---
title: SSN validation
summary: Submits a Social Security Number to the vendor SSNKey validation service and returns its vendor-supplied result.
status: draft
owner: SAIF
last_reviewed: 2026-07-30
library: BankValidator
reference_type: package
operation_id: OP-BV-05
trigger: Caller invokes ValidateSSN
---

# SSN validation

This operation submits a Social Security Number to the vendor's SSNKey web service and returns the vendor's result string unchanged. It is the simplest of the five operations in this library: a single vendor call with no branching or output transformation.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-BV-05 |
| **Trigger** | Caller calls `ValidateSSN(inSSN)` on a constructed `clsValidateBank` |
| **Inputs** | `inSSN` (Social Security Number string) |
| **Outputs** | Vendor-supplied result string |
| **Primary components** | `clsValidateBank.ValidateSSN`, `clsValidateBank.LogonSSN`, `clsValidateBank.LogoffSSN` |
| **Entry point** | `Legacy\BankValidator\clsValidateBank.vb` |

## Steps

1. **Log on to the SSNKey service.** `LogonSSN()` increments `m_LogonAttempts`, lazily constructs `SSNKeyService.SSNKeyService` if needed, sets its `Url` from `URLSSNKey`, and calls `SSNKey.Logon(CompanyId, UserId, Password)` to obtain a `LogonToken` ([BR-002](../business-rules.md#br-002-vendor-logon-retry-handling)).
   - On failure: the `Catch` block recursively calls `LogonSSN()` again while `m_LogonAttempts < m_LogonAttemptsMax`.
   - On failure after the retry limit is exhausted: throws `ApplicationException("Unable to logon to SSNKey web service.", ex)`.
2. **Invoke the vendor validation.** Call `SSNKey.ValidateSSN(LogonToken, inSSN)` and assign the result to `result`.
   - Not wrapped in `Try/Catch`; an exception raised by the vendor call propagates directly to the caller and skips step 3.*
3. **Log off the SSNKey service.** `LogoffSSN()` calls `SSNKey.Logoff(LogonToken)`, disposes the `SSNKey` proxy, and sets it to `Nothing`.
   - On failure: the exception is silently swallowed (the `Throw` line is commented out).
4. **Return the result.** The vendor-supplied `result` string is returned to the caller unchanged.

## Process flow

The following diagram visualizes the single-path control flow for SSN validation.

```mermaid
flowchart TD
	Start([Caller calls ValidateSSN]) --> Logon[LogonSSN:<br>logon with retry up to m_LogonAttemptsMax]
	Logon --> LogonOk{Logon succeeded?}
	LogonOk -->|No, retries exhausted| Ex([ApplicationException thrown])
	LogonOk -->|Yes| Validate[SSNKey.ValidateSSN]
	Validate --> Fault{Vendor call throws?}
	Fault -->|Yes| Propagate([Exception propagates;<br>LogoffSSN skipped])
	Fault -->|No| Logoff[LogoffSSN:<br>release token, dispose proxy]
	Logoff --> Done([Return vendor result string])
```

## Failure and edge-case behavior
- If the SSNKey logon fails repeatedly, the caller receives an `ApplicationException` after `m_LogonAttemptsMax` retries ([BR-002](../business-rules.md#br-002-vendor-logon-retry-handling)); no validation is attempted.
- Because the vendor invocation is not wrapped in `Try/Catch`, an exception from `SSNKey.ValidateSSN` propagates unhandled to the caller and `LogoffSSN()` is never reached, leaving the SSNKey proxy and logon token unreleased.*
- The method performs no format validation on `inSSN` before submitting it to the vendor; any interpretation of the result string (e.g., valid/invalid, formatted message) is determined entirely by the vendor service and is not inspected or transformed by this façade.*
- `LogoffSSN` failures are intentionally swallowed and never surface to the caller.*

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

## Sources
- `Legacy\BankValidator\clsValidateBank.vb`