# Client onboarding and support runbook

## Onboarding

1. Identify the client application's technical owner and intended decisions.
2. Create a dedicated API consumer and deliver its secret through an approved secure channel.
3. Confirm the audience is `vinquery:api:decisioq`; the Environment field on an API consumer is currently informational and has no routing, isolation, billing, or authorization effect.
4. Import the Postman environment and collection; insert credentials only into the local environment.
5. Obtain a token and run Health, Validate, and one approved Decide request.
6. Confirm expected output, credit behavior, timeout/retry configuration, secret storage, and production monitoring.
7. Record client owner, VINquery owner, escalation route, target launch date, and credential rotation process.

## Support request checklist

Provide:

- UTC timestamp and environment/host used
- endpoint and HTTP method
- HTTP status and sanitized response body
- response `requestId` and client `X-Correlation-Id`
- DecisioQ/API contract version and decision identifier/version
- minimal sanitized request that reproduces the failure
- whether retry occurred and whether a charge appears in usage summary

Never provide the client secret, JWT, full Authorization header, or unnecessary customer data.

Support contact channels and hours must be supplied by the customer's commercial support agreement; this kit does not invent or imply a support SLA.