Iterable Acceptance E2E Runbook

Status

The code path is prepared but owner-gated. Do not enable it until Asana task 1216860419874164 contains the approved restricted list, campaign/template, trigger, mailbox, destination hosts, webhook latency, and cleanup policy.

Runtime Contract

• Use only the EU Data Ingestion test project.
• Store the server-side key in Secret Manager and expose it only to the LTI runtime. Never put it in frontend code, CI output, evidence, or Asana.
• Set ITERABLE_ACCEPTANCE_ENABLED=true only after approval.
• The shared runtime gate must declare LTI_TARGET_ENVIRONMENT=acceptance and include every allowed destination in LTI_ALLOWED_TARGET_HOSTS.
• Configure exact mailbox and Iterable destination hostname allowlists. Wildcards are not supported, and a destination must be present in both the integration-specific and shared acceptance allowlists.
• The only accepted cleanup policy is delete_run_owned_profile.
• Each run ID must match lti-acc-<unique-suffix>.

Iterable documents https://api.eu.iterable.com as the EDC API base URL and requires API keys in the Api-Key header. The pilot uses documented profile, event, targeted-email, subscription, event-history, and user deletion endpoints:

• https://support.iterable.com/hc/en-us/articles/17572750887444-Iterable-s-European-Data-Center-EDC
• https://support.iterable.com/hc/en-us/articles/204780579-Iterable-API-Endpoints-and-Sample-Payloads
• https://support.iterable.com/hc/en-us/articles/360043464871-API-Keys

Preflight

Run the validation command inside the acceptance runtime. It does not make a network request:

python manage.py check_iterable_acceptance \
  --run-id lti-acc-example-001 \
  --recipient approved-mailbox@example.test \
  --scenario standard_donation \
  --destination-url https://approved-acceptance.example.test/path

The output contains a recipient fingerprint, not the mailbox. A failure means the owner contract or runtime configuration remains incomplete.

Execution Order

1. Create or update the run-owned synthetic profile.
2. Subscribe it only to the approved test list.
3. Track the approved trigger event and target the approved campaign.
4. Poll within the approved latency window and retain redacted send evidence.
5. Open the received message from the approved mailbox and validate the final acceptance destination before continuing.
6. Run the standard donation, express donation, or list-level unsubscribe path.
7. Correlate FRAPI, webhook, and final subscription evidence by run ID.
8. Delete only the exact run-owned synthetic profile after evidence retention.

Evidence

Retain run ID, scenario, list/campaign/template identifiers, operation name, HTTP status, elapsed time, send/delivery timestamps, final hostname, donation trace identifier, webhook correlation, and final subscription state. Do not retain API keys, raw email addresses, response bodies, DR values, payment data, or tracked-link query strings.

Failure Handling

• A non-allowlisted mailbox or hostname blocks before an API call.
• An async timeout is a dependency failure, not a pass.
• A failed cleanup preserves redacted evidence and requires manual review.
• Never compensate by deleting a broad list, campaign, or non-run-owned profile.