Production checklist

You’ve built your integration. Run through this checklist to make sure everything is production-ready.

Before go-live

• Store API keys server-side or in a secure secrets manager. See Authentication.
• Log metadata.requestId for every request so support can trace issues quickly.
• Monitor quotas.workspace.credits.left and quotas.workspace.minuteRateLimit.left from the Usage endpoint.
• Route async workflows through a durable webhook receiver, not a manual test endpoint.
• Make webhook processing idempotent by deduplicating on webhookId. See Webhooks.

Request safety

• Use timeouts on every outbound request.
• Retry only 429 and 5xx with exponential backoff. See Error handling.
• Respect minuteRateLimit.nextReset before retrying a throttled request.
• Treat 4xx validation or auth failures as permanent until you change the input or credentials.

Webhook safety

• Use HTTPS for every production webhook URL.
• Return 200 quickly, then process heavy work asynchronously.
• Validate that each callback contains webhookId + data or webhookId + errorCode. See Webhook payload.
• Deduplicate on webhookId to handle rare duplicate deliveries.

Monitoring & alerts

• Alert on repeated 401, 402, 429, and 5xx responses.
• Surface credit exhaustion before it blocks critical workflows. See Rate limits & credits.
• Keep one smoke test for a sync endpoint and one for an async endpoint (see below).
• Document which team owns API key rotation, webhook incidents, and quota alerts.

Recommended smoke tests

1. GET /v2/usage returns 200 and a valid quotas object.
2. POST /v2/fetch/persons/check returns 200 with creditsConsumed: 0.
3. One async endpoint returns an immediate response and the result is delivered to your webhook URL.
4. Your application logs both the outbound request and the webhook completion using the same requestId or webhookId.

You’re ready to go live

If you’ve checked every item above, your integration is solid. Ship it.