# DigiLocker requester outcome matrix

Contract title and version:
Approved client and environment reference:
Purpose and document type:
Application decision owner:

Use synthetic cases first. Record actual provider tests separately.

| Case | Expected behavior | Observed behavior | Date | Reviewer |
| --- | --- | --- | --- | --- |
| Valid grant and required document | Fetch only the permitted document | | | |
| Denied consent | No document retrieval | | | |
| Missing list permission | No unauthorized list request | | | |
| Missing exact document permission | No document retrieval | | | |
| Invalid identity signature or nonce | Reject identity response | | | |
| Invalid download HMAC | Reject document response | | | |
| Expired grant | Stop retrieval and follow cleanup policy | | | |
| Expired or unknown document validity | Follow the approved business rule | | | |
| Issuer signature not verified | Preserve that status in the decision | | | |
| Provider timeout | Show the reviewed recovery path | | | |

Keep tokens, document URIs, credentials and personal records out of this worksheet.