Integration checklist

Authentication and production environment

[ ] Send POST/PATCH requests with Content-Type: application/json.
[ ] Use snake_case for JSON fields and query parameters.
[ ] Handle amounts and traffic as strings, and do not convert IDs to low-precision numeric types.
[ ] Determine success from response-body code = 0, not only HTTP 200.
[ ] Treat non-200, non-JSON, and empty responses as transport failures. Read operations may be queried again; for write operations, verify the current result or state first.
[ ] Save any available X-TRACE-ID, but do not log API keys or proxy passwords.

[ ] Generate a unique request_no for every business operation.
[ ] Understand that request_no only prevents duplicate acceptance; it is not a result-query key and does not guarantee replay of the original result.
[ ] If the outcome of a write request is uncertain, query the result first instead of blindly resubmitting with the original or a new request number.
[ ] Store the request number, request content, call time, production Base URL, any available X-TRACE-ID, and the returned order number.
[ ] Never provide an API key when contacting support.

[ ] Filter the order list by the exact order_no. Stop automatic polling when a purchase order reaches SUCCESS, PARTIAL_SUCCESS, or FAILED.
[ ] Stop automatic polling when a renewal order reaches COMPLETED or FAILED.
[ ] For a SUCCESS or PARTIAL_SUCCESS purchase order, list static proxy resources to obtain connection details for successfully fulfilled resources.
[ ] Retain polling and recovery queries even when a callback is configured.
[ ] Use the fixed production public key described in the callback guide, and verify the timestamp, line break, and raw request body with RSA-SHA256.
[ ] Verify that the callback timestamp differs from the current time by no more than five minutes. Do not trigger business queries if signature verification fails.
[ ] Deduplicate callback processing by order_no.
[ ] Design recovery queries around the rule that each order receives at most one callback, failed delivery is not retried, and no second callback is sent.
[ ] Do not treat a callback as the sole source of the order result.
[ ] Query the corresponding order list and static proxy resources again after manual handling by support.

[ ] Do not write API keys, proxy accounts, passwords, or connection credentials to ordinary logs.
[ ] Do not place responses containing sensitive fields in shared caches or error pages.
[ ] If you suspect API key exposure, revoke and replace the key immediately in the web console.