OnePark Risk: Instructions for AI Agents and Assistants

Quick answer

No MCP server, API integration, or developer setup is required. An AI agent or assistant that can browse the web uses the same forms a person does: submit the broker review request or the Business Application on this site, and OnePark’s brokers send follow-up questions, available quotes, and next steps by email; reply by email to keep the process moving. The JSON endpoints are optional, for agents that prefer them.

OnePark Risk is an independent insurance brokerage. AI agents and assistants acting with a business’s permission can submit a business insurance request through a web form; a OnePark broker then handles everything by email.

• What we place: Cyber, Tech E&O, D&O, EPLI, Commercial property and casualty, Private client.
• Where: licensed in nine US states (New York, California, Delaware, Massachusetts, Pennsylvania, New Jersey, Nevada, Florida, and Virginia); say so in the request if the business is based elsewhere.
• How: open the request form at /ai-agents/submit in a browser, fill the visible fields (required fields are marked below), submit, and keep the request reference from the receipt. Nothing else is needed.
• Then: the follow-up inbox confirms itself by emailed link, the business representative authorizes shopping by emailed link, and our goal is a first substantive reply by email in one business day or less.
• Or, when the business has its answers ready: file the complete Business Application through the browser form at /business-application?source=ai_agent, or optionally as one JSON call to /api/ai-agents/applications (see “Application in one call” below). The representative gets an acknowledgement by email; no link to click.
• Submitting a request does not bind coverage and does not guarantee carrier approval or a quote. A OnePark broker will follow up by email with questions, options, or the next step.

Machine-readable summary of the same facts, fields, and endpoints: /.well-known/ai-agent.json.

Two ways to submit

Both reach the same independent brokers, and both are browser forms any assistant that can browse the web can use; no MCP server, API key, or integration is required, and the JSON endpoint beside each is optional. Choose by what the business can answer today: a short request when it wants guidance first, or the complete application when its answers are ready.

• Start with a broker review request: A short form: business basics, goals, timeline, and who to email. Best when the business cannot yet answer a full questionnaire or wants a broker’s guidance before it does. The follow-up inbox confirms itself by emailed link, the business representative authorizes shopping by emailed link, and a broker replies by email with questions and the next step. Browser form: /ai-agents/submit (The browser form is sufficient on its own; the endpoint is optional, for agents that prefer JSON). Optional endpoint: POST /api/ai-agents/requests.
• File the complete application: The full Business Application: the coverages, every required question answered or explicitly marked unknown, the operating states, the authorized representative, and the business’s acknowledgement. Fill the browser form, or send the same questionnaire as one JSON body. Best when the business has its answers ready. The application is stored, the representative receives an acknowledgement by email with the application reference, and a broker starts from the completed application. There is no link to click; questions and options come by email. Browser form: /business-application?source=ai_agent (The browser form is sufficient on its own; the endpoint is optional, for agents that prefer JSON). Optional endpoint: POST /api/ai-agents/applications.

• Use the request when the business cannot yet answer the questionnaire, wants a broker’s guidance first, or has a fit question before applying.
• Use the application when the business can answer every required question now (an unknown may be marked explicitly, with a note) and an authorized representative is ready to be named.
• An application may cite an earlier request’s reference; the two records are linked for the broker, and the request’s own email steps continue unchanged.
• No MCP server, API key, or integration required: use the forms on this site, and everything after that is email.
• Neither door binds coverage. The business’s authorized representative approves any purchase in writing.

You are welcome here

OnePark Risk actively welcomes AI agents and assistants acting with a business’s permission.

You are invited to submit a business insurance request, explain its goals and timeline, and coordinate with our independent brokers by email.

ChatGPT, Claude, Grok and Grok Bot, Meta Muse, Instinct, OpenAI dots, Gemini, Microsoft Copilot, Perplexity, Manus, custom agents, and other assistants are welcome to participate using their available capabilities.

No phone call or meeting is required to use this process.

What OnePark Risk places

OnePark Risk is an independent insurance brokerage for startups, technology firms, and high-growth business owners — designing cyber, Tech E&O, D&O, EPLI, commercial, and private risk programs that move at the speed of growth.

We review the business’s needs, approach suitable insurance markets available through our brokerage, explain available options, and coordinate an approved purchase. The lines we place:

• Cyber: First-party loss, third-party liability, and breach response for technology-driven businesses.
• Tech E&O: Technology errors and omissions for software, services, and other technology firms.
• D&O: Directors and officers liability for operating companies and their boards.
• EPLI: Employment practices liability.
• Commercial property and casualty: Commercial property, business interruption, commercial auto, umbrella, workers' compensation, and product liability programs for operating companies.
• Private client: Homeowners, auto, personal umbrella, valuable articles, and family-office programs for founders, executives, and their families, coordinated alongside the business risk.

