Change Document: v2.3.3.0 — Permission Fix for New Customer Creation (ISSUE-12 Root Cause)

Field	Value
Version	2.3.3.0
Date	2026-03-09
Extension	BC Dialing Application (Cambay Solutions)
Severity	Critical — fixes 65-74% API failure rate on new customer creation
Status	Deployed to Production — 2026-03-09

---

Background

Production telemetry from March 9 shows that 65% of ReceivePhoneNumber (Pag-80000) and 74% of ReceiveEmail (Pag-80003) API calls return HTTP 403 with NavPermissionException. The failures occur exclusively on the new customer creation path — existing customer lookups succeed consistently.

v2.2.1.0 added inline permissions for 13 standard BC tables accessed by Insert(true) and ApplyCustomerTemplate. However, the ECOMMERCE customer template populates fields (Salesperson Code, Payment Terms Code, Currency Code, Country/Region Code) whose Validate() triggers access additional setup tables not in the original permission list. Additionally, the BestwayUSA extension's INVCCustomerAreaDimension event subscriber on Customer.OnAfterInsertEvent accesses General Ledger Setup, which was also missing.

Rather than waiting for the v2.3.2.0 breadcrumb telemetry to identify the specific failure point, this version proactively traces the full call chain through the ECOMMERCE template's field values and the BestwayUSA extension's event subscribers to close all permission gaps at once.

---

Root Cause Analysis

ECOMMERCE Template Field Values (from Production API)

Template Field	Value	Table Accessed by Validate()
salespersonCode	SR-010	Salesperson/Purchaser
paymentTermsCode	PRE	Payment Terms
currencyCode	USD	Currency
country	US	Country/Region
type	Person	(enum — no table lookup)
taxLiable	true	(boolean — no table lookup)

When ApplyCustomerTemplate runs, it calls Validate() on each populated template field. Each Validate() trigger looks up the corresponding setup table to verify the value exists. If the API page's inline Permissions don't declare read access to that table, BC raises NavPermissionException (HTTP 403).

BestwayUSA Extension Event Subscribers

The BestwayUSA extension (BestwayUSA) subscribes to Customer.OnAfterInsertEvent in two codeunits:

Codeunit	Subscriber	Tables Accessed
INVCMiscIIntegrationHandler	INVCCustomerAreaDimension	General Ledger Setup, Default Dimension, Dimension Value
INVCSalesHandler	OnAfterInsertCustomer	Customer Templ. (then calls ApplyCustomerTemplate again)

INVCCustomerAreaDimension runs on every Insert(true) and reads General Ledger Setup to get Shortcut Dimension 3 Code, then reads/writes Default Dimension records. Default Dimension and Dimension Value were already declared, but General Ledger Setup was not.

OnAfterInsertCustomer calls ApplyCustomerTemplate a second time if the customer's No. Series matches a template. This accesses the same tables as the page's own ApplyCustomerTemplate call — no additional missing tables.

BestwayUSA OnAfterModifyEvent Subscriber

INVCMiscIIntegrationHandler.INVCUpdateSalesOrderAreaDimension subscribes to Customer.OnAfterModifyEvent and accesses General Ledger Setup, Default Dimension, Dimension Value, and Customer Posting Group. The Modify(true) call at step 7 of the page trigger fires this subscriber. General Ledger Setup was the only table not already declared.

---

Summary of Changes

#	Severity	Category	Description
1	Critical	Fixed	Added 5 missing table permissions to Pages 80000, 80003, and CU-60000 inline Permissions
2	Low	Fixed	Standardized step 4 breadcrumb to Dictionary overload for consistency

---

Detailed Changes

1. Missing Table Permissions — Pages 80000, 80003, and CU-60000

Files modified:

• src/Page/Pag-80000.ReceivePhoneNumber.al
• src/Page/Pag-80003.ReceiveEmail.al
• src/Codeunit/CU-60000.PhoneIntegration.al

Tables added to inline Permissions:

Table	Permission	Accessed By	Why It Was Missing
Salesperson/Purchaser	R	ApplyCustomerTemplate → Validate("Salesperson Code")	v2.2.1.0 permission audit didn't trace into Validate() trigger chains for template-populated fields
Payment Terms	R	ApplyCustomerTemplate → Validate("Payment Terms Code")	Same
Currency	R	ApplyCustomerTemplate → Validate("Currency Code")	Same
Country/Region	R	ApplyCustomerTemplate → Validate("Country/Region Code")	Same
General Ledger Setup	R	BestwayUSA INVCCustomerAreaDimension OnAfterInsertEvent + INVCUpdateSalesOrderAreaDimension OnAfterModifyEvent	Cross-extension event subscriber — not visible from the BC Dialing Application code alone

