Steps

  1. Separate client credentials from provider credentials.
  2. Configure route and request limits for the test identity.
  3. Verify one allowed synthetic request.
  4. Verify a denied route request and preserve the prior mapping.

Verify and rollback

Credentials cannot call unapproved providers or routes. Revert the route and revoke temporary credentials after testing.