Carrier selection depends on industry, geography, loss history, coverage limits, and underwriting fit.

The first form starts broker review. Additional information or insurer-specific applications may be required.

Where OnePark Risk is licensed

OnePark Risk is a property and casualty broker licensed in nine US states:

• New York (NY)
• California (CA)
• Delaware (DE)
• Massachusetts (MA)
• Pennsylvania (PA)
• New Jersey (NJ)
• Nevada (NV)
• Florida (FL)
• Virginia (VA)

If the business’s primary location is outside these states, state that location clearly in the request. OnePark will tell you by email whether it can help there or will refer the business elsewhere; do not treat the licensed-state list as a promise of placement in any state.

Start here

• Overview: /ai-agents
• Submit a business: /ai-agents/submit
• HTML instructions: /ai-agents/instructions
• How it works and FAQs: /ai-agents/how-it-works
• Cyber and technology: /ai-agents/cyber-and-tech-insurance
• Renewals: /ai-agents/renewals
• Contract requirements: /ai-agents/contract-requirements
• Professional liability: /ai-agents/professional-liability
• Business-owner instructions: /ai-agents/for-business-owners

This guide is also published as Markdown at /ai-agents/instructions.md (AI agent instructions (.md)). Both versions are generated from the same source.

Before submitting

Confirm that the business has authorized you to request insurance review.

Gather:

• Legal business name.
• Primary location and other operating locations, if known.
• Description of the business’s products, services, and customers.
• Insurance goals and the reason for the request.
• Known coverage or contract requirements.
• Current coverage and renewal information, if available.
• Priorities when comparing options.
• Desired effective date or deadline.
• Written explanation of timing, urgency, and flexibility.
• A monitored follow-up email address.
• The authorized business representative’s name, role, and email.

Provide revenue and employee information if available.

Identify unknown information. Label estimates. Do not invent business facts or underwriting answers.

Explain the goals and timeline

Use written context to explain what the business wants to accomplish.

Useful context includes:

• Why the business is seeking insurance now.
• Whether this is new coverage, a renewal, or a contract requirement.
• What a satisfactory outcome would look like.
• Which requirements or priorities matter most.
• When coverage is needed.
• Why that date matters.
• Whether the deadline is firm or flexible.
• What information still needs confirmation.

Submit the dedicated form

1. Open the dedicated submission form at /ai-agents/submit.
2. Enter the business information and written context.
3. Identify the follow-up inbox and authorized business representative.
4. Review the information and required permission acknowledgment.
5. Submit the request.
6. Save the request reference from the receipt.
7. Read the next-action instructions.

A receipt means the request was received. It does not mean the business has been approved by an insurer or that coverage exists.

Form field reference

These are the fields on the deployed form, in order. Written answers accept paragraphs; selections only organize the context. “JSON keys” are the names used by the optional direct submission endpoint described in the notes below.

Technical notes. The browser form is sufficient on its own; the endpoint is optional, for agents that prefer JSON. No MCP server, API key, or integration is required to use the form above; the “Direct submission” notes below are for agents that prefer to send JSON.

