Receive "Authority to operate" (ATO) for Veterans Confirmation API

[indexing]

The final aspect of the "path to go live" for veterans eligibility in the Benefits application is completing the process from the Veterans Administration that grants us authority to operate. Following guidance on the VA API Platform website, we need to complete the following steps:

• Request production access to use the VA APIs by completing the "production access form."
• Schedule product demo
• Complete product demo

[indexing]

From @johnatstate on Slack: Production access request is submitted. We should hear in a week or two then schedule a demo within a week from then (automated response with typical times).

https://cal-itp.slack.com/archives/C05DKD0U8UD/p1687554923438529

[indexing]

We are aiming to schedule the product demo with the VA before the end of August. We are still waiting on the VA to approve our request, but there has been ongoing dialogue between the IdG team and the VA since mid-July.

[indexing]

On Monday the CDT identity gateway team, @johnatstate and @jarrettkrumrei, reported some new challenges getting authority to operate from the VA on the full scope of the veterans enrollment pathway as it is implemented now.

We use two VA.gov APIs in the current implementation:

• Veteran Service History and Eligibility API (VSHE API)
• Veteran Confirmation API (VC API)

While the technical work to utilize both APIs is complete and ready for testing in the Benefits app, getting authority to use the VSHE API with the identity gateway has proven to be a more complex process largely because of the steps the VA requires to establish a legal agreement. However, if we only apply for the VC API, the process is straightforward and we expect to receive approval quickly.

The trade-off of using the VC API by itself is that we can only use Login.gov to share rider identity information with the VA. While this approach means Veterans will not be able to use all authentication methods supported by the VA in the initial launch of this feature, it does provide a pathway for digital benefits enrollment.

Thus, the plan is to launch the Benefits app with the VC API by the end of September. The CDT team intends to integrate the identity gateway with both APIs to offer both veteran status verification and, in the future, veteran disabled status verification. We will enhance the Benefits app experience for Veteran riders in a future release by adding support for the VSHE API to unlock all authentication options offered by the VA.

There are now two user stories to capture the phased support of the two APIs.

• [Design] Veteran eligibility verification using Login.gov #1691 (end of Sep)
• [Tracking] Veteran eligibility verification with VA.gov #1413 (future)

cc// @vykster @thekaveman

[thekaveman]

@indexing I think we are good to close this! 🎉

[indexing]

Today we received confirmation from @jarrettkrumrei that the VA granted us the "authority to operate" for the VC API. We aim to make the Veterans enrollment pathway available to MST users by 11/10 to coincide with the observance of Veteran's Day.

Next step is "authority to operate" for the VSHE API, but that effort will be captured in a separate issue.