> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amlok.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify your integration

> Validate your AMLOK integration in Sandbox, including authentication, borrower authorization, underwriting, monitoring, recovery, evidence and billing.

Use this checklist to verify your application's integration with AMLOK before enabling Live traffic. Run the business and consumer journeys in Sandbox and confirm that your application handles successful results, recovery paths and permission errors.

| Area | Required observable result |
| - | - |
| Provisioning | An Owner obtains scoped keys, publishes a Hub, registers origins/return URLs and reads complete configuration |
| Authentication | Missing/invalid/revoked keys fail; wrong workspace/environment IDs and cursor chains disclose no resources |
| Permissions | Each operation enforces its documented scope; billing requires Owner authority; export and event reads recheck source access |
| Hub | Approved iframe and redirects work; unapproved origins/URLs fail; spoofed messages cannot complete sessions |
| Consent | Underwriting and monitoring purposes are explicit; missing/revoked monitoring consent blocks Signal and ongoing restricted collection |
| Inputs | Application/product/policy schemas and units are validated; your application handles document validation and rejection states |
| Insights | Your application retrieves the accepted request's package and linked usage, or handles its typed blocking/terminal state |
| Recovery | Timeout after acceptance, 24-hour replay expiry, duplicate commands and mismatched payloads do not create duplicate work/charges |
| Data | All snapshot pages plus changes contain authorized records without gaps; revoked access and removals reconcile local copies |
| Evidence | Metric/policy references resolve to the exact versions used; restricted files stay restricted; downloads match SHA-256 |
| Signal | Explicit portfolio baseline works; scheduled/changed-source evaluations preserve source coverage and prior package links |
| Deal inputs | Competing snapshot submissions accept exactly one current version; prior snapshots/results remain unchanged |
| Actions | Every requires\_action state has a typed, usable resolution; failed states expose safe structured reasons |
| Events | Every event type maps to its documented retrievable resource/version; signatures, duplicate delivery and out-of-order processing are safe |
| Exports | Complete authorized snapshot contents, format/schema and integrity match; source permission is rechecked on download |
| Billing | Pending payments do not create spendable credits; one snapshot reconciles deposits, product usage, corrections and returns |
| Signal billing | One charge per borrower/workspace/month, including multiple facilities; no duplicate charge for included reassessment |
| Limits | Effective configured upload/rate/expiry boundaries produce the documented errors; clients can discover all values |
| Cancellation | Processing and future deductions/top-ups stop immediately; closure/refund follow the documented credit policy |
| Sandbox isolation | Test controls and synthetic resources stay in Sandbox; Live requests contain no Sandbox scenario headers |

## Evidence to retain

Record the environment, contract SHA-256/revision, operational profile ID/version, test scenario, request IDs, resource IDs and observed results. Retain redacted assertions and counts; do not store API keys, provider credentials, full identity files or signed capability URLs in test logs.

## Client recovery exercise

Run the example to completion, interrupt it after command acceptance, and resume it with the same state. Independently reconcile its package, evidence, monitor, deal snapshot and billing entries. Verify both a business and a consumer fixture; applicability and missing values must remain explicit rather than forcing a business metric into consumer underwriting.

Use two distinct Sandbox workspaces to test isolation. Check that your application selects the intended environment and never reuses Sandbox IDs or test controls in Live. Use separate Owner, Dev and Analyst users for console permission checks, and independently scoped API keys for programmatic checks. UI visibility never substitutes for server authorization.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.