# SAS Visual Analytics / Airlock IAM public contracts for va.baloise.de
# Derived from captured requests; no target-facing form was submitted.

## Protected SAS handoff

GET /SASStoredProcess/do
  -> 303 Location: /auth/check-login?Location=https%3A%2F%2Fva%2Ebaloise%2Ede%2FSASStoredProcess%2Fdo
  -> creates AL_SESS-S (HttpOnly, SameSite=Lax) and CSRFT759-S (SameSite=Strict)
  evidence: 01a1beb5-de5b-7186-b797-9c2292954c34

The other SAS route families in recon/va-sas-airlock-routes-v4.txt use the same gateway interception. The Location query preserves the absolute requested SAS URL. GET /auth/check-login sends a 302 to /auth/ui/app/auth/application/access.
  evidence: 01a1a2fe-ccee-7509-b0f4-802002f2f4d9

## Browser/API session convention

Public IAM API calls use both gateway cookies and mirror the CSRFT759-S value in X-CSRFT759. The browser client also sends X-Same-Domain: 1. A sessioned API request lacking the CSRF header returns JSON:API error code CSRF_HEADER_MISSING.
  success evidence: 01a1a0da-562b-7281-a3b3-c943924d4b5f
  missing-header evidence: 01a1a0d9-871e-744d-a6ef-74c658eedeee

## Static UI discovery

GET /auth/rest/public/ui/languages
  -> defaultLanguage de; availableLanguages de, en, fr, it
  evidence: 01a1a0da-56b6-77ca-a41a-bdc0dd8c8be9

GET /auth/rest/public/ui/static/configuration
  -> JSON:API ui.static.configuration object with empty attributes
  evidence: 01a1a0da-562b-7281-a3b3-c943924d4b5f

GET /auth/rest/public/authentication/ui/default/application/id
  -> {"applicationId":"default"}
  evidence: 01a1a0da-5514-7037-9420-7b693dfe4076

GET /auth/rest/public/authentication/ui/configuration/access
  -> {"ssoParameterNames":["sso"]}
  evidence: 01a1a0da-55a3-729f-871c-37e9deb08194

## sas_va authentication flow

POST /auth/rest/public/authentication/applications/sas_va/access
Content-Type: application/json
Body: null
  -> 401 NOT_AUTHORIZED is the normal flow-start response
  -> nextAuthStep PASSWORD_REQUIRED
  -> UI path {{SPA}}/auth/flow/sas_va/password
  -> stepId default-username-password
  -> dynamic target portal-redirect is activatable/deactivatable and initially inactive
  -> public self-service link {{SPA}}/self-service/select/flow/password-reset-init
  -> no additional authentication buttons advertised
  evidence: 01a1a2fe-be01-7328-848f-7a8bcc4e64a3

GET /auth/rest/public/flow during that session
  -> flowType authentication; id sas_va; nextStep PASSWORD_REQUIRED
  evidence: 01a1a2fe-cbd1-7594-bd8a-1ecb09160edd

## Location interpretation

POST /auth/rest/public/authentication/location/interpret
Content-Type: application/json
Body: {"location":"https://va.baloise.de/SASLogon"}
  -> 200 location.interpretation with an opaque numeric id
  evidence: 01a1a0da-df17-74af-95e7-907e82288730

POST /auth/rest/public/authentication/location/access with the same body
  -> starts/continues sas_va and returns the same PASSWORD_REQUIRED flow metadata as direct application access
  evidence: 01a1a0da-dfa6-76e7-a90a-83fe423163f9

## Password-reset self-service selection

POST /auth/rest/public/self-service/flows/password-reset-init/select
Content-Type: application/json
Body: null
  -> 200 public-self-service.session
  -> nextStep USERNAME_REQUIRED
  -> UI path {{SPA}}/self-service/flow/password-reset-init/username
  -> cancel target {{SPA}}/auth/application/access/default
  evidence: 01a1a304-bd1d-7101-b84a-8c9a3b6d4647

GET /auth/rest/public/flow during that session
  -> flowType public-self-service; id password-reset-init; nextStep USERNAME_REQUIRED
  evidence: 01a1a304-bdb4-77c2-9832-98528a315492

## Generic IAM dispatcher parity

A complete 112-candidate product comparison yields the same active matrix as Infoportal and the Mein Portal tenants: 54 exact public POST handlers advertised by `Allow: POST,OPTIONS`, 33 protected self-service boundaries returning 401 before method dispatch, and 25 inactive 404 candidates. Exact parity and representative evidence are `recon/airlock-va-product-route-parity-v2.txt`; full normalized routes are `recon/va-sas-airlock-routes-v4.txt`.


## SAS Web Infrastructure Platform families

Web Infrastructure Platform, WIP client access, DWR-style remoting, REST registry and SOAP registry/service paths are directly represented. All use the same 303 `/auth/check-login` handoff and preserve their absolute target URL before any backend service content is returned. Exact routes and exchanges are `recon/va-sas-wip-route-contracts-v1.txt`.

The canonical SAS environment descriptor route `/sas/sas-environment.xml` is also directly represented at the same `sas_va` IAM handoff; evidence and excluded look-alikes are `recon/va-sas-wip-route-contracts-v1.txt`.