Anonymous Quoting

Anonymous quoting lets prospective customers explore insurance quotes without creating an account first. By removing the sign-up barrier, you reduce friction at the top of the funnel and allow customers to evaluate pricing and coverage options before committing to account creation — leading to higher engagement and conversion rates.

When to Use Anonymous Quoting

Direct-to-consumer products
Products where end-customers initiate the quoting process themselves online, without broker involvement.
Reducing sign-up friction
When you want prospects to explore pricing and coverage before committing to creating an account.

Anonymous quoting is optional and configured per product. Enabling it does not affect the standard broker-driven quoting funnel — both can coexist on the same product.

How It Works

The anonymous quoting flow has three phases: exploration, sign-in, and handoff.

Phase 1: Exploring quotes without an account

When a prospective customer opens a product's quoting funnel, a temporary session is created automatically. This session allows the customer to:

Enter their personal details
Provide information about the asset to insure
Receive and compare quotes for different coverage options

If the customer leaves the page and comes back later, they can resume exactly where they left off — as long as they have not cleared their browser cache. The data they entered is preserved even if the session token expires; in that case, a new session is issued automatically and linked to the existing data.

Phase 2: Signing in to finalize

When the customer is satisfied with a quote and wants to proceed to contract signature, they are prompted to create an account or log in to an existing one. This is the first and only point in the flow where authentication is required.

Phase 3: Handoff to authenticated account

Once the customer signs in, all information entered during the anonymous session — personal details, asset information, and the selected quote — is automatically transferred to the authenticated account. The customer then continues the standard signing flow: confirm the policy, sign documents, and set up payment.

The anonymous session is closed after the handoff and is no longer accessible.

Driving anonymous quoting through the API

Three endpoints implement the flow. The important idea is that an anonymous session is an access token: you start a session, then make the ordinary quoting calls with the token it returns, and finally transfer everything to the real account.

Start a session
```
curl -X POST 'https://api.sandbox.korint.io/anonymous-session' \
  --header 'tenant: <tenant>'
```
```
{ "sessionId": "<sessionId>", "accessToken": "<anonymous_access_token>" }
```
This call needs no credentials at all — no Authorization header, no client token. The tenant header is the only requirement, which is what lets a public funnel start a session from the browser. It is rate limited to 100 sessions per hour.
Reading configuration (GET /config, GET /config/{productId}) is unauthenticated for the same reason.
Store the sessionId where the visitor's browser will still have it on a later visit, and use the accessToken as the bearer for every quoting call you make on their behalf.
Quote under the session token
From here the calls are the ordinary ones — POST /customers, PATCH /customers/{customerId}, POST /assets, POST /policies/{policyId}/quote — and a session may also set a payment mode and collect a payment method.
Two things it may not do, both returning 403 FORBIDDEN: confirm a policy, and look a company up with GET /siren. So a company product's funnel takes a typed SIRET rather than offering a search, and confirmation waits for the hand-off. The full boundary is tabulated in What an anonymous session may do below.
Resume a returning visitor
Pass the stored sessionId back to POST /anonymous-session to get a fresh token for the same session — this is how a visitor picks up where they left off after their token has expired.
Then recover what the session already created:
```
curl 'https://api.sandbox.korint.io/anonymous-session/entities' \
  --header 'Authorization: Bearer <anonymous_access_token>' \
  --header 'tenant: <tenant>'
```
Two things to get right here.
Use the branchId this returns when you read the session's policy or its assets. A new-business policy holds its work on its own branch, so querying without that branchId reads an empty branch and looks as though the visitor's asset was never created.
And check the branch is still open before resuming into it. This listing can include branches that have been invalidated, so a visitor resumed from it alone can land in a closed draft. Cross-check with GET /policies/{policyId}/branches and require branchStatus === "BRANCH_OPEN" — see Which draft is live.

Hand over to the account

Once the visitor is signed in, call the handoff with their token and the anonymous sessionId:

curl -X POST 'https://api.sandbox.korint.io/anonymous-session/handoff' \
  --header 'Authorization: Bearer <authenticated_user_token>' \
  --header 'tenant: <tenant>' \
  --header 'Content-Type: application/json' \
  --data '{ "sessionId": "<sessionId>" }'

transferredCount reports how many relations moved across. The anonymous session is closed afterwards, so keep nothing that depends on its token.

Abandoned quotes are yours to tidy

Pricing needs a policy, so every visitor who asks for a price creates one — and most visitors abandon. A public funnel therefore accumulates created-but-never-signed policies as its normal steady state, not as a fault.

On products without automatic archiving, nothing cleans them up on your behalf. What exists to help:

GET /anonymous-session/entities lists what a session created, so a returning visitor resumes rather than starting a second contract.
POST /policies/{policyId}/branches/{branchId}/invalidate closes a draft you know is dead. It requires a reason in the body — CUSTOMER_REQUEST is the usual one for an abandoned funnel — and rejects the call with REQUEST_VALIDATION_FAILED without it.
Products with automatic archiving retire inactive quotes on their own schedule — see Archiving quotes.

Decide early which of those you rely on. A funnel that mints a fresh policy on every page refresh, and never invalidates any of them, makes the tenant's portfolio unusable long before anything technically breaks.

