Authentication

The API authenticates with bearer tokens. Send the token in the
Authorization header on every request:

curl https://zyins.isaapi.com/v3/prequalify \
  -H "Authorization: Bearer $ISA_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d @prequalify.json

That's it. The SDKs read the same token from ISA_TOKEN by default.

Test vs live

Issue both from the dashboard. Use isa_test_* for integration; switch the
variable to isa_live_* when you're ready to ship. See
Test mode for what stays simulated.

Getting a token

Keys are self-service in the dashboard at app.isaapi.com/settings/api-keys: sign up, accept the API agreement, and issue a key. An isa_test_ key is free and runs against the sandbox; an isa_live_ key unlocks real underwriting once the $950/year subscription starts (30-day free trial).

The dashboard handles the full key lifecycle — issue, rotate (with an optional 1h, 24h, or 72h grace period), and revoke. Revocation takes effect within 60 seconds.

For custom procurement or high-volume accounts, email [email protected] (one-business-day turnaround).

Rotation

Rotate keys from the dashboard: API Keys → Rotate. The old key can keep working for an optional grace period — 1 hour, 24 hours, or 72 hours — so deploys don't break before it is revoked. Rotating with no grace period revokes the old key right away; revocation takes effect within 60 seconds.

Treat tokens like passwords. Store them in your secrets manager. Never commit them to source control or put them in URLs.

Leaked token? Revoke the key from the dashboard right away — revocation takes effect within 60 seconds — and email [email protected] quoting the request_id from a recent response.

Constructors

Every SDK exposes the same factory. Pass your bearer token and the SDK
handles transport, idempotency, and retries:

import { Isa } from "isa-sdk";

// Bearer token — reads ISA_TOKEN from the environment.
const isa = await Isa.withBearer();

// Pass the token explicitly when it is not in the environment.
const isaExplicit = await Isa.withBearer({ token: process.env.MY_ISA_TOKEN });

from isa_sdk import Isa

# Bearer — reads ISA_TOKEN from the environment.
isa = Isa.with_bearer()

# Explicit token.
isa = Isa.with_bearer("isa_test_aaaaaaaaaaaaaaaaaaaa")

import sdk "github.com/isa-sdk/sdk"

// Bearer — reads ISA_TOKEN from the environment.
isa, err := sdk.WithBearer("")

// Explicit token.
isa, err := sdk.WithBearer("isa_test_aaaaaaaaaaaaaaaaaaaa")

using Isa.Sdk;

// Bearer — reads ISA_TOKEN from the environment.
var fromEnv = IsaClient.WithBearer();

// Explicit token.
var explicitToken = IsaClient.WithBearer("isa_test_aaaaaaaaaaaaaaaaaaaa");

use Isa\Sdk\Isa;

// Bearer — reads ISA_TOKEN from the environment.
$isa = Isa::withBearer();

// Explicit token.
$isa = Isa::withBearer('isa_test_aaaaaaaaaaaaaaaaaaaa');

apiVersion pinning

The apiVersion map is optional for most consumers. Use it to pin specific
surfaces to a particular wire version — useful during staged rollouts:

import { Isa } from "isa-sdk";

// Pin prequalify to v3 explicitly (the SDK's bundled default for current releases).
const isa = await Isa.withBearer(undefined, undefined, {
  apiVersion: { prequalify: "v3" },
});

Resolution at call time is:

effectiveVersion = apiVersion[surface] ?? BundledApiVersions[surface]

Omit the map entirely to use the SDK release's bundled defaults for every
surface. BundledApiVersions is an exported constant you can inspect at
build time:

import { BundledApiVersions } from "isa-sdk";
// { prequalify: 'v3', quote: 'v3', datasets: 'v3', cases: 'v1', ... }

What goes wrong

See Errors for the full code catalog.