SAIF.Business.Policy.Audit.ApiCalls business rules
This page captures the rules enforced by SAIF.Business.Policy.Audit.ApiCalls.
BR-AAC-001: Outbound clients identify as PremiumAudit
Field
Value
Statement All outbound API clients from this library stamp ClientInfo.ApplicationId with "PremiumAudit".
Trigger Any API client is constructed.
Enforcement The constructors for ApiCall, DocumentApiCall, and PolicyDocDistributionCall assign the fixed application identifier before building JsonHttpClient.
Outcome Downstream services receive a consistent caller-application identity.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs, Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs, Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs
BR-AAC-002: Outbound clients propagate machine and user identity
Field
Value
Statement All outbound API clients propagate the current machine name and environment-service user ID in ClientInfo.
Trigger Any API client is constructed.
Enforcement Each constructor reads EnvironmentService.MachineName and EnvironmentService.UserId() and copies those values into ClientInfo.
Outcome Downstream services can attribute requests to the submitting workstation and user.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs, Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs, Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs
BR-AAC-003: API base URLs come from environment settings
Field
Value
Statement Each API client resolves its base URL from an Environment API setting instead of hard-coding the host address.
Trigger Any API client is constructed.
Enforcement ApiCall, DocumentApiCall, and PolicyDocDistributionCall call EnvironmentService.GetConfigSetting(...) with their respective setting keys before creating the request URI.
Outcome Endpoint selection stays environment-specific and external to source code.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs, Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs, Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs
BR-AAC-004: Policy Audit API credentials come from a secure setting
Field
Value
Statement The Policy Audit API client retrieves its NTLM credential pair from secure setting gwcommon.gw_lg_pc_pr_service, unlocked with SystemHashUtil.ComputeHash(SystemType.WebApp, "PolicyAuditAPI").
Trigger ApiCall is constructed.
Enforcement ApiCall calls EnvironmentService.GetSecureConfigSetting(...) with the fixed key and hash subject before creating the authenticator.
Outcome The credential value is supplied at runtime instead of being embedded in source.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs
BR-AAC-005: Policy Audit credentials must split into user and password
Field
Value
Statement The secure Policy Audit API credential value must produce a two-part username|password pair for NTLM authentication.
Trigger ApiCall builds its authenticator.
Enforcement ApiCall splits the secure-setting value on | and passes element 0 and element 1 to NtlmAuthenticator.
Outcome ApiCall can only construct its NTLM-authenticated client when the secure setting preserves that two-part format.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs
BR-AAC-006: Callers choose the Policy Audit API route
Field
Value
Statement The Policy Audit API route is chosen by the caller-supplied method argument, not by an internal route lookup.
Trigger PolicyAuditAPICall or WaiveAPICall is invoked.
Enforcement Both methods pass the received method argument directly to _api.PostJson<bool>(...).
Outcome Different Policy Audit API routes can be targeted without changing this library.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs
BR-AAC-007: Audit submission success comes from the first boolean result
Field
Value
Statement PolicyAuditAPICall reports success by returning the first boolean element from the response wrapper's Results collection.
Trigger PolicyAuditAPICall returns to its caller.
Enforcement The method evaluates result.Results.FirstOrDefault() and returns that value.
Outcome A missing or empty result set yields false to the caller.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs
BR-AAC-008: Waive-audit submission returns the wrapper string
Field
Value
Statement WaiveAPICall returns the response wrapper object's string representation instead of a boolean payload value.
Trigger WaiveAPICall returns to its caller.
Enforcement The method calls _api.PostJson<bool>(...) and then returns result.ToString().
Outcome Callers receive a textual wrapper representation rather than a decision flag.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs
BR-AAC-009: Only the Policy Audit API client attaches an authenticator
Field
Value
Statement DocumentApiCall and PolicyDocDistributionCall construct JsonHttpClient without supplying an authenticator; only ApiCall attaches NTLM credentials.
Trigger Any client constructor runs.
Enforcement ApiCall passes an NtlmAuthenticator into JsonHttpClient, while the other two constructors pass only the URI and ClientInfo.
Outcome Authentication behavior differs by downstream service.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs, Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs, Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs
BR-AAC-010: Document API requests use submitter name PremAudit
Field
Value
Statement Document API distribution requests are submitted with DistributionRequest.Username = "PremAudit".
Trigger CallDocumentApi assembles a request.
Enforcement DocumentApiCall.CallDocumentApi assigns the fixed username before posting the payload.
Outcome The downstream Document API sees a consistent submitter identity for this flow.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs
BR-AAC-011: Document API requests carry exactly one distribution entry
Field
Value
Statement Each call to CallDocumentApi builds a single-element Distributions array.
Trigger CallDocumentApi assembles a request.
Enforcement The method instantiates one DistributionConfig inside a one-item array.
Outcome Each invocation submits exactly one distribution configuration.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs
Field
Value
Statement Document API requests leave DistributionTime null to indicate immediate distribution.
