- New On Hold status for cases and policies, for loans that should be paused rather than closed. Place a case on hold with POST /rest/cases/:id/on-hold and release it with POST /rest/cases/:id/release-hold. Putting a case on hold also puts every policy on that case on hold, except policies that are already deactivated — those are left as they are. Releasing returns the case to the status it held before the hold, so an approved case comes back approved. Policies are not released alongside the case: release each one with POST /rest/policies/:id/release-hold, which lets you resume some policies while others stay paused. An individual policy can also be paused on its own with POST /rest/policies/:id/on-hold, which does not change its case’s status. While a policy is on hold, automated renewal follow-up stops for it and picks up where it left off once released. Cases and policies stay fully visible and editable throughout, so coverage can still be reviewed and kept up to date. Case and policy status fields can now return onHold, and GET /rest/cases accepts onHold in its status filter.
- Policy responses (GET /rest/policies, GET /rest/policies/:id, POST /rest/policies, PATCH /rest/policies/:id) now include displayName — the policy’s insurance product name as shown in the Advocate app. Use this field instead of productType, which is now deprecated: it only carries a value for policies on the legacy program model and is always null for policies on the new coverage model. For legacy policies displayName returns the same name productType did, so a single field covers both.
- Feedback recipients (insuranceContacts) are no longer required on POST /rest/policies, PATCH /rest/policies/:id, or POST /rest/policies/:id/new-term. Requests may now omit recipients or send an empty list; previously these could be rejected with a validation error.
- All REST endpoints now require the API access entitlement. Requests authenticated with an API key belonging to an organization whose plan does not include API access are rejected with 403 Forbidden. Contact your account team if your integration begins returning 403.
- Coverage Framework (risk-profile-backed) policies created or updated via the REST API now default their coverage form type to “Unknown” when it has not been set. Legacy program-backed policies are unaffected. This does not change the request or response shape.
- All /rest/risk-profiles endpoints now require the organization’s plan to include risk profile management. Requests from organizations whose plan does not include it receive 403 Forbidden.
- Policies can now have a “renewalInProgress” status, used to track policies whose renewal is being worked. Policy responses may return this new status value, and renewal notice scheduling treats these policies the same as active ones.
- Speed up GET /rest/policy-versions and GET /rest/policy-versions/:id. Carrier and peril details are now resolved only for the page of results being returned, and the total count no longer performs that extra work, so responses stay within the expected time even for lenders with many policy versions.
- Add GET /rest/risk-profiles and GET /rest/risk-profiles/:id to list and retrieve risk profiles. Each risk profile includes its name, description, version, type, protection score, linked asset types and certificate holders, and an isPublished flag (with publishedAt). Supports pagination and the standard id/metadata/date filters.
- Fix the perils breakdown returned for policies on cases using the Coverage Framework — policy and policy-version responses now correctly populate perilsByAsset instead of an empty or incorrect breakdown.
- Add an applied flag to each peril in policy and policy-version responses, indicating whether the peril was evidenced on the policy.
- POST /rest/policies now rejects policy creation on a Coverage Framework (risk-profile-backed) case while that case is still in DRAFT — the case must be published (OPEN or ONBOARDING) first. Policies on legacy program-backed cases can still be created in DRAFT.
- POST /rest/policies and POST /rest/policies/:id/new-term now return 422 when a coverage type or peril ID does not exist or is not applicable for the case. Previously such IDs were silently dropped from the saved policy.
- POST /rest/policies/:id/new-term now requires startDate and endDate — requests missing either field are rejected with a 422 validation error.
- Add POST /rest/policies/:id/new-term to create a new term on an existing policy. Returns the updated policy.
- Policy responses no longer fail for Coverage Framework (risk-profile-backed) policies that have no product type — productType is now returned as null instead of causing an error.
- Add POST /rest/policies/:id/deactivate and POST /rest/policies/:id/reactivate to deactivate and reactivate a policy. Each returns the updated policy.
- Add GET /rest/coverage-types to list coverage types, returning each type’s name, key, and coverage group, with pagination and filtering.
- Add GET /rest/perils to list perils, returning each peril’s name, key, and the coverage types it belongs to, with pagination and filtering.
- POST /rest/cases now accepts a riskProfile field for Coverage Framework cases, and program becomes optional. A case must reference either a program or a risk profile (never both or neither); otherwise the request is rejected with a 422 error.
- POST /rest/policies now supports Coverage Framework cases via new coverageLayer, coverageTypes, and perils fields, with productType becoming optional. The payload is validated against the case type: risk-profile-backed cases require the Coverage Framework fields and reject productType, while program-backed cases require productType and reject the Coverage Framework fields. Mismatches return a 422 error.
- POST /rest/cases and PATCH /rest/cases now return a specific error when an insurance contact ID (in insuranceContacts or insuranceContactsCC) does not exist or does not belong to your lender, instead of failing generically.
- Fix a 500 error on GET /rest/assets/:id/fields when fetching an asset’s required fields — the endpoint now returns the required-field list correctly.
- Fix POST /rest/documents/sign-urls returning 500 when fileName is missing — now returns 422 with field error
- Fix PATCH /rest/cases/:id returning 500 for non-existent case — now returns 404
- Fix PATCH /rest/assets/:id returning 500 on metadata-only updates — fields are no longer overwritten with undefined
- Add createdAt field to GET /rest/users response
- Make managementType optional on case creation — defaults to advocateManaged when omitted
- Optimize GET /rest/assets/:id/fields response time
- Expose managementType field in case response (advocateManaged or selfManaged)
- Auto-cancel open tasks when managementType changes via PATCH /rest/cases/:id
- Add certificate holder clause management to risk profiles
- Optimize GET /rest/policies and /rest/policy-versions response times
- Fix GET /rest/brokers returning 500 instead of paginated results
- Fix 422 error on asset POST/PATCH when address fields are included
- Add tangible/nonTangible classification to asset types
- Validate fieldType IDs on asset creation — returns 422 with specific error instead of 500
- Validate mortgagee clause and asset type IDs on creation — returns 422 instead of 500
- Fix UpsertFieldDto crash when invalid data types are sent for asset fields