Describe the exchange
For each operation, document the method, resource, required fields and shape of a successful response. Include a validation error. Distinguish a transport failure from a rejected request: a missing response does not prove that a state-changing operation failed.
Treat credentials as configuration
Keep server credentials outside browser bundles and source repositories. Request the smallest useful permission set and separate development access from production access. Record who owns each integration and how access can be revoked. Follow the provider’s documented authorization flow.
Plan for unavailable dependencies
Set timeouts, respect rate-limit guidance and retry only when an operation is safe to repeat. Where supported, an idempotency key can identify repeated requests. Log a request identifier and a concise failure category; avoid authorization headers, session cookies and personal payloads.