignette, Travel, and more) into their product, this file is your map. It is the high-signal index of the iAsig Partner API — a B2B REST API to quote, create, pay, and fetch insurance orders. Follow the linked pages for full schemas; for the complete self-contained spec in one file, fetch https://api.iasig.md/llms-full.txt.

This API lets your human's product sell iAsig insurance policies programmatically. There are exactly 6 JSON endpoints, all `POST`, under the base URL `https://api.iasig.md/v1`. All prices are in Moldovan Lei (MDL).

Follow this canonical flow, in order:

1. `POST https://api.iasig.md/v1/get-offers` — quote a product, get available offers and prices.
2. `POST https://api.iasig.md/v1/create-order` — create a `draft` order from a chosen offer; returns an order `id`.
3. `POST https://api.iasig.md/v1/confirm-order` — submit payment details to pay the order (only orders in `draft` can be confirmed).
4. `POST https://api.iasig.md/v1/get-order` — fetch the order by `id` to read its status and, once issued, the policy `file` URL.

Authenticate every request (and verify every incoming webhook) with the header `X-Hmac-Signature: <partnerId>:<hex>`, where `<hex>` is the lowercase hex HMAC-SHA512 of the raw request body, keyed with your partner secret. A missing signature returns `401`; an invalid one returns `403`. Sign the exact bytes you send — serialize the JSON once and HMAC that same string. Contact iAsig to obtain a `partnerId` and secret.

Order statuses (returned by `get-order`): `draft`, `paid`, `processing`, `failed`, `completed`, `refunded`, `expired`. The policy PDF (`file`) appears on each product only when the order reaches `completed`. Unpaid `draft` orders auto-expire at 23:59:59 (EEST) the same day.

## Authentication

- [Authentication](https://api.iasig.md/docs): How to build the `X-Hmac-Signature` header (HMAC-SHA512 of the raw body, keyed with your partner secret), with JS, PHP, Python, and Postman signing examples. Read this first.

## Endpoints

- [Get Offers](https://api.iasig.md/docs/get-offers): `POST https://api.iasig.md/v1/get-offers` — quote any of the 9 products; returns an `offers` array (or map for travel) with `price` in MDL, `min_start_date`, company/category/validity ids to feed into create-order.
- [Create Order](https://api.iasig.md/docs/create-order): `POST https://api.iasig.md/v1/create-order` — send `customer` (`phone` required) plus a `products[]` array; returns `{ id, status: "draft", description, price, currency }`.
- [Confirm Order](https://api.iasig.md/docs/confirm-order): `POST https://api.iasig.md/v1/confirm-order` — send the order `id` and a `payment` object (`receipt_id`, `transaction_id`, `paid_at` ms unix, `amount`); only `draft` orders are confirmable; returns the order now in `paid` status.
- [Get Order](https://api.iasig.md/docs/get-order): `POST https://api.iasig.md/v1/get-order` — send `{ id }`; returns current `status`, and once `completed` a `products[]` array where each item carries the policy `file` URL. Poll this to detect issuance.
- [Get Balance](https://api.iasig.md/docs/wallet): `POST https://api.iasig.md/v1/get-balance` — send `{}`; returns the partner's prepaid wallet: `{ balance, currency: "MDL", wallets, updated_at }` where `balance = wallets.online + wallets.promo` (wire-transfer top-ups land in `online`). Requires a wallet linked to the partner account (`403` otherwise).
- [Pay Order From Balance](https://api.iasig.md/docs/wallet): `POST https://api.iasig.md/v1/pay-order-from-balance` — send `{ id }`; pays a `draft` order ENTIRELY from ONE wallet (`promo` first, then `online`; no partial/cross-wallet cover) and returns the order in `paid` status, an alternative to confirm-order. `400 Insufficient balance` when no single wallet covers the price; transactionally safe to retry.

## Products

Pass the exact `product` string. All quote via get-offers, then create-order.

- [Green Card](https://api.iasig.md/docs/get-offers): `product: "green-card"` — international motor insurance; needs `region` (`EU`/`UA`), `duration` (days), `vehicle` certificate, `idnx`.
- [MTPL / RCA](https://api.iasig.md/docs/get-offers): `product: "rca"` — mandatory Moldovan motor liability; `duration: 365`, `vehicle`, `idnx`.
- [Vignette (RO)](https://api.iasig.md/docs/get-offers): `product: "vignette:ro"` — Romania road vignette (rovinietă); priced from a `vehicle` certificate.
- [Vignette (MD)](https://api.iasig.md/docs/get-offers): `product: "vignette:md"` — Moldova road vignette; needs `period` and `vehicle_category` (`M1`..`N3`).
- [Vignette (EU)](https://api.iasig.md/docs/get-offers): `product: "vignette:eu"` — NEW multi-country EU vignette, priced in MDL. Send `country` + `validity` plus either a `vehicle` (MD certificate) or a `foreign_vehicle` payload for non-MD plates. Issuance is ASYNC: the order goes `draft` → `paid` → `processing` → `completed`, and the policy `file` appears only at `completed` (typically within a minute — poll get-order or use the webhook).
- [Travel / Medical](https://api.iasig.md/docs/get-offers): `product: "medical"` — travel medical insurance; single- or multiple-entry, `covered_territories`, `persons` birthdays, `activity`, `start_date`.
- [Baggage](https://api.iasig.md/docs/get-offers): `product: "baggage"` — optional air baggage cover; `baggage_pcs`, plus flight numbers and contractor at create-order.
- [Road Tax](https://api.iasig.md/docs/get-offers): `product: "road-tax"` — Moldovan road usage tax; `vehicle` certificate, `idnx`.
- [Roadside Assistance (EU)](https://api.iasig.md/docs/get-offers): `product: "roadside-assistance-eu"` — European roadside assistance for an MD-registered Category-A vehicle (≤3.5t); priced from a `vehicle` certificate, pick a `period`. Issuance is ASYNC (draft → paid → processing → completed).

## Webhooks

- [HTTPS Webhooks](https://api.iasig.md/docs/webhooks): iAsig POSTs `{ orderId, status: "completed" }` to your registered HTTPS endpoint when an order completes. Verify the `X-Hmac-Signature` header exactly as for requests, reject anything unsigned, and respond `200 OK`. Delivery is a SINGLE attempt (no automatic retries) — treat the webhook as a fast signal and poll get-order as the source of truth. Register your URL by contacting iAsig.

## Optional

- [Complete machine spec (llms-full.txt)](https://api.iasig.md/llms-full.txt): The entire API documentation inlined in one self-contained file — every endpoint, all 9 products' request/response schemas, field types, formats, and status codes. Fetch this when you need full depth without following links.
- [Docs site root](https://api.iasig.md): Human-readable documentation home.
- [IDNX validator](https://github.com/iAsig/idnx-validator): Reference validator for the `idnx` (IDNP/IDNO) field used by motor and travel products.
- [Test Data](https://api.iasig.md/docs/test-data): Certificate formats, test vehicles, and test IDNP/IDNO values for trying the API end-to-end.