50
Travellers per quote
You can price 1 to 50 people in a single call. Past ten travellers the group product takes over: the same price per person, whatever their age.
Developer platform
The API to sell travel insurance inside your product
A signed conversion API, tracked deep links and an S2S postback into your stack. Free to integrate and free per call: you are paid on commission.
What sits behind the API
The catalogue
193
Countries of residence
The traveller gets priced whatever country they set out from.
193
Destinations
Every destination, high-risk areas included.
26
Languages
Journey, documents and summary in the traveller's own language.
33
Currencies
The price shows in the traveller's own currency.
28
Cover types
Health, assistance, trip, belongings, liability, activities, expat. Ceilings and deductibles in the response.
What you do not have to build
Three things you will never build
No licence to hold
HelloSafe is the regulated distributor and carries the compliance. You embed the experience, not the regulation.
No per-insurer integration
One call, the whole catalogue. The connections, the product updates and the policy documents stay with us.
No salesperson to call
The sandbox key is one click from your account. No review, no card, no meeting.
Integration paths
Five ways to wire up HelloSafe
From a tracked link in an afternoon to a REST quote API: pick your level of integration. Same cover, same commissions.
Tracked deep links
One tracked link per piece of content or campaign, with a Sub-ID. The fastest way to start, zero code.
- Deep links per page and per offer
- Sub-ID per campaign, content or point of sale
- 90-day attribution cookie, last-click
Conversion postback API
Notify Atlas when an attributed sale lands or changes state. HMAC-signed request, state machine, idempotent.
- Per-caller signed keys (HMAC-SHA256)
- States: pending, validated, cancelled
- Native amount: commission is computed server-side
S2S postback to your stack
Send conversions back to wherever you run your business: Impact, Partnerize, Awin, Voluum, RedTrack, Everflow or a BI webhook.
- Standard S2S connectors
- Webhook to your BI
- CSV export
Pricing REST API
Price a trip across insurers, mint the tracked sale link, and read what a traveller's card leaves uncovered. One key for all of it. Create an account and the sandbox key is one click away.
- Real-time multi-insurer quotes
- Tracked sale link, attribution baked in
- Public documentation and OpenAPI spec
MCP server for AI agents
Expose HelloSafe as typed tools your LLM can call: search, compare, hand over the tracked link. In private beta.
- Typed tools for Claude, ChatGPT and custom agents
- Answers grounded in live data
- Agentic checkout
Documentation
Read before you build
The docs are public and in English. No login, no form: everything the API answers is written down.
Quickstart
Sandbox key, signed request, first priced offers. Node, cURL and PHP.
Quickstart →API reference
Endpoints, trip fields, cover slugs, error codes and quotas.
API reference →OpenAPI spec
The machine readable contract, for your client generator.
OpenAPI spec →API status
Live check of the API, availability commitments and incident log.
API status →The conversion API, concretely
From postback to commission, in one signed request
The conversion API is live today. You post an attributed sale, Atlas matches it to the link, converts to EUR (our accounting currency) and computes the commission from your rate card.
- 01
Provision a key
During the launch phase, keys are granted on request. You get a key_id and a signing secret scoped to your integration.
- 02
Sign the request
Compute HMAC-SHA256 of the secret over timestamp.body, then send the x-atlas-key-id, x-atlas-timestamp and x-atlas-signature headers. The replay window is 5 minutes.
- 03
Post the conversion
Send ref and externalOrderId, plus the gross amount in its native currency and the state. Atlas freezes the FX rate, computes the commission and returns the applied state.
postback.js
import { createHmac } from "node:crypto";
const secret = process.env.ATLAS_SIGNING_SECRET;
const body = JSON.stringify({
ref: "hs-acme-7f3k9",
externalOrderId: "ORDER-5821",
amount: 79.90,
currency: "GBP",
status: "validated"
});
const ts = Math.floor(Date.now() / 1000).toString();
const signature = "v1=" + createHmac("sha256", secret)
.update(`${ts}.${body}`)
.digest("hex");
await fetch("https://atlas.hellosafe.com/api/postback/conversion", {
method: "POST",
headers: {
"Content-Type": "application/json",
"x-atlas-key-id": "pbk_live_a1b2c3",
"x-atlas-timestamp": ts,
"x-atlas-signature": signature
},
body
});
// → 200 { ok: true, action: "inserted", status: "validated" }Postback signed with HMAC-SHA256. A 200 returns the applied action and state.
