{
  "info": {
    "_postman_id": "nic-general-api-v1",
    "name": "NIC General Public Open API",
    "description": "Third-party REST API for binding insurance policies across every line of business through NIC IMIS.\n\n## Setup\n\n1. Import this collection.\n2. Import the companion environment (`general_api.postman_environment.json`) **or** run\n   `python manage.py general_api_mint_test_credentials` on the server and paste the\n   resulting JSON block via *File → Import → Raw text*.\n3. In the environment, fill in `api_key`, `api_secret`, and `base_url`.\n4. Run *Auth & Discovery → List available products* to populate `{{product_id}}` automatically.\n5. Run *Submission → Submit full proposal* — `{{partner_reference}}` is auto-bumped on every send and `{{submission_id}}` is captured for the status request.\n\n## Variables\n\n| Variable | Filled by | Notes |\n| --- | --- | --- |\n| `base_url` | environment | e.g. `http://localhost:8008/uat/mware/general/v1` |\n| `api_key` | environment | `API-KEY` header value |\n| `api_secret` | environment | `API-SECRETE` header value |\n| `product_id` | *List available products* test script | Picks the first eligible product. |\n| `partner_reference` | *Submit proposal* pre-request | Auto-bumped `GENERAL-API-POSTMAN-<epoch>` if empty. |\n| `submission_id` | *Submit proposal* test script | Echoed by status request. |\n",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "auth": {
    "type": "apikey",
    "apikey": [
      {"key": "key", "value": "API-KEY", "type": "string"},
      {"key": "value", "value": "{{api_key}}", "type": "string"},
      {"key": "in", "value": "header", "type": "string"}
    ]
  },
  "event": [
    {
      "listen": "prerequest",
      "script": {
        "type": "text/javascript",
        "exec": [
          "// Inject the API-SECRETE header on every request, since Postman's",
          "// `apikey` auth scheme only handles one header at a time.",
          "pm.request.headers.upsert({",
          "    key: 'API-SECRETE',",
          "    value: pm.environment.get('api_secret') || ''",
          "});"
        ]
      }
    },
    {
      "listen": "test",
      "script": {
        "type": "text/javascript",
        "exec": [
          "// Global response sanity checks shared across every request.",
          "pm.test('content-type is JSON', function () {",
          "    pm.expect(pm.response.headers.get('content-type') || '').to.match(/application\\/json/);",
          "});"
        ]
      }
    }
  ],
  "variable": [
    {"key": "base_url", "value": "http://localhost:8008/uat/mware/general/v1"},
    {"key": "product_id", "value": ""},
    {"key": "filter_tag", "value": ""},
    {"key": "partner_reference", "value": ""},
    {"key": "submission_id", "value": ""}
  ],
  "item": [
    {
      "name": "Auth & Discovery",
      "item": [
        {
          "name": "List filter tags",
          "request": {
            "method": "GET",
            "header": [],
            "url": {"raw": "{{base_url}}/filter-tags/", "host": ["{{base_url}}"], "path": ["filter-tags", ""]},
            "description": "Returns the catalogue of product-class filter tags currently exposed to partners. Use a `filter_tag` value with `GET /products/?filter_tag=<tag>` to narrow the product list."
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test('200 OK', () => pm.response.to.have.status(200));",
                  "const json = pm.response.json();",
                  "pm.test('payload has results array', () => pm.expect(json.results).to.be.an('array'));",
                  "if (json.results && json.results.length) {",
                  "    pm.environment.set('filter_tag', json.results[0].filter_tag);",
                  "    console.log('filter_tag →', json.results[0].filter_tag);",
                  "}"
                ]
              }
            }
          ]
        },
        {
          "name": "List products (filtered by tag)",
          "request": {
            "method": "GET",
            "header": [],
            "url": {
              "raw": "{{base_url}}/products/?filter_tag={{filter_tag}}",
              "host": ["{{base_url}}"],
              "path": ["products", ""],
              "query": [{"key": "filter_tag", "value": "{{filter_tag}}"}]
            },
            "description": "Narrow the product catalogue to a single product class. Uses `{{filter_tag}}` set by the *List filter tags* request."
          }
        },
        {
          "name": "List available products",
          "request": {
            "method": "GET",
            "header": [],
            "url": {"raw": "{{base_url}}/products/", "host": ["{{base_url}}"], "path": ["products", ""]},
            "description": "Returns every approved, non-rider product eligible for the partner API. The first item is captured into `{{product_id}}` for downstream requests."
