---
title: SAIF.Business.Policy.Audit.ApiCalls architecture
summary: Architectural responsibilities, boundaries, and interaction patterns for SAIF.Business.Policy.Audit.ApiCalls.
status: draft
owner: Technical Writer
last_reviewed: 2026-07-31
library: SAIF.Business.Policy.Audit.ApiCalls
reference_type: package
---

# SAIF.Business.Policy.Audit.ApiCalls architecture

`SAIF.Business.Policy.Audit.ApiCalls` is an outbound integration layer that sits between Premium Audit callers and three downstream SAIF document and audit services. The library owns client construction, runtime configuration lookup, and payload shaping, while the downstream services own all persistence, routing, and decision-making.

## Responsibilities
- Create the three outbound clients used by Premium Audit audit-submission and document-distribution workflows.
- Translate caller data into the DTO contracts expected by the Policy Audit API, Document API, and Policy Document Distribution API.
- Propagate application, machine, and user identity to downstream services.
- Isolate secure credential retrieval for the Policy Audit API inside the `ApiCall` constructor.

## Component boundaries
- `ApiCall`: wraps authenticated Policy Audit API posts for audit-term and waive-audit flows.
- `DocumentApiCall`: wraps the older Document API distribution contract, including one generated-document distribution per request.
- `PolicyDocDistributionCall`: wraps the newer preset-driven policy document distribution contract.
- Distribution DTOs: define the on-the-wire shapes for document-routing channels, imaging metadata, recipient contacts, and preset keys.
- Configuration boundary: all runtime settings come from `SAIF.Framework.Security.AppGlobal.EnvironmentService`; the local config files only carry Oracle provider registration and assembly redirects.

## Interaction model
- Each client constructor builds `ClientInfo`, resolves the target base URL, and then constructs `JsonHttpClient` immediately.
- `ApiCall` is the only client that also resolves secure credentials and attaches `NtlmAuthenticator`; the other two clients rely on unauthenticated `JsonHttpClient` construction.
- All exposed operations are synchronous wrapper calls over `JsonHttpClient.PostJson<T>`.
- The library exposes both the older fully specified distribution path (`DistributionRequest`) and the newer preset-driven path (`PolicyDocumentConfig`).

## Architecture diagram
The following diagram shows the three outbound clients and the shared Environment API dependency that feeds their runtime configuration.

```mermaid
flowchart TD
  Caller[Premium Audit callers] --> ApiCall[ApiCall]
  Caller --> DocApi[DocumentApiCall]
  Caller --> PresetApi[PolicyDocDistributionCall]
  ApiCall --> Env[EnvironmentService]
  DocApi --> Env
  PresetApi --> Env
  ApiCall --> PolicyAudit[Policy Audit API]
  DocApi --> DocumentApi[Document API]
  PresetApi --> PresetDist[Policy Document Distribution API]
```

## Sequence diagram
The following diagram shows the document-distribution path implemented by `DocumentApiCall`.

```mermaid
sequenceDiagram
  participant Caller
  participant DocApi as DocumentApiCall
  participant Env as EnvironmentService
  participant Service as Document API
  Caller->>DocApi: new DocumentApiCall()
  DocApi->>Env: MachineName, UserId(), GetConfigSetting(documentapi.url)
  Env-->>DocApi: Caller metadata + base URL
  Caller->>DocApi: CallDocumentApi(packageName, xml, options)
  DocApi->>Service: POST /v1/distribute
  Service-->>DocApi: HTTP response
  DocApi-->>Caller: bool success
```

## Design constraints
- The library performs no local persistence, database access, or BOF business-object lifecycle work.
- Successful client construction depends on required Environment API settings being present before any method is called.
- The Document API and Policy Document Distribution API flows do not attach explicit authenticators in this library.
- `DistributionMethod<T>` uses the concrete class name as the channel discriminator, so renaming a channel type changes its emitted identifier.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Configuration](configuration.md)
- [API reference](api/index.md)

## Sources
- `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs`
- `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs`
- `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs`
- `Business\SAIF.Business.Policy.Audit.ApiCalls\DistributionMethod.cs`
- `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocumentConfig.cs`
- `Business\SAIF.Business.Policy.Audit.ApiCalls\app.config`
- `Business\SAIF.Business.Policy.Audit.ApiCalls\Web.config`