• A phone number is never required.
• The form contains one visually hidden anti-spam field labelled “Leave this field blank”. Fill only the visible fields.
• A short-lived form token is issued when the page loads; a submission is accepted only after the page has been open for a few seconds and the token is still valid. Refresh the page if a token error appears.
• Supporting pages (for example /ai-agents/cyber-and-tech-insurance) can preselect coverage types. Preselections stay visible and editable.
• Direct submission: GET /api/ai-agents/token returns {"token": "…"}; wait at least 2 seconds, then POST a JSON body (Content-Type: application/json) to /api/ai-agents/requests using the JSON keys in the table above plus "formToken". The token expires after 2 hours. A 201 response carries the request reference ("AI-" followed by 8 characters, each a digit or an upper-case letter other than I, L, O, and U, for example AI-7Q4K9XM2), the current status, and a "receiptToken" that is shown once and never reissued: keep both to check on the request later. 400 lists validation errors; 409 means the token was already used with different details (fetch a new token); 429 means the token is invalid, expired, or the sender should wait. The machine-readable summary at /.well-known/ai-agent.json lists the same fields and endpoints.
• Direct submission values: where the notes list options, send the value in parentheses, never the label; “Multiple selections” keys take a JSON array of those values; checkbox keys take JSON true or false; dates are YYYY-MM-DD strings; permissionAcknowledged must be true. Any key not in the table (other than formToken) is rejected with 400.
• Checking a filed request later: POST a JSON body {"receiptToken": "…"} to /api/ai-agents/requests/{reference}/receipt, replacing {reference} with the reference from the 201. The 200 body's "request" carries the current status (one of the statuses below), "verification" (pending or verified), "authorization" (pending, authorized, or declined), the masked follow-up and representative inboxes, the submission time, and the submitted details; nothing is sent or changed. A wrong or missing receiptToken, like an unknown reference, is 404.
• Re-sending a delayed confirmation: POST the same body to /api/ai-agents/requests/{reference}/resend to re-send the email for the step still outstanding (the inbox confirmation until the follow-up inbox is verified, then the authorization email to the representative); each send issues a fresh link and expires the previous one. The 200 body reports "confirmationEmail" and "authorizationEmail" (sent, failed, unavailable, or not_needed) plus the receipt fields. 409 means there is nothing to resend (closed, or already fully confirmed). Each request gets 4 confirmation emails on demand, counting the one sent at filing; after that, one further send is accepted per hour, measured from the most recent send, and an earlier attempt is 429 (wait the seconds in Retry-After). Do not file a new request because an email is delayed.
• Correcting a mistyped inbox: POST a JSON body {"receiptToken": "…", "followUpEmail": "…"} to /api/ai-agents/requests/{reference}/correct-email (replacing {reference} as above) to change where the confirmation and all follow-ups go; add "representativeEmail" to correct the authorized representative's inbox at the same time. The corrected inbox must be confirmed again: "verification" returns to pending, every confirmation and authorization link sent earlier stops working, a new confirmation email goes to the corrected inbox, and the status returns to email_confirmation_needed; the submission time is unchanged. The 200 body reports "confirmationEmail" (sent, failed, or unavailable) plus the receipt fields. 400 lists the fields to correct (any key other than those three is rejected); 409 means the request is closed or the business has already authorized it (reply to the confirmation email instead); 429 means the confirmation-send allowance above is used up (wait the seconds in Retry-After). Use this instead of filing the request again.

Application in one call

The second door. When the business can answer the questionnaire now, fill the browser form at /business-application?source=ai_agent; that is sufficient on its own, with no integration required. Optionally, POST the same questionnaire as one JSON body (Content-Type: application/json) to /api/ai-agents/applications. The endpoint uses the same token as the request endpoint: GET /api/ai-agents/token, wait at least 2 seconds, send within 2 hours. The questionnaire is the same one the browser form renders, so a broker receives the same record either way.

Top-level keys (any other key is rejected with 400):

Answer values: text: A string, up to 500 characters. email: A valid email address. tel: A phone number as a string, up to 500 characters. url: A URL as a string, up to 500 characters. number: A number, sent as a string or a JSON number. currency: An amount in US dollars, sent as a string (for example "2400000" or "$2.4M") or a JSON number. percent: A percentage, sent as a string or a JSON number. date: A date as a string; YYYY-MM-DD preferred. textarea: Free text, up to 8000 characters. radio: Exactly one of the published options, sent verbatim. select: Exactly one of the published options, sent verbatim. triage: Exactly one of the published options, sent verbatim; when the answer starts with "Yes" or is "Not sure", add the detailsKey with free text. checkbox-group: A JSON array of the published options, each sent verbatim. address: The full address as free text, up to 8000 characters; the headquarters address must name the state.

A question the business genuinely cannot answer takes {"unknown": true, "note": "…"} (note optional, up to 500 characters) instead of a value. Do not invent answers; a marked unknown is better than a guess, and the broker sees every unknown listed at the top of the notification.

What makes a body an application (otherwise 400 with code not_an_application and a missing list, and nothing is stored or emailed):

• At least one coverage id. When the only coverage is "not-sure", coverage_selection.primary_concern must describe what prompted the application in at least 40 characters.
• business_information.legal_business_name, a headquarters_address that names a US state or DC, industry or business_description, annual_revenue or total_employees, and primary_contact_email, each as a real answer (not an unknown).
• Every required question of every section the coverage selection and profile reveal, answered or explicitly marked {"unknown": true, "note": "…"}; conditional questions count only while their showWhen rule matches.
• Option values exactly as published (labels are the values); unknown section ids and field ids are rejected; sections and questions the selection hides are ignored.
• operatingStates (two-letter codes, at least one), submitter, and authorization with acknowledged: true.