          },
          "response": [
            {
              "name": "200 OK",
              "originalRequest": {"method": "GET", "header": [], "url": {"raw": "{{base_url}}/products/"}},
              "status": "OK",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [{"key": "Content-Type", "value": "application/json"}],
              "body": "{\n  \"status\": true,\n  \"count\": 8,\n  \"results\": [\n    {\n      \"id\": 111,\n      \"code\": \"GIT01\",\n      \"name\": \"Goods In Transit\",\n      \"description\": \"This policy provides coverage to in land transit goods.\",\n      \"tira_code\": null,\n      \"policy_term\": 1,\n      \"policy_term_unit\": \"years\",\n      \"vat_apply\": true,\n      \"line_business\": {\"id\": 5, \"code\": \"LB04\", \"name\": \"General Insurance\"},\n      \"product_class\": {\"id\": 23, \"code\": \"MC01\", \"name\": \"General Cargo\"},\n      \"form_url\": \"http://localhost:8008/uat/mware/general/v1/products/111/form/\"\n    }\n  ]\n}"
            }
          ],
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test('200 OK', () => pm.response.to.have.status(200));",
                  "const json = pm.response.json();",
                  "pm.test('payload has results array', () => pm.expect(json.results).to.be.an('array'));",
                  "if (json.results && json.results.length) {",
                  "    pm.environment.set('product_id', json.results[0].id);",
                  "    console.log('product_id →', json.results[0].id, '(' + json.results[0].name + ')');",
                  "}"
                ]
              }
            }
          ]
        },
        {
          "name": "Get product form schema",
          "request": {
            "method": "GET",
            "header": [],
            "url": {
              "raw": "{{base_url}}/products/{{product_id}}/form/",
              "host": ["{{base_url}}"],
              "path": ["products", "{{product_id}}", "form", ""]
            },
            "description": "Returns the dynamic form for the selected product. Use the `api_tag` of each field as the JSON key in the `answers` block of the proposal submission."
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test('200 OK', () => pm.response.to.have.status(200));",
                  "const json = pm.response.json();",
                  "pm.test('has sections array', () => pm.expect(json.sections).to.be.an('array'));",
                  "if (json.sections && json.sections.length) {",
                  "    const all_tags = [];",
                  "    json.sections.forEach(s => (s.fields || []).forEach(f => all_tags.push(f.api_tag)));",
                  "    console.log('api_tags →', all_tags.slice(0, 20).join(', '));",
                  "}"
                ]
              }
            }
          ]
        }
      ]
    },
    {
      "name": "Submission",
      "item": [
        {
          "name": "Submit fully-valid proposal (all 22 required answers)",
          "request": {
            "method": "POST",
            "header": [{"key": "Content-Type", "value": "application/json"}],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"partner_reference\": \"{{partner_reference}}\",\n  \"product_id\": {{product_id}},\n  \"commencement_date\": \"2026-06-01\",\n  \"end_date\": \"2027-05-31\",\n  \"sum_insured\": 50000000,\n  \"property_name\": \"BL-2026-001 — Container TGHU1234567\",\n  \"underwrite_channel\": 5,\n  \"customer\": {\n    \"first_name\": \"Jamhuri\",\n    \"middle_name\": \"Ya\",\n    \"last_name\": \"Muungano\",\n    \"email\": \"ops@partner.example\",\n    \"phone\": \"+255700000000\",\n    \"identity_number\": \"19900101-12345-12345-12\",\n    \"gender\": \"M\",\n    \"date_of_birth\": \"01-01-1990\"\n  },\n  \"callbacks\": {\n    \"control_number\":    \"https://partner.example/webhooks/cn\",\n    \"approval_status\":   \"https://partner.example/webhooks/approval\",\n    \"approval_decision\": \"https://partner.example/webhooks/decision\",\n    \"payment\":           \"https://partner.example/webhooks/pay\",\n    \"tira_status\":       \"https://partner.example/webhooks/tira\",\n    \"commencement\":      \"https://partner.example/webhooks/commence\"\n  },\n  \"answers\": {\n    \"currency_type\": \"TZS\",\n    \"nature_of_business/occupation\": \"FREIGHT FORWARDER\",\n    \"description(s)_of_good(s)_to_be_dispatched\": \"DRY GOODS — 1×20FT CONTAINER\",\n    \"port_of_departure\": \"DAR ES SALAAM\",\n    \"final_port(s)_of_destination(s)\": \"MOMBASA, KENYA\",\n    \"route_of_voyage\": \"DAR ES SALAAM — MOMBASA via Indian Ocean\",\n    \"GIT,CorporateRequired,InsuredInfo,TypesOfGoods\": \"Non fragile/manufactured goods eg. textiles etc\",\n    \"means_of_transport\": \"Own transport\",\n    \"means_of_packaging\": \"Containerized\",\n    \"single_transit_or_one_off\": \"1\",\n    \"PolicyStartDate,CorporateRequired\": \"01-06-2026\",\n    \"PolicyTerm,GIT,CorporateRequired\": \"Year\",\n    \"mode_of_payment\": \"Pay by Control Number\",\n    \"PaymentMode, StaffRequired, ForCorporateOnly, MobileHiddenQuestion\": \"Cash\",\n    \"MobileHiddenQuestion, StaffRequired, CoInsuredBusiness\": \"No\",\n    \"excess\": \"No excess\",\n    \"decline_to_insure_you?\": \"No\",\n    \"required_special_terms_to_insure_you?\": \"No\",\n    \"cancelled_or_refused_to_renew_your_insurance?\": \"No\",\n    \"increased_your_premium_on_renewal?\": \"No\",\n    \"have_you_any_other_insurance_with_this_corpor\": \"No\",\n    \"i_desire_to_affect_with_corporation_an_insura\": \"true\"\n  }\n}"
