Travel Insured Partner Documentation

Use the certification package and synthetic identities, trips, policies, and payment data supplied for the target environment. Never copy production customer or payment data into development artifacts.

This page defines the evidence and readiness workflow a partner should prepare. The formal submission channel, named reviewers, review service levels, approval record, and production-provisioning trigger are not present in the published technical contract. Requires Travel Insured Process Owner Confirmation.

Functional Checklist

Connectivity succeeds with issued sandbox configuration.
Quote inputs produce the expected product-selection experience.
The selected purchase pattern completes exactly once.
Carry-forward identifiers are captured and not mixed between users or environments.
Search or servicing flows enforce authorization and object-level access.
Ambiguous payment or bind outcomes enter reconciliation instead of blind retry.

Negative and Boundary Checklist

Missing and malformed required input.
Expired or invalid access without secret disclosure.
Unauthorized object identifiers and cross-user access attempts.
Timeout and connection interruption before and after a state-changing request.
Duplicate submission and repeated browser events.
GraphQL responses containing errors, partial data, or absent required result fields.
Throttling behavior when the environment supports a documented test.

Security and Privacy Checklist

No credentials, tokens, card data, or unnecessary personal data in source, browser storage, logs, screenshots, traces, or reports.
Server authorization is enforced for every protected action and object.
Inputs are allowlisted and encoded with framework-safe APIs.
Browser messages validate origin and expected structure.
Dependencies and artifacts pass the team's supply-chain controls.

Accessibility Checklist

Complete keyboard operation with visible focus.
Programmatic labels, instructions, errors, and status announcements.
Logical focus after validation failures and dynamic transitions.
Reflow at 320 CSS pixels without loss of content or function.
Contrast, target size, and non-color status cues reviewed.
Automated checks supplemented by manual keyboard and assistive-technology review.

Evidence Package

Record sanitized request scenarios, expected and actual outcomes, environment label, integration model, build version, test date, owner, defects, retest results, and residual risks. Include evidence for the relevant functional, negative, authorization, security, accessibility, failure, and reconciliation cases. Do not include credentials, tokens, card data, or customer data.

Readiness Workflow

Stage	Partner responsibility	Travel Insured responsibility	Exit condition
1. Prepare	Complete the applicable checklists and assemble sanitized evidence	Provide enabled account capabilities, environment access, and any account-specific test criteria	Evidence package is complete and internally approved
2. Submit	Send the package through the approved onboarding channel and name a remediation owner	Acknowledge receipt and identify the reviewer	Submission is traceable to the partner, build, and environment
3. Review	Answer evidence questions and reproduce issues with synthetic data	Review contract behavior and identify required remediation or accepted constraints	Findings and owners are recorded
4. Remediate	Fix findings, run regression tests, and resubmit changed evidence	Re-review affected controls and contract scenarios	No blocking finding remains open
5. Approve readiness	Record partner release, security, QA, accessibility, and operations approvals	Record Travel Insured technical/process approval for the enabled scope	Both parties have a recorded readiness decision
6. Provision production	Provide final origins, contacts, and release timing	Issue or enable approved production configuration, credentials, origins, and account capabilities through a secure channel	Production access is verified server-side without a customer transaction
7. Joint launch	Deploy approved configuration, execute smoke checks, monitor, and retain rollback authority	Support activation, authoritative verification, and escalation	Launch checks pass or the agreed rollback is initiated

The exact submission mechanism, reviewer assignment, approval state name, provisioning lead time, and launch scheduling process are Requires Travel Insured Process Owner Confirmation. Do not send evidence or secrets to an unverified mailbox, ticket, or person.

Remediation and Approval Record

For every finding, record severity, affected scenario, owner, due date, resolution, regression evidence, and residual risk decision. Security-sensitive changes require human review. Automated accessibility checks support but do not replace manual keyboard and assistive-technology review; readiness approval is not a claim of comprehensive WCAG conformance.

Continue with Production Readiness.