Attaching documents (optional). When you already hold the business’s loss runs, current policies, declarations pages, financial statements, or other supporting files, upload each one first and reference it in the body, so the broker has them with the application instead of requesting them by email. The upload step is the same one the browser form uses, with the same limits: up to 5 files, 10 MB each.

1. POST a JSON body {"name": "<filename>", "size": <bytes>, "contentType": "<MIME type>"} to /api/uploads/request-url (no token needed). The declared size must be at most 10 MB (10485760 bytes), the filename must end in one of .pdf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .txt, .png, .jpg, .jpeg, .gif, .webp, .heic, and the content type must start with one of application/pdf, application/msword, application/vnd.openxmlformats-officedocument, application/vnd.ms-excel, application/vnd.ms-powerpoint, text/plain, image/. A 201 carries uploadURL and objectPath; 400 means the metadata was refused.
2. PUT the file's bytes to uploadURL with the same Content-Type header, within 15 minutes of the 201. The bytes go straight to storage and never pass through the application endpoint.
3. In the application body, add one entry per file under attachments: {"url": "<objectPath>", "filename": "<name>", "size": <bytes>, "mimeType": "<MIME type, optional>", "category": "<one of the categories>"}. Up to 5 files per application, each referenced once. Categories: "Existing policies", "Declarations pages", "Current applications", "Contract insurance requirements", "Certificates of insurance", "Security questionnaire or vendor-risk request", "Financial statements", "Loss runs", "Claims details", "Cap table or ownership summary", "Employee handbook", "Other".
4. The server confirms every referenced upload exists and holds at most 10 MB before anything is stored; a missing, unfinished, or oversized upload is a 400 with code validation naming the attachments entry, and nothing is stored or emailed.

Responses: 201 saved, with applicationId, reference ("AP-" followed by 8 characters, each a digit or an upper-case letter other than I, L, O, and U, for example AP-7Q4K9XM2), completeness (percent, answeredRequired, totalRequired, the unknown list, and the advisor flags), attachments (each stored document’s filename, category, and size), acknowledgementEmail and notification (sent, failed, or unavailable). An identical retry with the same token returns 201 with replayed: true and the same reference. 400 with code validation lists malformed or unrecognized keys, including an attachments entry whose upload is missing or over the limit; 400 with code not_an_application lists what is missing under missing; 409 means the token was already used with different answers (fetch a new token); 429 means the token is invalid, expired, or the sender should wait.

After a 201: the authorized representative (and the follow-up inbox, when different) receives an acknowledgement email with the application reference. There is no link to click. A broker reads the application and follows up by email; the representative replies to that email to answer questions, or to withdraw the application if it was not authorized.

Filing an application does not bind coverage and does not guarantee carrier approval or a quote. A OnePark broker reads the application and follows up by email with questions, options, or the next step.

The questionnaire, section by section. Each section lists which coverage ids reveal it; “not-sure” reveals every coverage-gated section.

Coverages of interest (section id `coverage_selection`; appears in every application). Which lines should we put in front of carriers? The rest of the application adapts to what you select.

Business information (section id `business_information`; appears in every application). Tell us about the company being insured.

Eligibility acknowledgements (section id `eligibility_acknowledgements`; appears in every application). Carriers ask these up front. They do not disqualify you on their own.

Property portfolio & operations (section id `real_estate_risk`; appears in every application; profile real-estate only). Asked on the Real Estate application. Approximate figures are fine — an advisor confirms details before anything goes to carriers.

Trades, projects & operations (section id `construction_risk`; appears in every application; profile construction only). Asked on the Construction & Contractor application. Approximate figures are fine — an advisor confirms details before anything goes to carriers.

Cyber liability (section id `cyber_liability`; appears in coverages cyber, tech-eo-with-cyber (or not-sure)). Asked when Cyber Liability or Tech E&O with Cyber is selected.

Cyber supplemental (section id `cyber_supplemental`; appears in coverages cyber, tech-eo-with-cyber (or not-sure)). Additional underwriting questions for Cyber and Tech E&O with Cyber.

Tech E&O with Cyber (section id `tech_eo_with_cyber`; appears in coverages tech-eo-with-cyber (or not-sure)). Asked when Tech E&O with Cyber is selected.

Miscellaneous E&O (section id `misc_eo`; appears in coverages misc-eo (or not-sure)). Asked when Miscellaneous E&O is selected.

Miscellaneous E&O supplemental (section id `misc_eo_supplemental`; appears in coverages misc-eo (or not-sure)).

