1.7 Smoke tests

Outcome

You've confirmed every key surface of the empty platform behaves correctly before onboarding the first customer.

Prerequisites

1.6 DNS and TLS complete.

What "good" looks like for an empty platform

Smoke checks

Health and metrics endpoints

curl -fsSL https://api.rcm.medsuite.com/health
curl -fsSL https://edi.medsuite.com/health
curl -fsSL https://api.rcm.medsuite.com/metrics | head -20
curl -fsSL https://api.rcm.medsuite.com/healthz/sampled-tenants

The sampled-tenants endpoint should return zero entries — the sampler walks identity.tenant, which is empty.

Sign in as platform admin
Browser: https://admin.<env>.medsuiteone.ai → email + password from 1.5 First platform admin → complete MFA → land on the tenant picker (empty list).
Confirm identity.tenant_audit got a PLATFORM_LOGIN_SUCCESS row.

API smoke via the platform JWT

The platform API is admin-service, on the console host — not api.rcm.medsuite.com. The paths are unchanged (/platform/*); a client reaches them through the /api prefix that Front Door routes to the service.

# dev: admin.dev.medsuiteone.ai · stg: admin.stg.medsuiteone.ai · prod: admin.medsuiteone.ai
ADMIN_HOST=admin.dev.medsuiteone.ai

LOGIN=$(curl -s -X POST "https://$ADMIN_HOST/api/platform/auth/login" \
  -H 'content-type: application/json' \
  -d '{"email":"you@medsuite.com","password":"<your password>"}')

TOKEN=$(echo "$LOGIN" | jq -r .data.platformToken)

curl -fsSL "https://$ADMIN_HOST/api/platform/tenants" \
  -H "Authorization: Bearer $TOKEN" | jq .

Expect {"data":[],"meta":{"total":0}}.

platformToken is null once MFA is enrolled — that is correct

POST /platform/auth/login only returns data.platformToken for an account with no second factor. Because 1.5 has you enrol TOTP, the response here is an MFA challenge instead:

{ "data": { "mfaRequired": true, "mfaPendingToken": "…", "factorsAvailable": ["totp"] } }

Exchange it for the platform JWT with the current TOTP code. The pending token travels as the Authorization header, and the code is the body field token:

PENDING=$(echo "$LOGIN" | jq -r .data.mfaPendingToken)

TOKEN=$(curl -s -X POST "https://$ADMIN_HOST/api/platform/auth/mfa/totp/verify" \
  -H "Authorization: Bearer $PENDING" \
  -H 'content-type: application/json' \
  -d '{"token":"<6-digit code>"}' \
  | jq -r .data.platformToken)

If the authenticator is unavailable, POST /platform/auth/mfa/recovery takes the same Authorization header but reads the body field code, not token.

Reference-data spot check

A platform admin can read reference data without impersonation:

curl -fsSL https://api.rcm.medsuite.com/admin/payers \
  -H "Authorization: Bearer $TOKEN" | jq '.data | length'

curl -fsSL https://api.rcm.medsuite.com/admin/procedure-codes?limit=5 \
  -H "Authorization: Bearer $TOKEN" | jq '.data | length'

Both should be > 0 (seeded by master migrations).

Worker / job-supervisor heartbeat
```
curl -fsSL https://api.rcm.medsuite.com/healthz/worker | jq .
```
Expect a lastHeartbeatAt within the last 30 seconds and activeWorkers >= 1.

EDI gateway smoke

curl -fsSL https://edi.medsuite.com/healthz/x12 | jq .
# expect: { "parsers":["837","270","271","278","835","277CA"], "ready":true }

Validation matrix

Surface	Expected
`/health` (rcm-core)	200
`/health` (edi-gateway)	200
`/metrics` (rcm-core)	Prometheus text
Console login (`admin.<env>.medsuiteone.ai`)	200, MFA completes, tenant picker empty
`/platform/tenants`	`[]`
`/admin/payers`	non-empty
`/admin/procedure-codes`	non-empty
`/healthz/worker`	recent heartbeat
`/healthz/x12`	parsers ready

Troubleshooting

If anything fails, head to 1.8 Troubleshooting.

You're done with Phase 1.

Continue to Phase 2 — Customer Onboarding.

Outcome​

Prerequisites​

What "good" looks like for an empty platform​

Smoke checks​

Validation matrix​

Troubleshooting​

Next​