Walk a complete tax submission — safely.

Generates a code verifier/challenge pair, exchanges the printed demo credentials for a one-time authorization code at /demo/login, then performs the standard token exchange at /oauth/token — no client secret, as befits a public client.

Creates an active, purpose-scoped consent record (purpose_category: tax_submission) and lists existing grants. Without this, every submission write is refused with 403 CONSENT_REQUIRED.

Creates a draft return for tax year 2026, then replaces its return_data with a PATCH. Drafts sit in status received until they are finalised.

Submits a final return that is deliberately missing the 10-digit tax reference. Validation gates it: the status walks to validation_failed with rule IT12-001 — a 200 response carrying a failed verdict, exactly as a real gate should behave.

Calls POST …/reopen — the only legal exit from validation_failed — then adds the tax reference with a PATCH (edits are only allowed while the status is received) and submits again. This time the return walks the whole pipeline to accepted.

Fetches GET …/response. The system issues an assessment number and a disclaimer — and refuses to invent a rand amount of tax payable. That refusal is the point.

Attaches a small text note to the draft (documents attach while a submission is in received) and lists what the service now holds. If the deployment has no document storage configured, you will see a clear 503 instead of a silent pretend-success.

Files a POPIA access request, moves it to in_progress (a subject may do that), then attempts the staff-only completion. The service refuses with 403: the person who filed a request can never close it.