What an anonymous session may do

Measured against a session token:

Action	Anonymous session
Read tenant and product config	Allowed
Create customer, policy, asset	Allowed
`calculate-quote` and `quote`	Allowed
Payment mode, setup secret, payment methods	Allowed
`POST /policies/{id}/confirm`	`403 FORBIDDEN`
`GET /siren` company lookup	`403 FORBIDDEN`
`GET /users/permissions/@me`	`200`, with an empty identity

So a public funnel can take a visitor all the way to a priced, payable contract, but confirmation and company search need a different actor — which is what the hand-off above exists for.

That last row breaks the obvious way to ask "is this visitor signed in?". @me does not fail for an anonymous session — it answers 200 with a syntactically valid but semantically empty identity: no brokerageFirmId, no brokerRole, email: "". Branch on a field in the body, not on the status code, or you will render a signed-in interface for a visitor who has no firm and no way forward.

The status codes around it are not uniform, so do not branch on the status alone. A malformed, expired or wrong-tenant token is always 401 INVALID_CREDENTIALS. A request carrying no token at all is not rejected by the authentication step — it is marked unauthenticated and passed on — so it answers 401 MUST_BE_AUTHENTICATED on @me and the handful of other endpoints that skip record-level permission checks, and 403 FORBIDDEN on the rest of the API, where the permission check is what turns it away. So 403 does not distinguish "not signed in" from "signed in but not allowed here", while the two 401 codes do tell you whether a token was rejected or never sent.

Embedding the hosted funnel

The hosted anonymous funnel can be embedded in an <iframe> on your own page. The funnel owns the session, the quoting calls and the sign-in handoff. Your page owns the iframe and its height: an iframe does not size itself to its content, so the funnel reports its content height to the parent page and the parent applies it.

Get the embed values
Ask the Korint operations team for three values: the funnel host, your brokerageFirmId, and the product's funnel path. They come from the product configuration.
Each product that supports embedding exposes an embedded entry path alongside its standalone one — /anonymous-embedded/... instead of /anonymous/....

Add the iframe

<iframe
  id="korint-funnel"
  src="https://<funnel-host>/anonymous-embedded/<brokerageFirmId>/<funnel-path>"
  style="width: 100%; border: 0"
  title="Devis en ligne"
></iframe>

Listen for the height message

The funnel posts this message to the parent window once on load, and again on every content-height change — both increases and decreases:

{ "type": "korint:embedded-funnel-resize", "height": 1284 }

Field	Value
`type`	Always `korint:embedded-funnel-resize`
`height`	Content height in CSS pixels

The message is posted to any parent origin, so the listener filters on event.origin — and on event.source when the page embeds more than one iframe.

<script>
  const funnel = document.getElementById('korint-funnel');

  window.addEventListener('message', event => {
    if (event.origin !== 'https://<funnel-host>') return;
    if (event.source !== funnel.contentWindow) return;
    if (event.data?.type !== 'korint:embedded-funnel-resize') return;

    funnel.style.height = `${event.data.height}px`;
  });
</script>

Apply each reported height as-is
Assign event.data.height to the iframe height on every message, without a safety margin and without retaining the largest value received.

The funnel does not implement the iframe-resizer protocol: it ships no child-side companion script, and a parent-side iframeResizer() call receives nothing from it. The message listener above is the supported integration.

Enabling Anonymous Quoting

Anonymous quoting requires configuration at the product level. The following elements are set up by the Korint team:

Anonymous role: A dedicated set of permissions is created for anonymous users. This role allows them to enter customer and asset information, view and compare quotes, and manage payment details. It prevents them from signing contracts or stopping policies — those actions require a full authenticated account.
Anonymous funnel: The product's quoting funnel is configured with an anonymous entry path, allowing customers to start the process without logging in.
Redirect rules: When the anonymous user reaches the finalization step, the platform automatically redirects them to the sign-in or account creation screen.

The Korint operations team handles all configuration. To enable anonymous quoting for your product, contact the operations team with your product details and requirements.

Security and Limitations

Rate limiting

To prevent abuse, the platform limits the number of anonymous sessions that can be created from a single source within a given time period. This protects against automated misuse without affecting legitimate customers.

Restricted permissions

Anonymous users can only perform quoting-related actions: entering customer and asset information, viewing quotes, and managing payment details. They cannot sign contracts, stop policies, or access other customers' data. Full platform access is granted only after authentication.

Frequently Asked Questions

Can the customer resume an anonymous session later?

Yes. The session is stored in the customer's browser cache, so they can return to the quoting funnel and pick up where they left off. If the session token has expired, a new one is issued automatically and the customer's data is preserved. However, if the customer clears their browser cache or uses a different browser or device, the session cannot be recovered and they need to start over.

Can anonymous quoting coexist with the standard broker funnel?

Yes. Anonymous quoting is an additional entry point for end-customers. The standard authenticated funnel used by brokers remains fully available and unaffected.

Which products currently support anonymous quoting?

Anonymous quoting is enabled per product. Contact the Korint operations team to check availability for your products or to request enablement.

Signing New Business
The standard new business flow that anonymous quoting extends.
Quotes
How quotes are generated, structured, and priced.
Permissions
Role-based access control and how permissions are assigned.
Signatures
The document signing process that follows quote acceptance.

When to Use Anonymous Quoting​

How It Works​

Phase 1: Exploring quotes without an account​

Phase 2: Signing in to finalize​

Phase 3: Handoff to authenticated account​

Driving anonymous quoting through the API​

Abandoned quotes are yours to tidy​

What an anonymous session may do​

Embedding the hosted funnel​

Enabling Anonymous Quoting​

Security and Limitations​

Frequently Asked Questions​

Related Pages​