Testing Scenarios

10 API calls in this section.

Collection of testing scenarios for different user roles and permissions.

System Admin Access

Delivery & Last-Mile / Testing Scenarios

GET/route/for-driver/{{driver_id}}/delivery/{{delivery_id}}

Test route calculation with system admin privileges.

Prerequisites

• User must have is_system_admin: true

• Should have access to all routes regardless of tenant

Expected Behavior

• Full access to any driver/delivery combination

• No tenant restrictions

Path parameters

Parameter	Type	Description
driver_idRequired	string	Variable used inside the request path. Variable used inside the request path.
delivery_idRequired	string	Variable used inside the request path. Variable used inside the request path.

Headers

Parameter	Type	Description
Authorization	string	System admin JWT token System admin JWT token Example: Bearer {{access_token}}
Content-Type	string	Example: application/json

Staging

Request

curl

1curl --globoff --request GET "https://staging-api.ondi.io/functions/v1/route/for-driver/${DRIVER_ID}/delivery/${DELIVERY_ID}" \2  --header "Authorization: Bearer ${ONDI_ACCESS_TOKEN}" \3  --header "Content-Type: application/json"

Response examples

No saved response example. Use Try it to inspect a staging response.

Dispatcher Access

Delivery & Last-Mile / Testing Scenarios

GET/route/for-driver/{{driver_id}}/delivery/{{delivery_id}}

Test route calculation with dispatcher privileges.

Prerequisites

• User must have delivery_dispatch permission OR

• User must have dispatcher role OR

• User must have tenant_admin role

• Driver and delivery must belong to same tenant as user

Expected Behavior

• Access to routes within their tenant only

• Cannot access routes from other tenants

Path parameters

Parameter	Type	Description
driver_idRequired	string	Variable used inside the request path. Variable used inside the request path.
delivery_idRequired	string	Variable used inside the request path. Variable used inside the request path.

Headers

Parameter	Type	Description
Authorization	string	Dispatcher JWT token Dispatcher JWT token Example: Bearer {{access_token}}
Content-Type	string	Example: application/json

Staging

Request

curl

1curl --globoff --request GET "https://staging-api.ondi.io/functions/v1/route/for-driver/${DRIVER_ID}/delivery/${DELIVERY_ID}" \2  --header "Authorization: Bearer ${ONDI_ACCESS_TOKEN}" \3  --header "Content-Type: application/json"

Response examples

No saved response example. Use Try it to inspect a staging response.

Driver Self Access

Delivery & Last-Mile / Testing Scenarios

GET/route/for-driver/{{driver_id}}/delivery/{{delivery_id}}

Test route calculation where driver accesses their own route.

Prerequisites

• The authenticated user must be linked to the driver record

• Driver's user_id must match the authenticated user's ID

• Delivery must belong to same tenant

Expected Behavior

• Driver can only access their own routes

• Cannot access routes for other drivers

Path parameters

Parameter	Type	Description
driver_idRequired	string	Variable used inside the request path. Variable used inside the request path.
delivery_idRequired	string	Variable used inside the request path. Variable used inside the request path.

Headers

Parameter	Type	Description
Authorization	string	Driver's own JWT token Driver's own JWT token Example: Bearer {{access_token}}
Content-Type	string	Example: application/json

Staging

Request

curl

1curl --globoff --request GET "https://staging-api.ondi.io/functions/v1/route/for-driver/${DRIVER_ID}/delivery/${DELIVERY_ID}" \2  --header "Authorization: Bearer ${ONDI_ACCESS_TOKEN}" \3  --header "Content-Type: application/json"

Response examples

No saved response example. Use Try it to inspect a staging response.

API Key Authentication

Delivery & Last-Mile / Testing Scenarios

GET/route/for-driver/{{driver_id}}/delivery/{{delivery_id}}

Test route calculation using API key authentication instead of JWT.

Prerequisites

• Valid API key with appropriate permissions

• API key must belong to same tenant as driver/delivery

Expected Behavior

• Same authorization rules apply as JWT authentication

• API key tenant context is used for authorization

Path parameters

Parameter	Type	Description
driver_idRequired	string	Variable used inside the request path. Variable used inside the request path.
delivery_idRequired	string	Variable used inside the request path. Variable used inside the request path.

