The Brella API.
A small, public REST API over the parts of Brella that are public: the health board, the blog, and the two intake forms. Described by an OpenAPI document, no key required to read.
https://www.brellapartners.com
Everything is under /api. Responses are JSON, UTF-8. There is no sandbox environment and no API key: the endpoints listed below are open, and the ones that are not are behind a Brella OS account.
Two of them — POST /api/quotes and POST /api/analysis — file a real enquiry that a person reads and replies to. Call them when somebody means to contact the brokerage, not to check that they work.
curl https://www.brellapartners.com/api/status
Or read the whole surface at once:
curl https://www.brellapartners.com/api/openapi.json
Eight of them, and no key for any.
| METHOD | PATH | WHAT IT DOES |
|---|---|---|
GET | /api/openapi.json | This API, as an OpenAPI 3.0 document. |
GET | /api/health | Liveness and database reachability. |
GET | /api/status | Per-service health board and recent history. |
GET | /api/blogs | Every published post, with its markdown body. |
GET | /api/blogs/{slug} | One published post. |
POST | /api/blogs/{slug}/view | Record that a post was read. |
POST | /api/quotes | Submit a request for commercial insurance quotes. |
POST | /api/analysis | Request a review of an existing program. |
Bearer tokens, for accounts we issue.
The public endpoints need nothing. Everything else belongs to Brella OS — the workspace an agency runs its book in — and needs a bearer token from POST /api/admin/login. Accounts are provisioned to an agency; there is no public sign-up, so there is no self-serve key to issue yourself.
Authorization: Bearer <token>
Tokens are HMAC-signed, carry the caller’s role and organisation, and last 12 hours. Every read is scoped server-side from the token — an organisation cannot be named in a request.
One shape, every failure.
Every 4xx and 5xx returns the same object. Branch on code; show error. The sentence gets reworded, the code does not.
{
"ok": false,
"code": "not_found",
"error": "No published post at that slug."
}The codes are enumerated in the OpenAPI document under the Error schema, and every failure response in it points at that schema.
A date, not a major number.
The current version is 2026-08-22, returned on every response:
X-Brella-API-Version: 2026-08-22
Breaking changes get a new version date. Additive changes — a new field, a new endpoint, a new optional parameter — do not, so clients must ignore fields they do not recognise. When a version is being retired, every response from it carries the RFC 8594 `Deprecation` header with the date the decision was taken, and a `Sunset` header with the date it stops working. Neither header is present on a version that is not deprecated — which is why its absence is the signal that a version is live.
120 requests a minute, and we tell you where you are.
Public endpoints allow 120 requests per 60 seconds per IP. Every response says how much of that is left, so a client can pace itself rather than discover the limit by hitting it.
RateLimit-Limit: 120 RateLimit-Remaining: 119 RateLimit-Reset: 60 RateLimit: limit=120, remaining=119, reset=60
Over the limit returns 429 with Retry-After in seconds.
Five files that describe this site.
The OpenAPI 3.0 description. Every operation has a unique operationId, a description and typed response schemas, so it converts cleanly to function-calling tool definitions.
The same document, rendered. Useful for reading and for trying a call by hand.
What this site is, what Brella does, and when an agent should reach for it. Start here.
Every public page. Generated from the same route list the pages are built from.
Live availability, as a page. The same data as /api/status.
Any page, as markdown
Every public page on this site has a markdown representation at the same URL. Ask for it with an Accept header and you get the document without the navigation, the footer or the markup:
curl -H "Accept: text/markdown" https://www.brellapartners.com/coverage
q-values are honoured, the responses carry Vary: Accept, and a request that accepts neither text/html nor text/markdown gets a 406. Pages that are generated per-request — the blog posts — have no markdown twin and return the HTML.
Worth saying, so nothing goes looking.
- There is no CLI. Nothing is published to npm, PyPI or Homebrew under the Brella name — if you find something that is, it is not ours.
- There are no webhooks. Nothing calls you back; the public endpoints are request/response only.
- There is no MCP server.
- There is no public write API beyond the two intake endpoints above, and no public read access to policy, certificate or claim data. That lives behind a Brella OS account, which is issued to an agency rather than signed up for.
Building something against this, or need an endpoint that is not here? hello@brellapartners.com