api-integration

API Integration Skill

Design integration patterns, webhook flows, event pipelines, and API composition strategies.

Webhook Design

Outbound Webhook Endpoint (from your system to 3rd party)

POST {subscriber_url}
Headers:
  Content-Type: application/json
  X-Webhook-Signature: hmac-sha256=<sig>
  X-Webhook-Event: order.created
  X-Webhook-Delivery: <uuid>
  X-Webhook-Timestamp: <unix-epoch>

Payload envelope

{
  "event": "order.created",
  "delivery_id": "uuid",
  "created_at": "ISO8601",
  "data": { ... }
}

Signature verification (receiver side):

import hmac, hashlib
expected = hmac.new(secret.encode(), payload_bytes, hashlib.sha256).hexdigest()
assert f"sha256={expected}" == request.headers["X-Webhook-Signature"]

Inbound Webhook Registration API

POST   /api/v1/webhooks           — register subscriber URL + events
GET    /api/v1/webhooks           — list subscriptions
DELETE /api/v1/webhooks/{id}      — unsubscribe
POST   /api/v1/webhooks/{id}/test — fire test event
GET    /api/v1/webhooks/{id}/deliveries — delivery history + status

API Chaining / Composition Pattern

Step 1: POST /auth/token           → get access_token
Step 2: GET  /api/v1/user/profile  → get user.id (use token from step 1)
Step 3: POST /api/v1/orders        → create order (use user.id from step 2)
Step 4: POST /api/v1/payments      → charge (use order.id from step 3)

Always: handle failures at each step independently, use idempotency keys, implement retry with exponential backoff.

Event-Driven Architecture

Event Schema (CloudEvents spec)

{
  "specversion": "1.0",
  "type": "com.example.order.created",
  "source": "/orders-service",
  "id": "uuid",
  "time": "2024-01-01T00:00:00Z",
  "datacontenttype": "application/json",
  "data": { "order_id": "...", "amount": 99.99 }
}

Topics / Queues design