Contract authority: OpenAPI is the machine-readable public v1 contract. This page is generated from the Privilege Integrator Pack. If prose and OpenAPI disagree, stop and contact Privilege.

14. Testing / sandbox status

Capability	Status
Dedicated external developer sandbox	Not available
Self-serve test-token portal	Not available
Partner Portal Integrations (merchant self-service)	Not available yet — coordinate with Privilege
Member App opaque POS credential for end-customer testing	Coordinate test tokens with Privilege
POS contract-readiness on production API	Available (deployed); not vendor certification
Third-party vendor POS end-to-end in production	Not independently verified with live vendor POS systems
Privilege-controlled API lifecycle (validate → confirm/cancel/reverse + idempotency)	Available on the production API host

Interim onboarding procedure (manual)

Coordinate with Privilege — this is a procedure, not an automated portal:

1. Agree on one test merchant/profile and one test outlet.
2. Privilege provisions a dedicated test Integration Client (do not reuse unrelated production pilot credentials casually).
3. Privilege maps one test externalOutletId → Privilege outlet (or confirms the mapping with you).
4. Privilege supplies or coordinates a controlled test opaque redemption credential (not self-serve).
5. Vendor runs validate → confirm and/or cancel (and reverse if in scope).
6. Privilege verifies audit / commercial outcome.
7. Privilege disables or retires the test integration when finished.

Do not claim automated sandbox issuance, unlimited self-serve test tokens, or that Partner Portal Integrations is already live.

---

15. Go-live checklist

• [ ] Production Integration Client created for the correct company/profile (via Privilege coordination until Partner Portal Integrations is available)
• [ ] clientKey / clientSecret stored securely (server-side only)
• [ ] Outlet mappings configured and verified (externalOutletId)
• [ ] validate returns reserved with privilegePromotionId, benefit: null, expiresAt
• [ ] confirm returns confirmed after successful till sale
• [ ] cancel tested for abandoned checkout
• [ ] reverse understood/tested if your product will use it (window policy still UNRESOLVED)
• [ ] Idempotency keys unique per logical operation; timeout retries reuse the same key
• [ ] Network timeout / retry behavior tested
• [ ] requestId / X-Request-Id logged on your side
• [ ] Credential rotation procedure understood
• [ ] Support contact agreed with Privilege
• [ ] Real end-to-end checkout test completed with Privilege confirmation

---

16. Support / escalation

Agree the technical support contact with Privilege during onboarding. Do not assume a public SLA from this document.

When escalating, provide:

• requestId (from error body or X-Request-Id)
• Timestamp + timezone
• Operation (validate / confirm / cancel / reverse)
• externalOutletId
• HTTP status + error.code
• Your own POS correlation / receipt reference

Never send clientSecret or full opaque tokens in email/chat. Prefer secret prefixes only if Privilege asks for identity hints.

---