Sandbox and test strategy

Create keys with environment=test for development and automated verification. Test keys use the rcn_test_ prefix, which makes accidental environment mixing visible in logs and configuration reviews.

1. Create one individual and one organisation.
2. Create a current account for each, then replay payment, delinquency, cure, default and closure paths permitted by the state machine.
3. Verify duplicate account IDs and source references are rejected.
4. Retry idempotent creates with identical bodies, then confirm key reuse with a changed body returns 409.
5. Query NR subjects as well as rated subjects and assert that your UI does not render NR as a numeric score.
6. Generate a signed test webhook and validate it through the same production verifier.
7. Exercise 401, 403, 404, 409, 413, 422, 429 and 500 handling in staging.

• Issue a new live key; never change a test prefix or reuse a test secret.
• Use independent idempotency namespaces and external account identifiers.
• Point webhooks to a production HTTPS endpoint with monitoring enabled.
• Run a single controlled subject/account/event/profile workflow, reconcile it, then expand traffic gradually.