Postman collection
The end-to-end flow from the integration guide, §6 as ready-to-run requests (token, entitlements, case, documents, quote, assessment, decision and report), plus one request for every other operation of the API.
Postman Collection format v2.1 (JSON). Generated from the same OpenAPI document the API publishes, so the two always match. It is regenerated with every change to the API, and each change is listed in the changelog.
Import and configure
- In Postman, choose Import and select the downloaded file.
- Create an environment (for example “WALT sandbox”) and add
clientIdandclientSecretfrom your onboarding email. SetclientSecretto the secret type, or keep it in Postman Vault. - Add
baseUrlto the environment, set to the base URL your onboarding email gives. The collection defaults to the intended sandbox host. - Select the environment and run the requests in the End-to-end flow folder from top to bottom.
- The API reference (every operation) folder has one request per endpoint, grouped like the API reference. Its bodies are minimal examples (required fields only).
Keep secrets out of the collection. Never paste credentials into collection variables, never share a workspace that holds a production secret, and never use sandbox credentials in production or the reverse. Use synthetic data only in the sandbox.
Variables
| Variable | Default | Purpose |
|---|---|---|
baseUrl | https://dev-api.underwritinguk.ai/v1 | The intended sandbox host; set the base URL from your onboarding email in your environment. Production (by arrangement) is https://api.underwritinguk.ai/v1. |
clientId | empty | OAuth client ID — set it in your environment. |
clientSecret | empty | OAuth client secret — set it in your environment as a secret. |
scope | empty | Optional, space-separated scopes. Empty requests every scope granted to the credential. |
personaSurname | Approve | Sandbox test persona that picks the outcome: Approve, Conditions, Refer, Decline, Sanctions, Pep, Idvpending, Idvfail, Outage, Slow. |
accessToken, accessTokenExpiresAt | managed | Set by the collection pre-request script. |
externalRef, caseId, assessmentId | managed | Set by the request scripts so each step feeds the next. |
individualId, companyId, propertyId, transcriptId, documentId, endpointId | empty | Path parameters of the reference requests. Copy them from an earlier response. |
How authentication works
A collection-level pre-request script requests an OAuth 2.0 client-credentials token from {{baseUrl}}/oauth/token with HTTP Basic authentication, stores it, and reuses it until about 60 seconds before it expires — as the guide asks, it does not request a token per call. Every request then sends Authorization: Bearer ….
Create requests send a fresh Idempotency-Key each time you press Send. In your connector, generate one key per logical operation and reuse it on retries.
Prefer OpenAPI?
Postman can also import the OpenAPI 3.1 document directly. That collection has the same endpoints but not the token script or the flow ordering.