Headers

Parameter	Type	Description
X-API-Key	string	API key for authentication API key for authentication Example: {{api_key}}
Content-Type	string	Example: application/json
Authorization	string	Example: Bearer {{access_token}}

Staging

Request

curl

1curl --globoff --request GET "https://staging-api.ondi.io/functions/v1/route/for-driver/${DRIVER_ID}/delivery/${DELIVERY_ID}" \2  --header "X-API-Key: ${ONDI_TENANT_API_KEY}" \3  --header "Content-Type: application/json" \4  --header "Authorization: Bearer ${ONDI_ACCESS_TOKEN}"

Response examples

No saved response example. Use Try it to inspect a staging response.

Cross-Tenant Access Denied

Delivery & Last-Mile / Testing Scenarios

GET/route/for-driver/{{driver_id}}/delivery/{{delivery_id}}

Test that users cannot access routes from different tenants.

Prerequisites

• User belongs to Tenant A

• Driver/Delivery belongs to Tenant B

• User is not system admin

Expected Response

• Status: 403 Forbidden

• Message: Insufficient permissions

Path parameters

Parameter	Type	Description
driver_idRequired	string	Variable used inside the request path. Variable used inside the request path.
delivery_idRequired	string	Variable used inside the request path. Variable used inside the request path.

Headers

Parameter	Type	Description
Authorization	string	JWT token from different tenant JWT token from different tenant Example: Bearer {{access_token}}
Content-Type	string	Example: application/json

Staging

Request

curl

1curl --globoff --request GET "https://staging-api.ondi.io/functions/v1/route/for-driver/${DRIVER_ID}/delivery/${DELIVERY_ID}" \2  --header "Authorization: Bearer ${ONDI_ACCESS_TOKEN}" \3  --header "Content-Type: application/json"

Response examples

403Forbidden

Response body

json

1{2  "success": false,3  "message": "Insufficient permissions"4}

System Admin Access

Delivery & Last-Mile / Testing Scenarios

GET/route/for-driver/{{driver_id}}/delivery/{{delivery_id}}

Test route calculation with system admin privileges.

Prerequisites

• User must have is_system_admin: true

• Should have access to all routes regardless of tenant

Expected Behavior

• Full access to any driver/delivery combination

• No tenant restrictions

Path parameters

Parameter	Type	Description
driver_idRequired	string	Variable used inside the request path. Variable used inside the request path.
delivery_idRequired	string	Variable used inside the request path. Variable used inside the request path.

Headers

Parameter	Type	Description
Authorization	string	System admin JWT token System admin JWT token Example: Bearer {{access_token}}
Content-Type	string	Example: application/json

Staging

Request

curl

1curl --globoff --request GET "https://staging-api.ondi.io/functions/v1/route/for-driver/${DRIVER_ID}/delivery/${DELIVERY_ID}" \2  --header "Authorization: Bearer ${ONDI_ACCESS_TOKEN}" \3  --header "Content-Type: application/json"

Response examples

No saved response example. Use Try it to inspect a staging response.

Dispatcher Access

Delivery & Last-Mile / Testing Scenarios

GET/route/for-driver/{{driver_id}}/delivery/{{delivery_id}}

Test route calculation with dispatcher privileges.

Prerequisites

• User must have delivery_dispatch permission OR

• User must have dispatcher role OR

• User must have tenant_admin role

• Driver and delivery must belong to same tenant as user

Expected Behavior

• Access to routes within their tenant only

• Cannot access routes from other tenants

Path parameters

Parameter	Type	Description
driver_idRequired	string	Variable used inside the request path. Variable used inside the request path.
delivery_idRequired	string	Variable used inside the request path. Variable used inside the request path.

