UAT checklist

Use a dedicated UAT enterprise arranged with GOFA. This checklist describes how to verify your integration; it is not a statement that your enterprise has already been provisioned or passed acceptance.

Open the three roles

GOFA configures access, credit grants, and effective limits on its side. Your technical team does not need access to GOFA's internal administrator console.

1. Establish a baseline

• Confirm the enterprise identity, enabled services, key scopes, and key expiry.
• Confirm approved return origins and defaults for both services.
• Record the starting balance, grant expiry, and configured service rates.
• Keep a stable opaque reference for the test customer and save every created Inquiry ID.

2. Run AI Nutrition

1. Sign in on your UAT website and request one AI Nutrition assessment.
2. Verify the backend uses workflowId: "ai-nutrition" and stores ownership of the returned Inquiry.
3. Open the returned URL, confirm the service declaration, and upload a permitted meal sample.
4. Complete analysis and check the saved result through the retrieval API.
5. Return to your website. Verify it shows the result for the same Inquiry and customer.
6. Refresh the return page. Verify the result remains available without another analysis.
7. Check Inquiries and usage history: one completed Inquiry, one settled usage entry at the configured rate.

3. Run Vital Scan on a real device

1. Create a new vital-scan Inquiry from your website.
2. Confirm the declaration, enter the required information, and allow camera access.
3. Complete the scan, continue to the completion page, and return to your website.
4. Verify a saved vital-scan result through the API and one settled usage entry.
5. Refresh the return page and confirm no extra charge or new Inquiry.

A simulated camera test does not replace acceptance on the browsers and devices your customers will use. Arrange an adult tester for camera and permission checks.

4. Verify interruption and retry

Use the Inquiry ID to correlate evidence. Do not create a new task to hide a failed retry; record the issue and its exact request ID instead.

5. Verify authorization and limits

• With a second authorized test customer, verify that changing inquiry_id cannot disclose the first customer's result through your website. Record this as blocked if you do not have a second account; do not mark it passed.
• Verify that a non-approved return origin is rejected.
• Confirm expired or revoked API keys cannot read enterprise results.
• Coordinate a small, isolated rate/concurrency test with GOFA. Respect 429 and Retry-After; do not load-test the shared UAT service without an agreed plan.
• Confirm failed/pending tasks do not appear as successful settled usage. Allow outstanding processing or reservation leases to finish before reconciling balances.

Record acceptance

For each case, record the date, browser/device, enterprise, service, Inquiry ID, expected result, observed result, and pass/fail/blocked status. Keep screenshots free of secrets and unnecessary personal information.

Before production, agree the production domain, enterprise provisioning, credentials, return origins, service configuration, credit terms, capacity, and approved user notices with GOFA. UAT credentials and acceptance do not enable production automatically.