BR-012: Bank account payloads require category and type¶
Field
Value
Statement
Bank-account payloads must specify both the business or consumer category and the checking or savings type.
Trigger
USBankAPIs builds add-account or recurring-authorization contract objects.
Enforcement
GetFilledUSBankBankAccountInfo and GetFilledRecurringACHPayMethod throw when either dimension is missing.
Outcome
Malformed bank-account metadata is rejected before the SOAP call is made.
Confidence
Verified
Source
Business\SAIF.Business.EPay.USBank\USBankAPIs.vb
BR-013: Duplicate bank accounts return a handled result¶
Field
Value
Statement
Duplicate bank-account responses are returned as a handled business outcome.
Trigger
AddBankAccount receives response code 75 or 5025 from US Bank.
Enforcement
The method returns AddBankAccountResults(False, String.Empty) instead of throwing an exception.
Outcome
Callers can distinguish duplicate-account handling from transport or contract failures.
Confidence
Verified
Source
Business\SAIF.Business.EPay.USBank\USBankAPIs.vb
BR-014: Return URLs are rewritten to secure SAIF view links¶
Field
Value
Statement
Return URLs must be rewritten to HTTPS SAIF view links.
Trigger
RemotePostFiller prepares a return URL for a session-transfer flow.
Enforcement
GetReturnURL rewrites http:// to https://, strips an existing query string, appends ?__SAIFPID=<ViewID>, and throws when the original value is not HTTP or HTTPS.
Outcome
US Bank redirects return to a normalized SAIF URL shape.
The utility throws when the concatenated policy number plus business-online user ID exceeds 16 characters.
Outcome
Callers cannot produce an oversized local composite identifier through this helper.
Confidence
Verified
Source
Business\SAIF.Business.EPay.USBank\User.vb
BR-018: Admin make-payment requests always use the voluntary biller ID¶
Field
Value
Statement
Admin make-payment remote-post requests always use the voluntary biller ID, regardless of whether the policy is actually voluntary or assigned-risk.
Trigger
RemotePostFiller.FillAdminMakePaymentRemotePost prepares an admin unregistered-payment redirect.
Enforcement
The method calls m_USBankCodes.GetBillerId(True) unconditionally instead of passing through inPolicyInfo.IsVoluntaryPolicy, with an inline comment noting the assigned-risk biller ID is not set up for credit card payments.
Outcome
Assigned-risk policies are redirected to US Bank's admin make-payment page using the voluntary biller ID instead of the assigned-risk biller ID.
BR-019: Update user profile failures are retried once, then reported by email instead of failing the call¶
Field
Value
Statement
A failed call to US Bank's UpdateUserProfile is retried exactly once after a short delay; if the retry also fails, the exception is not propagated to the caller, and an email failure notice is sent instead.
Trigger
USBankAPIs.UpdateUserToUSBank is invoked (from RegisterUser) and the first UpdateUserProfile SOAP call throws an exception.
Enforcement
The catch block sleeps 1500ms and retries the call once inside a nested Try/Catch; if the retry also throws, SendMail is called with USBankCodes.ErrorEmailAddress and the outer method returns without raising an exception.
Outcome
Callers of RegisterUser are not informed when both the initial and retried UpdateUserProfile calls fail; the failure is only surfaced through an outbound email, and the caller's flow continues as if no remote update error occurred.