Insurtech Embedded E-Signatures: Commercial BOP & Policy Automation (2026)

import axios from "axios";

interface InsuredEntity {
  legalBusinessName: string;
  dbaName?: string;
  ein: string;
  mailingAddress: string;
  contactName: string;
  contactEmail: string;
  naicsCode: string;
}

interface BOPCoverageQuote {
  quoteId: string;
  carrierName: string;
  effectiveDate: string;
  expirationDate: string;
  generalLiabilityLimit: string;
  propertyLimit: string;
  deductible: string;
  annualPremium: number;
  triaAccepted: boolean;
}

export async function createCommercialBOPBinderSession(
  insured: InsuredEntity,
  quote: BOPCoverageQuote
): Promise<{ documentId: string; signingUrl: string }> {
  // Construct dynamic Markdown for the Commercial BOP Binder & Disclosure
  const binderMarkdown = `
# COMMERCIAL BUSINESS OWNER'S POLICY (BOP) BINDER
**Binder Number:** BND-${quote.quoteId}  
**Issuing Carrier:** ${quote.carrierName}  
**Effective Date:** ${quote.effectiveDate} | **Expiration Date:** ${quote.expirationDate}

---

### SECTION I: NAMED INSURED & LOCATION
- **Named Insured:** ${insured.legalBusinessName} ${insured.dbaName ? `(${insured.dbaName})` : ""}
- **EIN / Tax ID:** ${insured.ein}
- **Mailing Address:** ${insured.mailingAddress}
- **Industry NAICS:** ${insured.naicsCode}

---

### SECTION II: SCHEDULE OF COVERAGES & LIMITS
| Coverage Type | Limit of Insurance | Deductible |
| :--- | :--- | :--- |
| **Commercial General Liability** | ${quote.generalLiabilityLimit} | $0 per occurrence |
| **Commercial Property & Contents** | ${quote.propertyLimit} | ${quote.deductible} |
| **Business Income & Extra Expense** | Actual Loss Sustained (12 Mo) | 72-Hour Waiting Period |
| **Terrorism Risk Insurance (TRIA)** | ${quote.triaAccepted ? "ACCEPTED" : "REJECTED"} | Included |

**Total Annual Premium:** $${quote.annualPremium.toLocaleString("en-US", { minimumFractionDigits: 2 })}

---

### SECTION III: MANDATORY STATUTORY NOTICES & FRAUD WARNINGS
*Any person who knowingly and with intent to defraud any insurance company or other person files an application for insurance or statement of claim containing any materially false information, or conceals for the purpose of misleading, information concerning any fact material thereto, commits a fraudulent insurance act.*

---

### SECTION IV: BINDING CONFIRMATION & APPLICANT ACCEPTANCE
By signing below, the authorized representative acknowledges:
1. Consent to electronic transactions pursuant to the ESIGN Act and state insurance statutes.
2. Accuracy of operational classification and underwriting warranty questions.
3. Authority to bind commercial coverage on behalf of **${insured.legalBusinessName}**.

{{signature:insured}}
**Authorized Signature:** ${insured.contactName}  
**Date:** {{date:insured}}
`;

  // Dispatch to Signbee REST API
  const response = await axios.post(
    "https://api.signb.ee/v1/documents",
    {
      title: `Commercial Insurance Binder - ${insured.legalBusinessName} (${quote.quoteId})`,
      content: binderMarkdown,
      signers: [
        {
          id: "insured",
          name: insured.contactName,
          email: insured.contactEmail,
          role: "Named Insured Representative",
        },
      ],
      metadata: {
        quote_id: quote.quoteId,
        policy_type: "COMMERCIAL_BOP",
        carrier: quote.carrierName,
        ein: insured.ein,
      },
      settings: {
        embedded: true,
        redirect_url: `https://app.insurtech-platform.com/policies/${quote.quoteId}/processing`,
        require_tamper_proof_audit: true,
      },
    },
    {
      headers: {
        Authorization: `Bearer ${process.env.SIGNBEE_API_KEY}`,
        "Content-Type": "application/json",
      },
    }
  );

  return {
    documentId: response.data.id,
    signingUrl: response.data.signers[0].embedded_signing_url,
  };
}

import hmac
import hashlib
import os
import httpx
from fastapi import FastAPI, Request, HTTPException, Header, status
from pydantic import BaseModel

app = FastAPI(title="Insurtech Policy Bind Webhook Service")

SIGNBEE_WEBHOOK_SECRET = os.getenv("SIGNBEE_WEBHOOK_SECRET", "").encode("utf-8")

def verify_signbee_signature(payload: bytes, header_signature: str) -> bool:
    """Verifies that the incoming webhook payload was generated by Signbee."""
    expected_signature = hmac.new(
        SIGNBEE_WEBHOOK_SECRET,
        msg=payload,
        digestmod=hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected_signature, header_signature)

@app.post("/webhooks/signbee-policy-bind", status_code=status.HTTP_200_OK)
async def handle_policy_binder_completion(
    request: Request,
    x_signbee_signature: str = Header(...)
):
    raw_body = await request.body()

    # 1. Cryptographic Webhook Authentication
    if not verify_signbee_signature(raw_body, x_signbee_signature):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid HMAC signature."
        )

    event = await request.json()
    event_type = event.get("event")

    if event_type != "document.completed":
        return {"status": "ignored", "reason": f"Unhandled event {event_type}"}

    data = event.get("data", {})
    document_id = data.get("id")
    metadata = data.get("metadata", {})
    quote_id = metadata.get("quote_id")
    signed_pdf_url = data.get("download_url")
    audit_trail = data.get("audit_trail", {})
    sha256_checksum = data.get("sha256_checksum")

    # 2. Download and persist certified PDF to tamper-proof S3/WORM storage
    async with httpx.AsyncClient() as client:
        pdf_response = await client.get(signed_pdf_url)
        if pdf_response.status_code == 200:
            pdf_bytes = pdf_response.content
            
            # Verify file integrity matches the webhook checksum
            computed_hash = hashlib.sha256(pdf_bytes).hexdigest()
            if computed_hash != sha256_checksum:
                raise HTTPException(status_code=400, detail="Checksum mismatch on policy PDF")

            # Store to Cloud Storage & update Policy Administration System
            await persist_policy_archive(
                quote_id=quote_id,
                document_id=document_id,
                pdf_data=pdf_bytes,
                audit_log=audit_trail,
                checksum=sha256_checksum
            )

    # 3. Trigger Carrier Policy Issuance & Invoice Capture
    await trigger_carrier_policy_bind(quote_id=quote_id, document_id=document_id)

    return {
        "status": "success",
        "quote_id": quote_id,
        "policy_status": "BOUND",
        "sha256": sha256_checksum
    }

async def persist_policy_archive(quote_id: str, document_id: str, pdf_data: bytes, audit_log: dict, checksum: str):
    # Simulated persistence to AWS S3 Object Lock / GCS Immutable Bucket
    print(f"[PAS] Archived Policy {quote_id} (Doc: {document_id}) with SHA256: {checksum}")

async def trigger_carrier_policy_bind(quote_id: str, document_id: str):
    # Automated ledger update, payment settlement, and certificate of insurance (COI) issuance
    print(f"[BINDING] Issued commercial policy for Quote {quote_id}")