            },
            "url": {"raw": "{{base_url}}/proposals/", "host": ["{{base_url}}"], "path": ["proposals", ""]},
            "description": "Drop-in valid example for product 111 (Goods In Transit). All 22 required dynamic-form fields populated with verified option strings (option values match exactly what `GET /products/{id}/form/` exposes).\n\nExpected outcome: HTTP 201, a fresh `submission_id`, a `partner_reference` of the shape `GENERAL-API-VALID-<epoch>`, an `assigned_operator` picked by the load-balancing picker, and the OrderItem entering the approval flow as task `ASSIGNED`.\n\nIf you point at a different product, the radio/select option strings will differ — rerun the *Get product form schema* request and adjust the `answers` keys + values accordingly.\n\nSchema source of truth: `GET /products/{id}/form/`.\nValidation source of truth: `mware/general_api/validators.py`."
          },
          "event": [
            {
              "listen": "prerequest",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "// Fresh idempotency key per send so repeated runs create",
                  "// independent submissions in the operator dashboard.",
                  "const ref = `GENERAL-API-VALID-${Date.now()}`;",
                  "pm.environment.set('partner_reference', ref);",
                  "console.log('partner_reference →', ref);"
                ]
              }
            },
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test('201 Created (validation passed)', () => pm.response.to.have.status(201));",
                  "const json = pm.response.json();",
                  "pm.test('returns submission id', () => pm.expect(json.submission_id).to.be.a('number'));",
                  "pm.test('echoes partner_reference', () => pm.expect(json.partner_reference).to.eql(pm.environment.get('partner_reference')));",
                  "pm.test('assigned to a general-API operator', () => pm.expect(json.assigned_operator).to.be.an('object'));",
                  "pm.environment.set('submission_id', json.submission_id);",
                  "console.log('submission_id →', json.submission_id, '· assigned to', json.assigned_operator && json.assigned_operator.username);"
                ]
              }
            }
          ]
        },
        {
          "name": "Submit full proposal",
          "request": {
            "method": "POST",
            "header": [{"key": "Content-Type", "value": "application/json"}],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"partner_reference\": \"{{partner_reference}}\",\n  \"product_id\": {{product_id}},\n  \"commencement_date\": \"2026-06-01\",\n  \"end_date\": \"2027-05-31\",\n  \"sum_insured\": 50000000,\n  \"property_name\": \"BL-2026-001 — Container TGHU1234567\",\n  \"underwrite_channel\": 5,\n  \"customer\": {\n    \"first_name\": \"Jamhuri\",\n    \"middle_name\": \"Ya\",\n    \"last_name\": \"Muungano\",\n    \"email\": \"ops@partner.example\",\n    \"phone\": \"+255700000000\",\n    \"identity_number\": \"19900101-12345-12345-12\",\n    \"gender\": \"M\",\n    \"date_of_birth\": \"01-01-1990\"\n  },\n  \"callbacks\": {\n    \"control_number\":    \"https://partner.example/webhooks/cn\",\n    \"approval_status\":   \"https://partner.example/webhooks/approval\",\n    \"approval_decision\": \"https://partner.example/webhooks/decision\",\n    \"payment\":           \"https://partner.example/webhooks/pay\",\n    \"tira_status\":       \"https://partner.example/webhooks/tira\",\n    \"commencement\":      \"https://partner.example/webhooks/commence\"\n  },\n  \"answers\": {\n    \"nature_of_business/occupation\": \"FREIGHT FORWARDER\",\n    \"description(s)_of_good(s)_to_be_dispatched\": \"DRY GOODS — 1×20FT CONTAINER\",\n    \"port_of_departure\": \"DAR ES SALAAM\",\n    \"currency_type\": \"TZS\"\n  }\n}"
            },
            "url": {"raw": "{{base_url}}/proposals/", "host": ["{{base_url}}"], "path": ["proposals", ""]},
            "description": "Submit a full proposal payload. The pre-request script generates a fresh `partner_reference` each send so you can run the request repeatedly without collisions. On success, `submission_id` and `partner_reference` are stashed in the environment for the status request."
