---
title: Resolve base URL and authenticate
summary: Resolves a Guidewire client's base URL and Basic-auth header, and executes cached requests.
status: draft
owner: SAIF.Core documentation team
last_reviewed: 2026-09-24
library: SAIF.Data.Guidewire
reference_type: package
operation_id: OP-SDG-01
trigger: Client construction (base URL) and first request with a non-blank AuthKey (credentials)
---

# Resolve base URL and authenticate

This operation is the shared pipeline every Guidewire client runs through: it resolves the client's base URL and Basic-auth credentials from configuration, then executes GET/POST calls through an optional Polly cache policy, all implemented once in `HttpClientBase` and reused by all five concrete clients.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-SDG-01 |
| **Trigger** | Client construction (base URL); first request when `AuthKey` is set (credentials) |
| **Inputs** | `UrlKey`, `AuthKey`, `IDataClientConfiguration` (`SystemType`, `SystemName`, `UseCache`, `CachePolicyKey`, `MaxCacheDuration`) |
| **Outputs** | Configured `HttpClient` with `BaseAddress` and `Authorization` header set; cached or direct HTTP response |
| **Primary components** | `HttpClientBase` |
| **Entry point** | `Data/SAIF.Data.Guidewire/Clients/HttpClientBase.cs` |

## Steps

1. On construction, set `client.BaseAddress = IEnvironmentService.GetConfigSetting(UrlKey)`. ([SDG-BR-001](../business-rules.md#sdg-br-001-base-url-resolved-from-environment-configuration))
   - `GetConfigSetting` is resolved eagerly, so a missing `UrlKey` fails at DI resolution time rather than at first request.*
   - `GetConfigSetting(UrlKey)`† is implemented in `IEnvironmentService` in `SAIF.Framework.Core` (retrieved via the Legends CLI RAG service) and executed on behalf of this operation.

   > **Origin**: Step 1.1† is implemented in `GetConfigSetting` in `SAIF.Framework.Core` (retrieved via the Legends CLI RAG service) and executed on behalf of this operation.
2. On first request, if `AuthKey` is set, compute the system hash. ([SDG-BR-002](../business-rules.md#sdg-br-002-basic-credentials-read-from-secure-configuration))
   - If `IDataClientConfiguration.SystemName` is set: call `SystemHashUtil.ComputeHash(SystemType, SystemName)`.†
   - Otherwise: call `SystemHashUtil.Get(SystemType)`.†

   > **Origin**: Steps 2.1–2.2† are implemented in `ComputeHash` / `Get` in `SAIF.HashUtil` (retrieved via the Legends CLI RAG service) and executed on behalf of this operation.
3. Read `GetSecureConfigSetting(AuthKey, hash)`, split the result on `|` into user and password, and set the `Authorization: Basic base64(user:password)` header on the `HttpClient`. ([SDG-BR-002](../business-rules.md#sdg-br-002-basic-credentials-read-from-secure-configuration))
   - The split result is indexed without a length check, so a value not in `user|password` format is not defensively validated.*
4. For a cached GET/POST call, build the cache key `{Type}-{url}-{ensureSuccess}[-bodyhash]` and execute it through the Polly cache policy looked up by `IDataClientConfiguration.CachePolicyKey`. ([SDG-BR-003](../business-rules.md#sdg-br-003-responses-cached-unless-caching-is-disabled))
   - If `UseCache` is `false` (including every obsolete constructor): use a NoOp policy instead, so every call executes directly.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start(["Trigger: construction / first request"]) --> S1["Set BaseAddress from<br>GetConfigSetting UrlKey"]
	S1 --> S2{"AuthKey set?"}
	S2 -->|No| S4[Execute request]
	S2 -->|Yes| S3a["Compute system hash via<br>SystemHashUtil"]
	S3a --> S3b["Read GetSecureConfigSetting<br>and set Authorization header"]
	S3b --> S4
	S4 --> S5{"Cached call and UseCache true?"}
	S5 -->|Yes| S6[Execute via Polly cache policy]
	S5 -->|No| S7[Execute via NoOp policy]
	S6 --> EndOk([Return response])
	S7 --> EndOk
```

## Failure and edge-case behavior
- A missing `UrlKey` environment setting fails at DI resolution time, before any request is attempted.*
- A malformed secure credential (not `user|password`) is not defensively validated and may throw when split/indexed.*
- The obsolete `[Obsolete]` constructors force `UseCache = false`, so every call from a client built that way bypasses the Polly cache entirely.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

> **Note:** Statements marked with `†` are derived from dependency library
> documentation via the Legends CLI. Statements marked with `*` were inferred
> from code structure or contextual evidence.

## Sources
- `Data/SAIF.Data.Guidewire/Clients/HttpClientBase.cs`
- `Data/SAIF.Data.Guidewire/Clients/DataClientConfiguration.cs`
- `Data/SAIF.Data.Guidewire/Clients/IDataClientConfiguration.cs`