> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superoffice.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Validation checklist

> The app validation checklist - what to consider before you ask for a validation test.

My custom application is ready, what should I consider before I ask for a validation test?

## Development Tools subscription

Access to a customer's tenant from a custom application requires an active [Development Tools subscription][1] license or the Core plan. The license is purchased by the customer.

If the subscription is discontinued, any custom applications will lose access to that tenant.

## Security

* All [redirection URLs][1] and all URLs embedded in web panels are secure: run Qualys SSL Labs - [SSL Server tests][2] and aim for an A
* SSL 2.0 and 3.0 are disabled
* TLS 1.2 is supported
* All data is [validated on input][3] and escaped on output
* The application uses [federated authentication][4] and [validates all tokens][5] received from SuperOffice

[1]: ../create-app/config/redirects

[2]: https://www.ssllabs.com/ssltest/analyze.html

[3]: https://owasp.org/www-project-cheat-sheets/cheatsheets/Input_Validation_Cheat_Sheet

[4]: ../../online/identity/federated-auth

[5]: ../../api/authentication/online/validate-security-tokens

## Provisioning

The SuperOffice App Manager grants explicit consent to approved custom applications [during activation][1].

[1]: ../custom-app/activate

Custom apps therefore do not need to implement the [workflow for giving consent][2].

## Error handling

* The application handles scenarios where access to the customer's database is lost, such as during our maintenance windows. Check the [tenant status page][3]

## Limit your searches

* API calls don't choke the database, see [best practices][5]
* Ensure the user types at least 3 characters before you start searching for contacts, persons, email addresses, selections, and similar
* No more than 10 API calls per second

## Protect your web panels

* Information doesn't leak via web panels (and thus forwarded to others who are not authorized)
* The context identifier template variable (`uctx`) and also the User login associate ID (`usid`) are part of the URL of all web panels you add
* `usec` is **never** passed as a parameter in the URL

<Danger>
  The use of the `usec` template variable is **forbidden** in online environments.
  If you need to use the `usec` variable for debugging or other purposes, it should only be done in a secure, onsite installation where access is restricted to authorized personnel.
  If you have already used the `usec` variable in an online environment, it will only return an empty string from v11.5.
</Danger>

## System user and important rules

* Never rename the **owner company** (`contact.name` field for the company with `contact_id` found in the Company database table). If you do, our license check fails and all users are locked out!
* Persons may be associates - if they have a row in the associate table then
  * don't update a person's company (`person.contact_id`)

<Danger>
  You **must** protect the customer database from total destruction, which will require Online Operations to update the database manually. Use the [system user][1] with great caution.
</Danger>

[1]: ../getting-started/user-contexts

## Maintenance window

* You will handle unavailability scenarios such as when CRM Online is not available

## I'm good to go!

[Sign me up for validation][4]

[4]: ./validate

[1]: ../../admin/license/expander-services

[2]: ../provisioning/consent#hand-shake

[3]: ../best-practices/tenant-status/check-status

[5]: ../best-practices/index


## Related topics

- [Get your custom app validated and live](/en/developer-portal/custom-app/validate.md)
- [Certification checklist](/en/developer-portal/standard-app/certification/checklist.md)
- [ChecklistAppointment](/en/api/archive-providers/reference/checklistappointment.md)
- [NSUserValidationResult](/en/automation/crmscript/reference/CRMScript.NetServer.NSUserValidationResult.md)
- [SuperOffice.WebApi.Data.AttachmentValidationResult](/en/api/reference/webapi/SuperOffice.WebApi.Data.AttachmentValidationResult.md)
- [SuperOffice.WebApi.Data.UserValidationResult](/en/api/reference/webapi/SuperOffice.WebApi.Data.UserValidationResult.md)