Headers

Parameter	Type	Description
Authorization	string	Dispatcher JWT token Dispatcher JWT token Example: Bearer {{access_token}}
Content-Type	string	Example: application/json

Staging

Request

curl

1curl --globoff --request GET "https://staging-api.ondi.io/functions/v1/route/for-driver/${DRIVER_ID}/delivery/${DELIVERY_ID}" \2  --header "Authorization: Bearer ${ONDI_ACCESS_TOKEN}" \3  --header "Content-Type: application/json"

Response examples

No saved response example. Use Try it to inspect a staging response.

Driver Self Access

Delivery & Last-Mile / Testing Scenarios

GET/route/for-driver/{{driver_id}}/delivery/{{delivery_id}}

Test route calculation where driver accesses their own route.

Prerequisites

• The authenticated user must be linked to the driver record

• Driver's user_id must match the authenticated user's ID

• Delivery must belong to same tenant

Expected Behavior

• Driver can only access their own routes

• Cannot access routes for other drivers

Path parameters

Parameter	Type	Description
driver_idRequired	string	Variable used inside the request path. Variable used inside the request path.
delivery_idRequired	string	Variable used inside the request path. Variable used inside the request path.

Headers

Parameter	Type	Description
Authorization	string	Driver's own JWT token Driver's own JWT token Example: Bearer {{access_token}}
Content-Type	string	Example: application/json

Staging

Request

curl

1curl --globoff --request GET "https://staging-api.ondi.io/functions/v1/route/for-driver/${DRIVER_ID}/delivery/${DELIVERY_ID}" \2  --header "Authorization: Bearer ${ONDI_ACCESS_TOKEN}" \3  --header "Content-Type: application/json"

Response examples

No saved response example. Use Try it to inspect a staging response.

API Key Authentication

Delivery & Last-Mile / Testing Scenarios

GET/route/for-driver/{{driver_id}}/delivery/{{delivery_id}}

Test route calculation using API key authentication instead of JWT.

Prerequisites

• Valid API key with appropriate permissions

• API key must belong to same tenant as driver/delivery

Expected Behavior

• Same authorization rules apply as JWT authentication

• API key tenant context is used for authorization

Path parameters

Parameter	Type	Description
driver_idRequired	string	Variable used inside the request path. Variable used inside the request path.
delivery_idRequired	string	Variable used inside the request path. Variable used inside the request path.

Headers

Parameter	Type	Description
X-API-Key	string	API key for authentication API key for authentication Example: {{api_key}}
Content-Type	string	Example: application/json
Authorization	string	Example: Bearer {{access_token}}

Staging

Request

curl

1curl --globoff --request GET "https://staging-api.ondi.io/functions/v1/route/for-driver/${DRIVER_ID}/delivery/${DELIVERY_ID}" \2  --header "X-API-Key: ${ONDI_TENANT_API_KEY}" \3  --header "Content-Type: application/json" \4  --header "Authorization: Bearer ${ONDI_ACCESS_TOKEN}"

Response examples

No saved response example. Use Try it to inspect a staging response.

Cross-Tenant Access Denied

Delivery & Last-Mile / Testing Scenarios

GET/route/for-driver/{{driver_id}}/delivery/{{delivery_id}}

Test that users cannot access routes from different tenants.

Prerequisites

• User belongs to Tenant A

• Driver/Delivery belongs to Tenant B

• User is not system admin

Expected Response

• Status: 403 Forbidden

• Message: Insufficient permissions

Path parameters

Parameter	Type	Description
driver_idRequired	string	Variable used inside the request path. Variable used inside the request path.
delivery_idRequired	string	Variable used inside the request path. Variable used inside the request path.

Headers

Parameter	Type	Description
Authorization	string	JWT token from different tenant JWT token from different tenant Example: Bearer {{access_token}}
Content-Type	string	Example: application/json

Staging

Request

curl

1curl --globoff --request GET "https://staging-api.ondi.io/functions/v1/route/for-driver/${DRIVER_ID}/delivery/${DELIVERY_ID}" \2  --header "Authorization: Bearer ${ONDI_ACCESS_TOKEN}" \3  --header "Content-Type: application/json"

Response examples

403Forbidden

Response body

json

1{2  "success": false,3  "message": "Insufficient permissions"4}