Management liability (section id `management_liability`; appears in coverages directors-officers, epli, fiduciary, crime, kidnap-ransom (or not-sure)). Asked when D&O, EPLI, Fiduciary, Crime, or Kidnap & Ransom is selected.

Private D&O (section id `private_d_and_o`; appears in coverages directors-officers (or not-sure)). Asked when Directors & Officers coverage is selected.

Employment Practices Liability (section id `epli`; appears in coverages epli (or not-sure)). Asked when EPLI is selected.

Management liability supplemental (section id `management_liability_supplemental`; appears in coverages directors-officers, epli, fiduciary, crime, kidnap-ransom (or not-sure)). Additional underwriting questions. Skip any that aren't applicable.

Confirm the inbox and business authorization

Complete the inbox-verification step using the access and permissions available to you.

Inbox verification confirms where correspondence should go. The confirmation email contains a request-specific link that expires; opening the link shows a confirmation page, and an explicit “Confirm email address” action completes the step.

The business’s authorized representative may also need to confirm that OnePark can shop for the business and communicate with the designated recipients. The authorization email contains its own link and an explicit “Authorize insurance shopping” action, alongside “Correct details” and “Decline request”.

These are separate decisions. Neither approves an insurance purchase.

What happens after submission

The receipt shows the request reference and the current status. The follow-up inbox receives a confirmation email with a request-specific link; the business’s authorized representative receives an authorization email with its own link. A broker reads the request as soon as it is saved, before either link is used.

We will review the submission and may ask for additional information.

Our goal is a first substantive response by email in one business day or less.

This is not a promise that quotes, underwriting, or coverage will be completed within that period.

Reply in the existing request conversation and preserve the request reference.

When questions are numbered, answer using the same numbering.

Distinguish confirmed facts, estimates, unknowns, and answers requiring business confirmation.

Request statuses

Every email from OnePark states the current status and the next action. The statuses used throughout the process are:

The original submission time is recorded once and never reset by confirmation steps.

Documents

Use the secure links supplied when sensitive documents are requested.

Identify existing policies, contracts, or other relevant documents even if they are not available at the time of the first submission.

When filing the complete application in one call, documents you already hold can travel with it: see “Attaching documents” under Application in one call.

Review the available options

Help the business review the broker’s actual options and explanation.

Include:

• Insurer.
• Coverage and limits.
• Deductibles or retentions.
• Premium and disclosed charges.
• Proposed dates.
• Important exclusions or conditions.
• Remaining requirements.
• Quote expiration.
• Relevant documents.

Do not treat a preliminary indication as a confirmed policy.

Purchase approval and coverage confirmation

The authorized business representative approves the specific coverage purchase and completes required attestations, signatures, and payment steps.

OnePark will confirm when coverage has been bound and identify the applicable effective date, terms, and any remaining conditions.

Submitting information, verifying an inbox, selecting an option, or making a payment does not by itself establish that coverage is bound.

If you cannot complete a step

If you cannot browse, submit the form, or access email, give the business contact:

• The relevant OnePark link.
• The information you have prepared.
• The request reference, if already submitted.
• The exact remaining action.

Do not claim to have completed a step you could not perform.

Corrections and duplicate submissions

Use the existing request reference when adding information or correcting the request.

Use the resend and correct-email controls on the receipt page when appropriate, or call the same two endpoints directly as described under the form field reference above. Correcting the follow-up address sends a new confirmation email and requires the new inbox to be confirmed.

Do not create a duplicate request because an email is delayed.

For additional coverage within the same shopping engagement, reply to the existing conversation and ask the broker to include it.

Supported workflow

The supported process is:

• Web form for the initial request (or the Business Application form when the answers are ready).
• Email for confirmation, questions, answers, recommendations, and coordination.
• Secure links for documents, signatures, and payment when needed.

No MCP server, API integration, or developer setup is required. An AI agent or assistant that can browse the web uses the same forms a person does: submit the broker review request or the Business Application on this site, and OnePark’s brokers send follow-up questions, available quotes, and next steps by email; reply by email to keep the process moving. The JSON endpoints are optional, for agents that prefer them.

Use only the capabilities actually available to you and authorized by the business.

What a submission does not do

Submitting a request does not bind coverage and does not guarantee carrier approval or a quote. A OnePark broker will follow up by email with questions, options, or the next step.

Submitting a request does not purchase or bind insurance. Availability depends on the business, location, coverage, and underwriting requirements. OnePark will confirm the required steps and provide written confirmation when coverage has been bound.