Use official API documentation, typed payloads, bounded retries, idempotency, redacted logs, and scoped credentials. Test success, timeout, malformed response, rate limit, duplicate request, and revoked access.
Objective
add an external API with resilient behavior.
Context
official API docs, auth scheme, rate limits, sample payloads, data classification.
Decompose
typed client, timeout/retry, idempotency, validation, observability, mock tests.
Criteria
success, timeout, malformed response, rate-limit, duplicate request, revoked credential.
Security
secrets only through secret manager; redact logs; pin scopes.
Commit/rollback
feature flag and provider adapter.
Output
contract tests, data-flow note, fallback behavior.
Handoff checklist
- Data classification and scopes
- Timeouts and idempotency
- Failure and duplicate cases
- Secrets stay in the manager
Editorial recipe adapted from the project’s September 2026 research brief. Commands, authority and acceptance tests must be matched to your repository. No production execution is implied.