On this page
Confirm environment and access
- Official API address confirmed for your enabled environment.
- Key stored only on your backend with necessary permissions.
- Credentials and data separated between testing and production.
- Authorized IPs and download scope when accessing files.
Cover the complete lifecycle
Create a transaction, persist its correlation, open the returned journey and read its result. Cover rejection, expiration and manual review too; testing only approval leaves important decisions unhandled. An intermediate step must not release the process as approved.
Simulate a lost POST response and confirm retries use the same idempotency key. Send duplicate and out-of-order events to your consumer and verify GET reconciliation without repeating business side effects.
Check the event receiver
- Raw body preserved before JSON parsing.
- HMAC and time policy verified before processing.
- Durable acceptance, deduplication by
event_idand failure recovery. - Sanitized logs with no secrets in URLs or public tools.
Prepare operations
Assign responsibility for pending cases, delivery failures and expired transactions. Document how to pause business continuation during unavailability, reconcile afterward and contact support without unnecessary personal data.
Confirm purpose, access and retention requirements with the responsible teams. The simulator checks understanding of the contract; it does not certify your infrastructure or perform real identity verification. Production launch depends on the enablement and operational acceptance agreed for your integration.