---
title: SAIF.Business.Policy.Audit.ApiCalls business rules
summary: Enumerated business rules for SAIF.Business.Policy.Audit.ApiCalls.
status: draft
owner: Technical Writer
last_reviewed: 2026-07-31
library: SAIF.Business.Policy.Audit.ApiCalls
reference_type: package
---

# SAIF.Business.Policy.Audit.ApiCalls business rules

This page captures the rules enforced by `SAIF.Business.Policy.Audit.ApiCalls`.

## BR-AAC-001: Outbound clients identify as PremiumAudit

| Field | Value |
| --- | --- |
| **Statement** | All outbound API clients from this library stamp `ClientInfo.ApplicationId` with `"PremiumAudit"`. |
| **Trigger** | Any API client is constructed. |
| **Enforcement** | The constructors for `ApiCall`, `DocumentApiCall`, and `PolicyDocDistributionCall` assign the fixed application identifier before building `JsonHttpClient`. |
| **Outcome** | Downstream services receive a consistent caller-application identity. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs`, `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs`, `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs` |

---

## BR-AAC-002: Outbound clients propagate machine and user identity

| Field | Value |
| --- | --- |
| **Statement** | All outbound API clients propagate the current machine name and environment-service user ID in `ClientInfo`. |
| **Trigger** | Any API client is constructed. |
| **Enforcement** | Each constructor reads `EnvironmentService.MachineName` and `EnvironmentService.UserId()` and copies those values into `ClientInfo`. |
| **Outcome** | Downstream services can attribute requests to the submitting workstation and user. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs`, `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs`, `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs` |

---

## BR-AAC-003: API base URLs come from environment settings

| Field | Value |
| --- | --- |
| **Statement** | Each API client resolves its base URL from an Environment API setting instead of hard-coding the host address. |
| **Trigger** | Any API client is constructed. |
| **Enforcement** | `ApiCall`, `DocumentApiCall`, and `PolicyDocDistributionCall` call `EnvironmentService.GetConfigSetting(...)` with their respective setting keys before creating the request URI. |
| **Outcome** | Endpoint selection stays environment-specific and external to source code. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs`, `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs`, `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs` |

---

## BR-AAC-004: Policy Audit API credentials come from a secure setting

| Field | Value |
| --- | --- |
| **Statement** | The Policy Audit API client retrieves its NTLM credential pair from secure setting `gwcommon.gw_lg_pc_pr_service`, unlocked with `SystemHashUtil.ComputeHash(SystemType.WebApp, "PolicyAuditAPI")`. |
| **Trigger** | `ApiCall` is constructed. |
| **Enforcement** | `ApiCall` calls `EnvironmentService.GetSecureConfigSetting(...)` with the fixed key and hash subject before creating the authenticator. |
| **Outcome** | The credential value is supplied at runtime instead of being embedded in source. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs` |

---

## BR-AAC-005: Policy Audit credentials must split into user and password

| Field | Value |
| --- | --- |
| **Statement** | The secure Policy Audit API credential value must produce a two-part `username|password` pair for NTLM authentication. |
| **Trigger** | `ApiCall` builds its authenticator. |
| **Enforcement** | `ApiCall` splits the secure-setting value on `|` and passes element 0 and element 1 to `NtlmAuthenticator`. |
| **Outcome** | `ApiCall` can only construct its NTLM-authenticated client when the secure setting preserves that two-part format. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs` |

---

## BR-AAC-006: Callers choose the Policy Audit API route

| Field | Value |
| --- | --- |
| **Statement** | The Policy Audit API route is chosen by the caller-supplied `method` argument, not by an internal route lookup. |
| **Trigger** | `PolicyAuditAPICall` or `WaiveAPICall` is invoked. |
| **Enforcement** | Both methods pass the received `method` argument directly to `_api.PostJson<bool>(...)`. |
| **Outcome** | Different Policy Audit API routes can be targeted without changing this library. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs` |

---

## BR-AAC-007: Audit submission success comes from the first boolean result

| Field | Value |
| --- | --- |
| **Statement** | `PolicyAuditAPICall` reports success by returning the first boolean element from the response wrapper's `Results` collection. |
| **Trigger** | `PolicyAuditAPICall` returns to its caller. |
| **Enforcement** | The method evaluates `result.Results.FirstOrDefault()` and returns that value. |
| **Outcome** | A missing or empty result set yields `false` to the caller. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs` |