          },
          "event": [
            {
              "listen": "prerequest",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "// Always mint a fresh idempotency key so repeated sends each",
                  "// create a brand-new submission row instead of being mistaken",
                  "// for retries by partner systems that dedupe on it.",
                  "const ref = `GENERAL-API-POSTMAN-${Date.now()}`;",
                  "pm.environment.set('partner_reference', ref);",
                  "console.log('partner_reference →', ref);"
                ]
              }
            },
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test('201 Created', () => pm.response.to.have.status(201));",
                  "const json = pm.response.json();",
                  "pm.test('returns submission id', () => pm.expect(json.submission_id).to.be.a('number'));",
                  "pm.test('echoes partner_reference', () => pm.expect(json.partner_reference).to.eql(pm.environment.get('partner_reference')));",
                  "pm.environment.set('submission_id', json.submission_id);",
                  "console.log('submission_id →', json.submission_id, 'submit_status →', json.submit_status);"
                ]
              }
            }
          ]
        },
        {
          "name": "Submit minimal proposal (General Cargo)",
          "request": {
            "method": "POST",
            "header": [{"key": "Content-Type", "value": "application/json"}],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"partner_reference\": \"{{partner_reference}}\",\n  \"product_id\": {{product_id}},\n  \"commencement_date\": \"2026-06-01\",\n  \"sum_insured\": 10000000,\n  \"customer\": {\n    \"first_name\": \"Test\",\n    \"last_name\": \"Partner\",\n    \"phone\": \"+255700000001\",\n    \"identity_number\": \"19900101-99999-99999-99\"\n  }\n}"
            },
            "url": {"raw": "{{base_url}}/proposals/", "host": ["{{base_url}}"], "path": ["proposals", ""]},
            "description": "Smallest valid payload — no callbacks, no answers. Useful for verifying credentials and the happy path. Premium will likely be 0 because the product's formula needs `answers` to be populated."
          },
          "event": [
            {
              "listen": "prerequest",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "const ref = `GENERAL-API-POSTMAN-MIN-${Date.now()}`;",
                  "pm.environment.set('partner_reference', ref);"
                ]
              }
            },
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test('201 Created', () => pm.response.to.have.status(201));",
                  "const json = pm.response.json();",
                  "pm.environment.set('submission_id', json.submission_id);"
                ]
              }
            }
          ]
        },
        {
          "name": "Validation: missing partner_reference",
          "request": {
            "method": "POST",
            "header": [{"key": "Content-Type", "value": "application/json"}],
            "body": {"mode": "raw", "raw": "{}"},
            "url": {"raw": "{{base_url}}/proposals/", "host": ["{{base_url}}"], "path": ["proposals", ""]},
            "description": "Expected to return 400 GENERAL_API_MISSING_FIELD. Confirms the manager's validation path is wired."
