## Validate before sending

Use bounds defined by OpenAPI rather than creating a second contract in your application. During creation, `external_id` accepts up to 128 characters; `Idempotency-Key`, up to 180; `metadata`, up to 8 KB. When provided, `expires_in_minutes` ranges from 5 to 129600 minutes. Omitting an optional field is different from sending an arbitrary value.

Read countries, locales, statuses and codes from the current reference. For example, the website language `en` does not authorize replacing an API locale enum with that same value.

## Control client behavior

Configure connection and response timeouts. Limit concurrency, monitor your queue and use progressive delay for transient failures. Correct authentication, permission or payload errors before retrying. Do not continuously query every transaction without an interval.

This guide does not publish a universal request quota or SLA. Confirm the operational and commercial limits that apply to your integration with the responsible team.

## Minimize what you need to protect

Send only data necessary for your process. Do not use `metadata` as storage for documents, secrets or extensive personal-data payloads. Avoid logging complete request bodies. Protect journey links and downloaded files as sensitive access.

Combine [webhooks](/en/developers/kyc/webhooks-and-events) with [reconciliation](/en/developers/kyc/redelivery-and-reconciliation) instead of relying only on frequent polling. Review the [go-live checklist](/en/developers/kyc/go-live) to connect these practices to your operation.