---

## BR-AAC-008: Waive-audit submission returns the wrapper string

| Field | Value |
| --- | --- |
| **Statement** | `WaiveAPICall` returns the response wrapper object's string representation instead of a boolean payload value. |
| **Trigger** | `WaiveAPICall` returns to its caller. |
| **Enforcement** | The method calls `_api.PostJson<bool>(...)` and then returns `result.ToString()`. |
| **Outcome** | Callers receive a textual wrapper representation rather than a decision flag. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs` |

---

## BR-AAC-009: Only the Policy Audit API client attaches an authenticator

| Field | Value |
| --- | --- |
| **Statement** | `DocumentApiCall` and `PolicyDocDistributionCall` construct `JsonHttpClient` without supplying an authenticator; only `ApiCall` attaches NTLM credentials. |
| **Trigger** | Any client constructor runs. |
| **Enforcement** | `ApiCall` passes an `NtlmAuthenticator` into `JsonHttpClient`, while the other two constructors pass only the URI and `ClientInfo`. |
| **Outcome** | Authentication behavior differs by downstream service. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs`, `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs`, `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs` |

---

## BR-AAC-010: Document API requests use submitter name PremAudit

| Field | Value |
| --- | --- |
| **Statement** | Document API distribution requests are submitted with `DistributionRequest.Username = "PremAudit"`. |
| **Trigger** | `CallDocumentApi` assembles a request. |
| **Enforcement** | `DocumentApiCall.CallDocumentApi` assigns the fixed username before posting the payload. |
| **Outcome** | The downstream Document API sees a consistent submitter identity for this flow. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs` |

---

## BR-AAC-011: Document API requests carry exactly one distribution entry

| Field | Value |
| --- | --- |
| **Statement** | Each call to `CallDocumentApi` builds a single-element `Distributions` array. |
| **Trigger** | `CallDocumentApi` assembles a request. |
| **Enforcement** | The method instantiates one `DistributionConfig` inside a one-item array. |
| **Outcome** | Each invocation submits exactly one distribution configuration. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs` |

---

## BR-AAC-012: Null distribution time means immediate distribution

| Field | Value |
| --- | --- |
| **Statement** | Document API requests leave `DistributionTime` null to indicate immediate distribution. |
| **Trigger** | `CallDocumentApi` builds its `DistributionConfig`. |
| **Enforcement** | `DocumentApiCall.CallDocumentApi` assigns `DistributionTime = null`, matching the inline comment on `DistributionConfig.DistributionTime`. |
| **Outcome** | The request does not schedule a future send time. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs`, `Business\SAIF.Business.Policy.Audit.ApiCalls\DistributionConfig.cs` |

---

## BR-AAC-013: Document API output profile is PDF

| Field | Value |
| --- | --- |
| **Statement** | Document API requests emitted by this library always use `DocumentConfig.OutputProfile = "PDF"`. |
| **Trigger** | `CallDocumentApi` builds `DocumentConfig`. |
| **Enforcement** | The method assigns the fixed output profile literal before posting the request. |
| **Outcome** | Generated documents are requested in PDF format. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs` |

---

## BR-AAC-014: Document API recipient is the policy holder

| Field | Value |
| --- | --- |
| **Statement** | Document API requests emitted by this library target recipient ID `PH`. |
| **Trigger** | `CallDocumentApi` builds `DocumentConfig`. |
| **Enforcement** | The method assigns `RecipientId = "PH"`. |
| **Outcome** | The document package is addressed to the policy-holder recipient class. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs` |

---

## BR-AAC-015: Document API requests omit cover sheets and special handling

| Field | Value |
| --- | --- |
| **Statement** | Document API requests emitted by this library leave banner instructions and special handling empty and populate `CoverSheets` with a single empty string. |
| **Trigger** | `CallDocumentApi` builds `DocumentConfig`. |
| **Enforcement** | The method assigns empty strings for `BannerInstructions` and `SpecialHandling` and uses `new[] { "" }` for `CoverSheets`. |
| **Outcome** | The request is sent without additional cover-sheet or handling directives. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs` |

---

## BR-AAC-016: Document API success requires HTTP 200

| Field | Value |
| --- | --- |
| **Statement** | `CallDocumentApi` returns `true` only when the response status code equals `HttpStatusCode.OK`. |
| **Trigger** | `CallDocumentApi` processes a response. |
| **Enforcement** | The method checks `response.StatusCode == HttpStatusCode.OK` and otherwise falls through to `false`. |
| **Outcome** | Non-200 responses are reported as unsuccessful. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs` |

