Public resources
Treat the OpenAPI document as the request reference
Use the current API documentation and OpenAPI specification for paths, methods, request bodies and response schemas. Do not hard-code behaviour that is not documented by the current interface.
Protect API credentials
- Store credentials outside public source code and browser-delivered JavaScript.
- Scope access to what the integration requires.
- Keep production and test credentials separate where your workflow supports it.
- Revoke credentials that are no longer needed.
Handle responses defensively
Validate HTTP status codes and response bodies before treating an operation as successful. Preserve the provider response and correlation information needed for troubleshooting, but do not log secrets.
Change management
When changing an integration, test against the current API documentation before production rollout. Keep enough logging to diagnose a failed request without storing authentication secrets or customer-sensitive data.