Payload reference
The request body
JSON. ref and externalOrderId are required; everything else is optional. Any commission you send is ignored, the ledger is the source of truth.
| Field | Type | Required | Description |
|---|---|---|---|
ref | string | Yes | Attribution identifier, in the partnerCode-shortCode format. |
externalOrderId | string | Yes | Your order identifier. Acts as the idempotency key on the Atlas side. |
amount | number | No | Gross sale amount, in its native currency. |
currency | string (3) | No | ISO 4217 code. An unknown currency is stored needs_fx and priced later. |
status | enum | No | pending, validated or cancelled. Defaults to pending. |
subId | string | No | Campaign or content sub-identifier, for your reporting. |
Response codes
What the API returns
Explicit HTTP codes. Forbidden state transitions are never silently applied.
| Code | Meaning |
|---|---|
200 | Conversion recorded. action: inserted, updated, transitioned or unchanged. |
400 | Missing fields, invalid ref, or a ref that does not match the link owner. |
401 | Invalid signature, key or timestamp (5-minute window). |
404 | No link found for this ref. |
409 | Forbidden state transition: the state machine refuses it. |
422 | Amount above the per-conversion safety ceiling. |
Authentication & security
Signed, scoped, auditable
Every caller has its own key and its own secret. Nothing is shared, everything is revocable.
Per-caller keys
A distinct key_id and signing secret per integration. Revoke one without touching the others.
HMAC-SHA256 signature
The signature covers timestamp.body byte for byte. Any tampering with the body invalidates the request.
Replay protection
Requests whose timestamp is more than 5 minutes off are rejected. No replaying a captured request.
Idempotent state machine
pending to validated or cancelled; validated to cancelled only; cancelled is terminal. Re-sending the same state is a no-op.
Reliability & support
Built to stay up, answered by people
The conversion API and tracked links run on Cloudflare's edge network. Here is what you can plan around for uptime, retries and support.
99.9%
Target uptime
Postbacks and tracked links run on Cloudflare Workers with automatic failover. No single region can take the service down.
300+
Edge locations
Requests are served from the Cloudflare point of presence nearest your users; commission and FX are then computed asynchronously, off your checkout's critical path.
< 24h
Support response
Email support answers within one business day, on business days. Integration questions reach the partner engineering team, not an anonymous queue.
5 min
Safe retry window
Idempotent by externalOrderId: retry on any timeout without double-counting, and a captured request cannot be replayed past five minutes.
The status page is public: a live check of the API, what we commit to, and every incident since the API opened. Your integration and incident contact stays the partner team, reachable from the contact page. API status →
AI agents
Your agent calls a tool, HelloSafe returns a real price
The MCP server exposes pricing, comparison and the card check as typed tools. Access on request.
MCP server
No per-insurer integration, no quoting logic to write, no regulatory plumbing. Your copilot, your chatbot or your booking flow calls a tool and gets a real offer back, with its ceilings and its documents. Tell us what you are building.
Technical questions
What teams ask before they integrate.
What does the API cost?
Nothing. There is no setup fee, no monthly platform fee and no per-call charge on the conversion API or deep links. You earn 50% of commissions on sales your integration drives; that is the only money flow in the programme.
Is there a REST quote API?
Both are live. The conversion (postback) API and the pricing REST API: create an account and mint a sandbox key in one click, then apply for production once your integration runs.
How does authentication work?
Per-caller signed keys. You compute HMAC-SHA256 of the secret over timestamp.body and send it in x-atlas-signature, with a 5-minute replay window. A legacy Bearer path exists while existing callers migrate.
Which currency should I send the amount in?
The gross amount in its native currency, with the currency code (GBP for UK sales). Atlas freezes the rate at ingest, converts to EUR (our internal accounting currency) and computes the commission from your rate card. Any commission you send is ignored.
Is the postback idempotent?
Yes. externalOrderId is the key: re-sending the same state is a no-op, and the state machine refuses forbidden transitions with a 409 rather than applying them silently.
Can I integrate through Impact, Partnerize or Awin?
Yes. We expose a standard S2S postback that connects natively to Impact, Partnerize, Awin, Voluum, RedTrack and Everflow, or a webhook to your BI.
Do you have an OpenAPI spec?
Yes, published at /openapi.json, OpenAPI 3.1, with the full reference at /platform/api/documentation. The conversion API is documented by its contract above: endpoint, signed headers, payload and response codes.
Do you support MCP?
Yes, in private beta. The MCP server exposes quoting, comparison and binding as typed tools your LLM or agent can call.
What uptime and support can I count on?
The conversion API and tracked links run on Cloudflare Workers, deployed across 300+ edge locations with automatic failover, for a target of 99.9% uptime. Email support answers within one business day. The postback is idempotent, so any timeout is safe to retry. A public status page is on the roadmap.
Do I need a second key for the Coach?
No. One key opens every endpoint: pricing, tracked links and the Coach briefing. The sandbox key you mint from the dashboard carries all three scopes, so you can try the whole API before talking to anyone.
Have a technical or commercial question? Contact us
Let's build
Add travel insurance to your product
Create your account and mint a sandbox key in one click: fixed sample data, no insurer called, nothing to sign. Live access is a short review once your integration runs.