---
title: Construct the Policy Audit API client
summary: Resolve endpoint, caller identity, and NTLM credentials for the Policy Audit API.
status: draft
owner: Technical Writer
last_reviewed: 2026-07-31
library: SAIF.Business.Policy.Audit.ApiCalls
reference_type: package
operation_id: OP-001
trigger: A caller instantiates `ApiCall`.
---

# Construct the Policy Audit API client

Resolve endpoint, caller identity, and NTLM credentials for the Policy Audit API.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-001 |
| **Trigger** | A caller instantiates `ApiCall`. |
| **Inputs** | None. |
| **Outputs** | Initialized `JsonHttpClient` stored inside `ApiCall`. |
| **Primary components** | `ApiCall.ApiCall()` |
| **Entry point** | `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs` |

## Steps

1. Create a `ClientInfo` object and stamp it with application ID `PremiumAudit` ([BR-AAC-001](../business-rules.md#br-aac-001-outbound-clients-identify-as-premiumaudit)).
2. Copy `EnvironmentService.MachineName` and `EnvironmentService.UserId()` into `ClientInfo` so outbound requests carry machine and user identity ([BR-AAC-002](../business-rules.md#br-aac-002-outbound-clients-propagate-machine-and-user-identity)).
3. Read environment setting `policyauditapi.policyauditapiurl` and use the returned value to construct the base `Uri` for the HTTP client ([BR-AAC-003](../business-rules.md#br-aac-003-api-base-urls-come-from-environment-settings)).
4. Read secure setting `gwcommon.gw_lg_pc_pr_service` by hashing `PolicyAuditAPI` as a `SystemType.WebApp` subject and passing that hash into `GetSecureConfigSetting` ([BR-AAC-004](../business-rules.md#br-aac-004-policy-audit-api-credentials-come-from-a-secure-setting)).
5. Split the secure-setting value on `|`, use the first two elements to construct `NtlmAuthenticator`, and create `JsonHttpClient` with that authenticator ([BR-AAC-005](../business-rules.md#br-aac-005-policy-audit-credentials-must-split-into-user-and-password)).

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
  Start(["new ApiCall()"]) --> Info[Build ClientInfo]
  Info --> Config[Read base URL and secure credentials]
  Config --> Client[Create NTLM-authenticated JsonHttpClient]
  Client --> Done([Client ready])
```

## Failure and edge-case behavior

- If the base URL setting is missing or malformed, `new Uri(apiUrl)` fails during construction.
- If the secure setting does not produce a two-part `username|password` string, NTLM authenticator construction cannot complete.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Configuration](../configuration.md)

## Sources
- `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs`