Validate before sending
Use bounds defined by OpenAPI rather than creating a second contract in your application. During creation, external_id accepts up to 128 characters; Idempotency-Key, up to 180; metadata, up to 8 KB. When provided, expires_in_minutes ranges from 5 to 129600 minutes. Omitting an optional field is different from sending an arbitrary value.
Read countries, locales, statuses and codes from the current reference. For example, the website language en does not authorize replacing an API locale enum with that same value.
Control client behavior
Configure connection and response timeouts. Limit concurrency, monitor your queue and use progressive delay for transient failures. Correct authentication, permission or payload errors before retrying. Do not continuously query every transaction without an interval.
This guide does not publish a universal request quota or SLA. Confirm the operational and commercial limits that apply to your integration with the responsible team.
Minimize what you need to protect
Send only data necessary for your process. Do not use metadata as storage for documents, secrets or extensive personal-data payloads. Avoid logging complete request bodies. Protect journey links and downloaded files as sensitive access.
Combine webhooks with reconciliation instead of relying only on frequent polling. Review the go-live checklist to connect these practices to your operation.