Integration checklist

Authentication and environments

[ ] Send POST/PATCH requests with Content-Type: application/json.
[ ] Use snake_case for JSON fields and query parameters.
[ ] Handle amounts and traffic as strings, and do not convert IDs to low-precision numeric types.
[ ] Determine success from response-body code = 0, not only HTTP 200.
[ ] Treat non-200, non-JSON, and empty responses as transport failures. Read operations may be queried again; for write operations, verify the current result or state first.
[ ] Save any available X-TRACE-ID, but do not log API keys or proxy passwords.

[ ] Generate a unique request_no for every business operation.
[ ] Understand that request_no only prevents duplicate acceptance; it is not a result-query key and does not guarantee replay of the original result.
[ ] If the outcome of a write request is uncertain, query the result first instead of blindly resubmitting with the original or a new request number.
[ ] Store the request number, request content, call time, environment, any available X-TRACE-ID, and the returned order number.
[ ] Never provide an API key when contacting support.

[ ] Query a purchase order until its status is COMPLETED or FAILED.
[ ] Stop polling when a renewal order is COMPLETED. If it is FAILED, continue querying details until no resource remains PROCESSING.
[ ] Retain polling and recovery queries even when a callback is configured.
[ ] Use the shared fixed public key for test and production described in the callback guide, and verify the timestamp, line break, and raw request body with RSA-SHA256.
[ ] Verify that the callback timestamp differs from the current time by no more than five minutes. Do not trigger business queries if signature verification fails.
[ ] Deduplicate callback processing by order_no.
[ ] Design recovery queries around the rule that each order receives at most one callback, failed delivery is not retried, and no second callback is sent.
[ ] Do not treat a callback as the sole source of the order result.
[ ] Query order details again after manual handling by support to obtain the latest result.

[ ] Do not send request_no or callback_url in purchase or renewal quote requests.
[ ] Do not treat a quote as an order or payment result; quote APIs have no side effects.
[ ] Accept repricing when the actual order is created; the final amount may differ from the quote.

[ ] Do not write API keys, proxy accounts, passwords, or connection credentials to ordinary logs.
[ ] Do not place responses containing sensitive fields in shared caches or error pages.
[ ] If you suspect API key exposure, revoke and replace the key immediately in the web console.