The FileTrac SOAP API authenticates every request with three string parameters: Login, Password, and CompanyKey. There is no token exchange, no OAuth, and no session.

Credentials

Parameter	Type	Required	Description
`Login`	string	yes	The authorized FileTrac system login of the user.
`Password`	string	yes	The password associated with the login.
`CompanyKey`	string	yes	The unique company code provided by FileTrac.

All three values are supplied by FileTrac when API access is approved. They are not configurable by the integrator and are not the same as the user's FileTrac web UI login. The CompanyKey routes the request to the correct sub-environment within the FileTrac system.

Where the Credentials Go

Most methods accept the three credential fields at the top of the operation's parameter wrapper. For example, GetClaimSummaries wraps everything in <oParms>:

<GetClaimSummaries xmlns="https://ftservices.onlinereportinginc.com/v2/">
  <oParms>
    <Login>your-login</Login>
    <Password>your-password</Password>
    <CompanyKey>your-company-key</CompanyKey>
    <!-- search parameters follow -->
  </oParms>
</GetClaimSummaries>

AddClaim is the exception. Its parameter wrapper is <oClaim> (singular), and the three credential fields live inside that wrapper alongside the claim fields:

<AddClaim xmlns="https://ftservices.onlinereportinginc.com/v2/">
  <oClaim>
    <Login>your-login</Login>
    <Password>your-password</Password>
    <CompanyKey>your-company-key</CompanyKey>
    <ClientCompanyID>1234</ClientCompanyID>
    <ClientClaimNum>POL-2026-00042</ClientClaimNum>
    <!-- claim fields follow -->
  </oClaim>
</AddClaim>

Requesting API Access

API access is granted per login, not per organization. A valid FileTrac login does not automatically have API access.

To request access:

Open a FileTrac Support ticket of ticket type Training – General Help with ticket category Questions.
Identify the FileTrac login that needs API access.
State the business purpose for API access.

A FileTrac administrator reviews and authorizes each login individually. Once authorized, the same credentials work across every method in this API.

Adjuster logins are not authorized for API access. Field adjuster accounts cannot be granted API permissions. API access is reserved for system-integration logins held by adjustment company users or client company users.

Authorization Scope

What a request can see depends on the type of user that owns the login:

Adjustment Company users can access all data within their adjustment company. They see every claim, contact, contract, invoice, reserve, and user that belongs to the adjustment company that owns their login.
Client Company users can access only data within their own company. They see only the claims, contacts, invoices, and related records that belong to their client company within the adjustment company's system.

There is no per-method permission system beyond this. If a login has API access, it can call any method; the scope of returned data is filtered to what the user can see in the FileTrac UI.

Authentication Failure Behavior

The API does not raise SOAP faults for authentication failures. Instead, it returns the operation's default empty result and surfaces the failure in the response message.

The standard response codes are documented in Error Codes & Response Codes. For authentication outcomes specifically:

ResponseCode	Message	Cause
0	Success	Authentication passed.
1	LoginOrPasswordInvalid	Either the `Login` or the `Password` failed validation.
2	AuthenticationParameterMissing	Either `Login`, `Password`, or `CompanyKey` was not supplied.
3	TruncatedTransmission	The request was interrupted prior to completion.

When ResponseCode is non-zero, expect default-empty payloads: an empty string for string returns, an empty list for list returns, an empty object for object returns, or 0 for an ID return.

Credential Rules

Not interchangeable across versions. Credentials issued for the v2 API do not work against the deprecated v1 API, and v1 credentials do not work against v2. If a request fails with an authentication error and you are confident the credentials are valid, confirm you are calling the /v2/ endpoint.
Treat credentials as secrets. The three values together grant access to claim and financial data. Store them in a secure secret manager, not in source control.
Rotate via Support. There is no self-service credential rotation. To change a password or revoke access, file a FileTrac Support ticket.

What Authentication Does Not Do

It does not establish a session. Every request carries credentials independently.
It does not grant API rights to other logins. Each login must request its own access.
It does not bypass FileTrac UI permissions. If a user cannot see a claim in the web UI, the API will not return it for that user either.

Authentication & Authorization