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test('400 Bad Request', () => pm.response.to.have.status(400));",
                  "const json = pm.response.json();",
                  "pm.test('GENERAL_API_MISSING_FIELD code', () => pm.expect(json.code).to.eql('GENERAL_API_MISSING_FIELD'));"
                ]
              }
            }
          ]
        },
        {
          "name": "Validation: invalid identity_number",
          "request": {
            "method": "POST",
            "header": [{"key": "Content-Type", "value": "application/json"}],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"partner_reference\": \"{{partner_reference}}\",\n  \"product_id\": {{product_id}},\n  \"commencement_date\": \"2026-06-01\",\n  \"end_date\": \"2027-05-31\",\n  \"sum_insured\": 50000000,\n  \"property_name\": \"BL-2026-001 — Container TGHU1234567\",\n  \"underwrite_channel\": 5,\n  \"customer\": {\n    \"first_name\": \"Jamhuri\",\n    \"middle_name\": \"Ya\",\n    \"last_name\": \"Muungano\",\n    \"email\": \"ops@partner.example\",\n    \"phone\": \"+255700000000\",\n    \"identity_number\": \"ab12\",\n    \"gender\": \"M\",\n    \"date_of_birth\": \"01-01-1990\"\n  },\n  \"callbacks\": {\n    \"control_number\":    \"https://partner.example/webhooks/cn\",\n    \"approval_status\":   \"https://partner.example/webhooks/approval\",\n    \"approval_decision\": \"https://partner.example/webhooks/decision\",\n    \"payment\":           \"https://partner.example/webhooks/pay\",\n    \"tira_status\":       \"https://partner.example/webhooks/tira\",\n    \"commencement\":      \"https://partner.example/webhooks/commence\"\n  },\n  \"answers\": {\n    \"currency_type\": \"TZS\",\n    \"nature_of_business/occupation\": \"FREIGHT FORWARDER\",\n    \"description(s)_of_good(s)_to_be_dispatched\": \"DRY GOODS — 1×20FT CONTAINER\",\n    \"port_of_departure\": \"DAR ES SALAAM\",\n    \"final_port(s)_of_destination(s)\": \"MOMBASA, KENYA\",\n    \"route_of_voyage\": \"DAR ES SALAAM — MOMBASA via Indian Ocean\",\n    \"GIT,CorporateRequired,InsuredInfo,TypesOfGoods\": \"Non fragile/manufactured goods eg. textiles etc\",\n    \"means_of_transport\": \"Own transport\",\n    \"means_of_packaging\": \"Containerized\",\n    \"single_transit_or_one_off\": \"1\",\n    \"PolicyStartDate,CorporateRequired\": \"01-06-2026\",\n    \"PolicyTerm,GIT,CorporateRequired\": \"Year\",\n    \"mode_of_payment\": \"Pay by Control Number\",\n    \"PaymentMode, StaffRequired, ForCorporateOnly, MobileHiddenQuestion\": \"Cash\",\n    \"MobileHiddenQuestion, StaffRequired, CoInsuredBusiness\": \"No\",\n    \"excess\": \"No excess\",\n    \"decline_to_insure_you?\": \"No\",\n    \"required_special_terms_to_insure_you?\": \"No\",\n    \"cancelled_or_refused_to_renew_your_insurance?\": \"No\",\n    \"increased_your_premium_on_renewal?\": \"No\",\n    \"have_you_any_other_insurance_with_this_corpor\": \"No\",\n    \"i_desire_to_affect_with_corporation_an_insura\": \"true\"\n  }\n}"
            },
            "url": {"raw": "{{base_url}}/proposals/", "host": ["{{base_url}}"], "path": ["proposals", ""]},
            "description": "Fully-valid proposal EXCEPT `customer.identity_number` is set to an invalid value (`ab12`). Everything else (product, dates, all required answers, phone) is valid so the request reaches the identity-number check.\n\nExpected outcome: HTTP 400 with `code`=GENERAL_API_INVALID_IDENTITY_NUMBER. The `message` lists every accepted format and `errors[0]` carries the rejected `value` plus `accepted_formats`.\n\nValidation source of truth: `nic/validators/identity_validator.py`."