Updated Permissions property (20 tables, up from 15):

Permissions = tabledata CustomerPhoneLog = RIM,
            tabledata Customer = RIM,
            tabledata "NextivaConfig" = R,
            tabledata "Customer Templ." = R,
            tabledata "No. Series" = R,
            tabledata "No. Series Line" = RM,
            tabledata "Sales & Receivables Setup" = R,
            tabledata "Marketing Setup" = R,
            tabledata Contact = RIM,
            tabledata "Contact Business Relation" = RIM,
            tabledata "Business Relation" = R,
            tabledata "Default Dimension" = RIM,
            tabledata "Dimension Value" = R,
            tabledata "Customer Posting Group" = R,
            tabledata "Gen. Business Posting Group" = R,
            tabledata "VAT Business Posting Group" = R,
            tabledata "Salesperson/Purchaser" = R,
            tabledata "Payment Terms" = R,
            tabledata "Currency" = R,
            tabledata "Country/Region" = R,
            tabledata "General Ledger Setup" = R;

---

Permission History

Version	Tables	Change
2.0.0.12	2	CustomerPhoneLog, Customer
2.2.1.0	15	+13 standard BC tables for Insert(true) and ApplyCustomerTemplate base flow
2.3.3.0	20	+5 tables for template field validation and cross-extension event subscribers

---

Impact on Related Issues

Issue	Impact
ISSUE-12 (403 permissions — CRITICAL)	Direct fix. New customer creation should succeed, eliminating the 65-74% failure rate.
ISSUE-14 (Job Queue 91% error rate)	Self-resolves. Future calls will create customers. Orphaned phone logs from prior 403 failures will remain errored unless manually reprocessed.
ISSUE-13 (stale page error)	Partial mitigation. If the stale page error was caused by ApplyCustomerTemplate being called twice (page trigger + BestwayUSA subscriber) with the second call failing mid-write, this fix may reduce occurrence. However, the root cause of CE-0250097's specific error needs separate investigation.
ISSUE-15 (email log backlog)	No direct impact. Email log backlog is a throughput issue in CU-60003, not a permissions issue.

---

2. Step 4 Breadcrumb Consistency Fix

Files modified:

• src/Page/Pag-80000.ReceivePhoneNumber.al
• src/Page/Pag-80003.ReceiveEmail.al

Step 4 (4-PreInitCustomerNo) used the inline key-value Session.LogMessage overload while all other steps (1-3, 5-7) used the Dictionary of [Text, Text] overload. Converted step 4 to use the Dictionary pattern for consistency. Functionally equivalent — both produce the same telemetry output.

---

Object Inventory

No new objects. Modified objects only:

Object	ID	Type	Status	Description
ReceivePhoneNumber	80000	Page	Modified	Added 5 table permissions, fixed step 4 breadcrumb consistency
ReceiveEmail	80003	Page	Modified	Added 5 table permissions, fixed step 4 breadcrumb consistency
PhoneIntegration	60000	Codeunit	Modified	Added 5 table permissions

---

Deployment Notes

• No data migration required — permission declaration only, no behavioral changes
• No configuration changes required
• Backwards compatible — additive permissions, no logic changes
• Supersedes v2.3.2.0 — this version includes the breadcrumb telemetry from v2.3.2.0 plus the permission fix. Deploy this version instead of v2.3.2.0.
• Verification: After deployment, trigger an inbound call to a phone number not in BC (new customer creation path). The call should return HTTP 201 instead of 403. Check Application Insights for BCDIALER-4001 (new customer created) events.
• Post-deployment monitoring: Query RT0008 events for HTTP 403 on objects 80000 and 80003. Rate should drop to near zero. Any remaining 403s indicate additional missing tables — use the BCDIALER-0020 breadcrumb telemetry to identify the specific step.

---

Known Limitations

• Permission list may still be incomplete for other customer templates. The analysis is based on the ECOMMERCE template's field values (salespersonCode, paymentTermsCode, currencyCode, country). If the template is changed to populate additional fields (e.g., Location Code, Shipment Method Code, Payment Method Code), those tables would need to be added. The breadcrumb telemetry (v2.3.2.0) remains in place to diagnose any future gaps.
• BestwayUSA event subscribers could change. If Innovia modifies the BestwayUSA extension to add new event subscribers on Customer table events that access additional tables, the permission list would need updating. This is an inherent risk of cross-extension event-driven architecture.
• Orphaned phone logs from ISSUE-14 — 84 phone log records with "Customer not found" errors will remain in the error state. These reference calls where the 403 prevented customer creation. They can be manually reprocessed via the Manual Sync page (80009) after identifying the correct customer records, or left as-is if the call data is no longer needed.