Custom Software & API Integrations

An API provider may change field presence, formatting, or meaning without a major version change. Integrations that assume every response has the same shape can stop processing records or silently map values incorrectly. What to check Compare sanitized responses before and after the issue, review provider notices and request IDs, and inspect schema...

An API can return a successful response while silently omitting records because of pagination, default filters, permission scopes, time windows, or eventual consistency. The integration may appear healthy while downstream totals are incomplete. What to investigate Compare requested and returned page cursors, record counts, date boundaries, filter...

A client timeout does not prove that the server rejected a request. The operation may have completed while the response was lost, so retrying blindly can create duplicate orders, payments, or records. What to check Check provider request IDs, operation status, idempotency support, retry policy, and logs on both sides. Separate read-only requests from...

A long-lived API token can continue working long after a staff member or integration changes. If it is copied into code or logs, rotation may be difficult and access can exceed what the integration needs. What to check Identify where the token is stored, its permissions, owner, last use, expiration options, and all consumers. Review source control and...

A publicly reachable webhook can receive forged requests if the endpoint trusts any caller. Attackers may replay events, trigger unauthorized changes, or flood processing queues. What to check Review provider signature validation, timestamp tolerance, secret rotation, request size limits, replay protection, rate limits, and logging. Confirm signature...

Webhook providers may retry delivery when acknowledgments are delayed or lost. If the integration processes every delivery as new, a single event can create duplicate records or repeat a business action. What to check Check provider event IDs, retry headers, response timing, concurrent workers, and destination behavior. Determine whether the webhook...

An API rate limit can interrupt integrations during peak activity. If the system drops events instead of queueing or retrying them, records may never reach the provider even after the limit window resets. What to check Review rate-limit headers, retry-after guidance, queue depth, event retention, concurrency, and dead-letter handling. Identify whether...

Webhook senders and receivers may rotate a shared secret on different schedules. If the receiver switches too early or too late, valid events can be rejected; accepting both secrets indefinitely weakens control. What to check Confirm provider rotation behavior, signature version, overlap window, secret storage, deployment sequence, and rejected event...