          },
          "event": [
            {
              "listen": "prerequest",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "// Fresh reference per send so the duplicate guard never fires",
                  "// before the identity-number check we are exercising here.",
                  "const ref = `GENERAL-API-INVALID-ID-${Date.now()}`;",
                  "pm.environment.set('partner_reference', ref);",
                  "console.log('partner_reference →', ref);"
                ]
              }
            },
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test('400 Bad Request', () => pm.response.to.have.status(400));",
                  "const json = pm.response.json();",
                  "pm.test('GENERAL_API_INVALID_IDENTITY_NUMBER code', () => pm.expect(json.code).to.eql('GENERAL_API_INVALID_IDENTITY_NUMBER'));",
                  "pm.test('flags the identity_number field', () => pm.expect(json.errors[0].field).to.eql('customer.identity_number'));",
                  "pm.test('rejected value echoed back', () => pm.expect(json.errors[0].value).to.eql('ab12'));",
                  "pm.test('accepted_formats provided', () => pm.expect(json.errors[0].accepted_formats).to.be.an('array').that.is.not.empty);"
                ]
              }
            }
          ]
        },
        {
          "name": "Validation: ineligible product",
          "request": {
            "method": "POST",
            "header": [{"key": "Content-Type", "value": "application/json"}],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"partner_reference\": \"NEGATIVE-{{$timestamp}}\",\n  \"product_id\": 1,\n  \"commencement_date\": \"2026-06-01\",\n  \"customer\": {\n    \"first_name\": \"Negative\",\n    \"last_name\": \"Path\",\n    \"phone\": \"+255700000099\",\n    \"identity_number\": \"19900101-11111-11111-11\"\n  }\n}"
            },
            "url": {"raw": "{{base_url}}/proposals/", "host": ["{{base_url}}"], "path": ["proposals", ""]},
            "description": "Expected to return 400 GENERAL_API_PRODUCT_NOT_ELIGIBLE. Confirms the product eligibility filter rejects ineligible products."
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test('400 Bad Request', () => pm.response.to.have.status(400));",
                  "const json = pm.response.json();",
                  "pm.test('GENERAL_API_PRODUCT_NOT_ELIGIBLE code', () => pm.expect(json.code).to.eql('GENERAL_API_PRODUCT_NOT_ELIGIBLE'));"
                ]
              }
            }
          ]
        }
      ]
    },
    {
      "name": "Status",
      "item": [
        {
          "name": "Poll proposal status",
          "request": {
            "method": "GET",
            "header": [],
            "url": {
              "raw": "{{base_url}}/proposals/{{partner_reference}}/",
              "host": ["{{base_url}}"],
              "path": ["proposals", "{{partner_reference}}", ""]
            },
            "description": "Latest snapshot for the most-recent submission with `{{partner_reference}}`. Use as a callback fallback."
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test('200 OK', () => pm.response.to.have.status(200));",
                  "const json = pm.response.json();",
                  "pm.test('returns submit_status', () => pm.expect(json.submit_status).to.be.a('string'));",
                  "console.log('submit_status →', json.submit_status, '| acks: cn=' + json.cn_ack + ', pay=' + json.pay_ack + ', tira=' + json.tira_ack + ', commence=' + json.commencement_ack);"
                ]
              }
            }
          ]
        },
        {
          "name": "404 for unknown reference",
          "request": {
            "method": "GET",
            "header": [],
            "url": {
              "raw": "{{base_url}}/proposals/UNKNOWN-REF-NOPE/",
              "host": ["{{base_url}}"],
              "path": ["proposals", "UNKNOWN-REF-NOPE", ""]
            },
            "description": "Expected to return 404 GENERAL_API_SUBMISSION_NOT_FOUND."
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test('404 Not Found', () => pm.response.to.have.status(404));",
                  "const json = pm.response.json();",
                  "pm.test('GENERAL_API_SUBMISSION_NOT_FOUND code', () => pm.expect(json.code).to.eql('GENERAL_API_SUBMISSION_NOT_FOUND'));"
                ]
              }
            }
          ]
        }
      ]
    },
    {
      "name": "Negative auth",
      "item": [
        {
          "name": "Missing credentials",
          "request": {
            "method": "GET",
            "header": [{"key": "API-KEY", "value": "", "disabled": true}],
            "url": {"raw": "{{base_url}}/products/", "host": ["{{base_url}}"], "path": ["products", ""]},
            "description": "Bypasses the collection-level auth to verify the 401 path. Note: Postman's collection-level auth is still attached but with an empty value, so the server still receives an empty API-KEY header — both forms yield the same 401."
          },
          "auth": {"type": "noauth"},
          "event": [
            {
              "listen": "prerequest",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "// Strip the API-SECRETE header that the collection-level",
                  "// pre-request normally adds.",
                  "pm.request.headers.remove('API-SECRETE');",
                  "pm.request.headers.remove('API-KEY');"
                ]
              }
            },
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test('401 Unauthorized', () => pm.response.to.have.status(401));"
                ]
              }
            }
          ]
        }
      ]
    }
  ]
}