Trigger CallDocumentApi builds its DistributionConfig.
Enforcement DocumentApiCall.CallDocumentApi assigns DistributionTime = null, matching the inline comment on DistributionConfig.DistributionTime.
Outcome The request does not schedule a future send time.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs, Business\SAIF.Business.Policy.Audit.ApiCalls\DistributionConfig.cs
BR-AAC-013: Document API output profile is PDF
Field
Value
Statement Document API requests emitted by this library always use DocumentConfig.OutputProfile = "PDF".
Trigger CallDocumentApi builds DocumentConfig.
Enforcement The method assigns the fixed output profile literal before posting the request.
Outcome Generated documents are requested in PDF format.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs
BR-AAC-014: Document API recipient is the policy holder
Field
Value
Statement Document API requests emitted by this library target recipient ID PH.
Trigger CallDocumentApi builds DocumentConfig.
Enforcement The method assigns RecipientId = "PH".
Outcome The document package is addressed to the policy-holder recipient class.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs
BR-AAC-015: Document API requests omit cover sheets and special handling
Field
Value
Statement Document API requests emitted by this library leave banner instructions and special handling empty and populate CoverSheets with a single empty string.
Trigger CallDocumentApi builds DocumentConfig.
Enforcement The method assigns empty strings for BannerInstructions and SpecialHandling and uses new[] { "" } for CoverSheets.
Outcome The request is sent without additional cover-sheet or handling directives.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs
BR-AAC-016: Document API success requires HTTP 200
Field
Value
Statement CallDocumentApi returns true only when the response status code equals HttpStatusCode.OK.
Trigger CallDocumentApi processes a response.
Enforcement The method checks response.StatusCode == HttpStatusCode.OK and otherwise falls through to false.
Outcome Non-200 responses are reported as unsuccessful.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs
BR-AAC-017: Document API exceptions are swallowed and reported as failure
Field
Value
Statement CallDocumentApi catches all exceptions, writes the exception message to Console, and returns false.
Trigger An exception is thrown during request assembly or posting.
Enforcement The method wraps the post in try/catch, calls Console.WriteLine(e.Message), and does not rethrow.
Outcome The caller sees a boolean failure result rather than an exception.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs
BR-AAC-018: Preset-based distribution always reports success
Field
Value
Statement DistributeApiCall returns true without inspecting the RequestResult returned by the Policy Document Distribution API.
Trigger DistributeApiCall returns to its caller.
Enforcement The method stores _documentApi.PostJson<RequestResult>(...) in a local response variable and immediately returns true.
Outcome The caller cannot distinguish accepted, rejected, or failed preset distributions from this method's return value.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs
Field
Value
Statement Contact payloads use only three recipient type codes: policy holder (PH), agent (AG), and third party (3P).
Trigger A ContactType value is resolved for a policy-document payload.
Enforcement Contact.ValidContactTypes defines the canonical mapping and each concrete subclass returns the mapped code for its own role.
Outcome Serialized preset-distribution contacts stay within the service contract's three supported recipient classes.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocumentConfig.cs
Field
Value
Statement A contact type is valid only when it matches one of the values stored in ValidContactTypes.
Trigger Contact.IsValidContactType is called.
Enforcement The method checks ValidContactTypes.Values.Contains(contactType).
Outcome Validation succeeds only for PH, AG, or 3P.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocumentConfig.cs
Field
Value
Statement Carbon-copy naming differs by contact role: policy holders return an empty value, agents return either the formatted name or "name, agency", and third parties return the formatted name.
Trigger The CCName contract is evaluated for a contact.
Enforcement Each Contact subclass overrides CCName with role-specific formatting logic.
Outcome The preset-distribution payload can populate CC metadata consistently for each recipient class.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocumentConfig.cs
BR-AAC-022: Distribution channels identify themselves by class name
Field
Value
Statement Each distribution channel advertises its discriminator through DistributionMethodType = typeof(T).Name.
Trigger A distribution-channel option is serialized or inspected.
Enforcement DistributionMethod<T> exposes a read-only DistributionMethodType property that returns the generic argument's class name.
Outcome Channel selection travels on the wire as the concrete option class name.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\DistributionMethod.cs
BR-AAC-023: This library persists no local state
Field
Value
Statement This library performs no direct database persistence or local business-object lifecycle work; it only shapes payloads and posts them to downstream services.
Trigger Any documented operation runs.
Enforcement The project contains only HTTP client logic, DTO contracts, config access, and no data-access APIs or BOF business-object types.
Outcome Audit, document, and preset-distribution state changes occur in downstream services rather than in this repository.
Confidence Verified
Source Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs, Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs, Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs
Sources
Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.csBusiness\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.csBusiness\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.csBusiness\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocumentConfig.csBusiness\SAIF.Business.Policy.Audit.ApiCalls\DistributionMethod.csBusiness\SAIF.Business.Policy.Audit.ApiCalls\DistributionConfig.cs