--- id: CAP-PFM-INT-012 title: Exercise a provider capability on a test account feature: FEAT-PFM-INT-03 product_area: platform module: integrations revision: 1 status: draft product_intent: proposed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f intent_sources: - 'services-platform:docs/milestones/INTG-M2-calls-through-the-gateway.md#M2-D1' - 'services-platform:docs/milestones/INTG-M2-calls-through-the-gateway.md#M2-D1a' - 'services-platform:docs/milestones/INTG-M2-calls-through-the-gateway.md#M2-D1b' - 'services-platform:docs/milestones/INTG-M2-calls-through-the-gateway.md#M2-D1c' purpose: Administrators check a provider operation using an account identified by the provider as a test account. outcomes: - Provider-reported live or unknown accounts cannot receive Library test calls. - Test operations identify their initiating person and retain real gateway history. concepts: - CON-PFM-INT-003 - CON-PFM-INT-002 actors: - ACT-PFM-017 surfaces: - console - api preconditions: [] postconditions: [] permissions: - key: platform.integrations.manage where_checked: api scope: tenant - key: platform.integrations.manage where_checked: console scope: tenant rules: - id: BR-CAP-PFM-INT-012-01 proved_by: [ATS-PFM-INT-012-01, TST-PFM-INT-484] statement: >- Library test invocation requires a provider-reported test account; live and unreported account environments are refused before execution recording. kind: policy enforced_at: - api - service must_prove: true provenance: test source: >- services-platform:modules/integrations/tests/e2e/connection-try.e2e.spec.js#is refused 409 connection_not_test when the provider reported a live account, and no execution is recorded origin: 'services-platform:docs/milestones/INTG-M2-calls-through-the-gateway.md#M2-D1c' - id: BR-CAP-PFM-INT-012-02 proved_by: [ATS-PFM-INT-012-02, TST-PFM-INT-484] statement: >- Existing integration-manage authority permits a person to try a call, with no additional permission and no records for unauthorized attempts. kind: permission enforced_at: - api - console must_prove: true provenance: test source: >- services-platform:modules/integrations/tests/e2e/connection-try.e2e.spec.js#is refused 403 and no execution or audit row is recorded origin: 'services-platform:docs/milestones/INTG-M2-calls-through-the-gateway.md#M2-D1b' - id: BR-CAP-PFM-INT-012-03 proved_by: [ATS-PFM-INT-012-03, TST-PFM-INT-484] statement: >- The selected connection must be active or degraded and verified for the capability, with suspended and unsupported cases refused distinctly. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/integrations/tests/e2e/connection-try.e2e.spec.js#is refused 409 connection_unavailable when it is suspended origin: none - id: BR-CAP-PFM-INT-012-04 proved_by: [ATS-PFM-INT-008-11, ATS-PFM-INT-009-18, ATS-PFM-INT-012-04, ATS-PFM-INT-012-07, ATS-PFM-INT-012-08, TST-PFM-INT-340, TST-PFM-INT-484] statement: >- The Library invokes through the gateway directly on the selected connection without a binding, as its test application for the person and with a new idempotency key each time. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/integrations/tests/e2e/connection-try.e2e.spec.js#records an execution of that connection by the calling application library_try on behalf of the person, with no binding origin: 'services-platform:docs/milestones/INTG-M2-calls-through-the-gateway.md#M2-D1a' - id: BR-CAP-PFM-INT-012-05 proved_by: [ATS-PFM-INT-012-05, TST-PFM-INT-484] statement: 'Test-call history identifies the person, capability and resulting execution.' kind: invariant enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/integrations/tests/e2e/connection-try.e2e.spec.js#writes a connection.test_call audit row naming the capability, the execution and the person origin: none - id: BR-CAP-PFM-INT-012-06 proved_by: [ATS-PFM-INT-012-06, TST-PFM-INT-516] statement: >- Account checks replace a prior environment with the provider’s valid test or live report; missing or other values leave environment unknown without failing verification. kind: calculation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/integrations/tests/integration/services/connections/connection-account-environment.integration.spec.js#records test when the provider reports a test account origin: 'services-platform:docs/milestones/INTG-M2-calls-through-the-gateway.md#M2-D1c' - id: BR-CAP-PFM-INT-012-07 proved_by: [] statement: >- Try a call is shown on connection detail only to integration managers for usable provider-reported test accounts. kind: policy enforced_at: - console must_prove: true provenance: observed source: 'react-console:components/integrations/try-a-call.tsx:accountEnvironment !== "test"' origin: 'services-platform:docs/milestones/INTG-M2-calls-through-the-gateway.md#M2-D1a' scenarios: - id: SC-CAP-PFM-INT-012-01 given: The provider describes its connected account as test. when: An administrator authorizes twelve dollars through Try a call. then: Activity retains the test execution with the initiating person. provenance: test source: 'react-console:acceptance/integrations/playwright/journeys/providers/INT-ACC-0706.spec.ts#INT-ACC-0706' edge_cases: [] constraints: [] depends_on: - CAP-PFM-INT-009 - CAP-PFM-INT-004 related: - CAP-PFM-INT-008 journeys: - JNY-PFM-INT-003 open_questions: [] evidence: - >- services-platform source inventory: modules/integrations/services/executions/try-connection.ts, aws/api/connection-try.routes.ts, connections/verify-connection.ts (account environment); rule-level automated test references; docs/milestones/INTG-M2-calls-through-the-gateway.md (M2-D1, M2-D1a to M2-D1c). - >- react-console source inventory: components/integrations/try-a-call.tsx, lib/integrations/try-a-call.ts; acceptance journeys INT-ACC-0332, 0706. - 'Operation coverage: tryIntegrationConnectionCall.' - 'Persistent record coverage: integration_executions, integration_connections.' - 'End-to-end definition inventory: connection-try.e2e.spec.js.' controls: [TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-PI-001, TC-PI-002, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-INT-03-01, FAS-PFM-INT-03-04] suites: [TST-PFM-INT-340, TST-PFM-INT-484, TST-PFM-INT-516] --- # Exercise a provider capability on a test account ## Purpose Administrators check a provider operation using an account identified by the provider as a test account. ## How It Works An administrator opens a usable test connection and chooses Try a call. The provider’s account description supplies the test boundary. The panel sends a real gateway operation on that selected account. Activity and connection history then provide the same investigation surfaces as ordinary calls. A fresh request identity distinguishes repeated test attempts. A live or unclassified account does not receive this control. Readers can inspect results without initiating a test. The product should retain the provider-reported boundary when adding more test operations. ## Relationships - Requires run provider operations safely through the gateway to supply the prerequisite configuration or operation. - Requires maintain a verified provider account connection to supply the prerequisite configuration or operation. - Connects with explain and select the connection for a call through shared integration records.