---

## BR-AAC-017: Document API exceptions are swallowed and reported as failure

| Field | Value |
| --- | --- |
| **Statement** | `CallDocumentApi` catches all exceptions, writes the exception message to `Console`, and returns `false`. |
| **Trigger** | An exception is thrown during request assembly or posting. |
| **Enforcement** | The method wraps the post in `try/catch`, calls `Console.WriteLine(e.Message)`, and does not rethrow. |
| **Outcome** | The caller sees a boolean failure result rather than an exception. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs` |

---

## BR-AAC-018: Preset-based distribution always reports success

| Field | Value |
| --- | --- |
| **Statement** | `DistributeApiCall` returns `true` without inspecting the `RequestResult` returned by the Policy Document Distribution API. |
| **Trigger** | `DistributeApiCall` returns to its caller. |
| **Enforcement** | The method stores `_documentApi.PostJson<RequestResult>(...)` in a local `response` variable and immediately returns `true`. |
| **Outcome** | The caller cannot distinguish accepted, rejected, or failed preset distributions from this method's return value. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs` |

---

## BR-AAC-019: Contacts serialize to three allowed recipient codes

| Field | Value |
| --- | --- |
| **Statement** | Contact payloads use only three recipient type codes: policy holder (`PH`), agent (`AG`), and third party (`3P`). |
| **Trigger** | A `ContactType` value is resolved for a policy-document payload. |
| **Enforcement** | `Contact.ValidContactTypes` defines the canonical mapping and each concrete subclass returns the mapped code for its own role. |
| **Outcome** | Serialized preset-distribution contacts stay within the service contract's three supported recipient classes. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocumentConfig.cs` |

---

## BR-AAC-020: Only configured recipient codes are valid

| Field | Value |
| --- | --- |
| **Statement** | A contact type is valid only when it matches one of the values stored in `ValidContactTypes`. |
| **Trigger** | `Contact.IsValidContactType` is called. |
| **Enforcement** | The method checks `ValidContactTypes.Values.Contains(contactType)`. |
| **Outcome** | Validation succeeds only for `PH`, `AG`, or `3P`. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocumentConfig.cs` |

---

## BR-AAC-021: Carbon-copy names depend on contact role

| Field | Value |
| --- | --- |
| **Statement** | Carbon-copy naming differs by contact role: policy holders return an empty value, agents return either the formatted name or `"name, agency"`, and third parties return the formatted name. |
| **Trigger** | The `CCName` contract is evaluated for a contact. |
| **Enforcement** | Each `Contact` subclass overrides `CCName` with role-specific formatting logic. |
| **Outcome** | The preset-distribution payload can populate CC metadata consistently for each recipient class. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocumentConfig.cs` |

---

## BR-AAC-022: Distribution channels identify themselves by class name

| Field | Value |
| --- | --- |
| **Statement** | Each distribution channel advertises its discriminator through `DistributionMethodType = typeof(T).Name`. |
| **Trigger** | A distribution-channel option is serialized or inspected. |
| **Enforcement** | `DistributionMethod<T>` exposes a read-only `DistributionMethodType` property that returns the generic argument's class name. |
| **Outcome** | Channel selection travels on the wire as the concrete option class name. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\DistributionMethod.cs` |

---

## BR-AAC-023: This library persists no local state

| Field | Value |
| --- | --- |
| **Statement** | This library performs no direct database persistence or local business-object lifecycle work; it only shapes payloads and posts them to downstream services. |
| **Trigger** | Any documented operation runs. |
| **Enforcement** | The project contains only HTTP client logic, DTO contracts, config access, and no data-access APIs or BOF business-object types. |
| **Outcome** | Audit, document, and preset-distribution state changes occur in downstream services rather than in this repository. |
| **Confidence** | Verified |
| **Source** | `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs`, `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs`, `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs` |

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Security and authorization](security-authorization.md)
- [Configuration](configuration.md)
- [API reference](api/index.md)

## Sources
- `Business\SAIF.Business.Policy.Audit.ApiCalls\ApiCall.cs`
- `Business\SAIF.Business.Policy.Audit.ApiCalls\DocumentApiCall.cs`
- `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocDistributionCall.cs`
- `Business\SAIF.Business.Policy.Audit.ApiCalls\PolicyDocumentConfig.cs`
- `Business\SAIF.Business.Policy.Audit.ApiCalls\DistributionMethod.cs`
- `Business\SAIF.Business.Policy.Audit.ApiCalls\DistributionConfig.cs`