Api
Go-Live Checklist
Production-readiness checklist for DMTR API integrations: credentials, idempotency, webhooks, error handling, and rate limits.
Work through this checklist before promoting an integration out of the sandbox. External production access is gated; the checklist applies to sandbox and staging integrations today.
Credentials and environment
- Separate API keys per environment; production keys are never used in sandbox code paths. See Authentication.
- Keys are stored in a secrets manager, not in source or CI logs.
- Key rotation is scheduled and tested. See Secrets rotation.
Request correctness
- All mutating requests send idempotency keys. See Idempotency.
- Pagination is handled on every list endpoint. See Pagination.
- The client pins an API version and handles deprecation headers. See Versioning.
Failure handling
- Error responses are handled by code, not message string. See Errors.
- Retries use exponential backoff and respect rate-limit headers. See Rate limits.
- Webhook signatures are verified and replay windows enforced. See Webhooks.
Operations
- Health and latency of DMTR calls are monitored with alerting. See Observability.
- Runbook entries exist for auth failures, webhook lag, and rate limiting. See Runbooks.
- A sandbox smoke test runs in CI against the sandbox environment.