Third-party integration architecture review

For engineering leads and staff engineers who own outbound HTTP, webhook handlers, or queue consumers tied to an external vendor.

Outcome

You receive a written report (typically 12–18 pages) plus a 90-minute recorded walkthrough. The report ranks risks as blocking, degrading, or cosmetic, and ties each item to a file path or sequence diagram edge where possible.

Who it is for

Teams in South Africa and internationally that already have a vendor integrated—or are weeks from go-live—and want an independent read before peak season, audit, or a pricing renegotiation. Common contexts: card present and card not present flows, courier label APIs, KYC providers, and accounting exports.

What we examine

Authentication refresh, secret rotation, and per-environment credential separation
Timeout, retry, and idempotency key usage on write operations
Webhook signature verification, ordering, and duplicate delivery handling
Mapping between vendor models and your domain entities (including partial failures)
Observability: correlation IDs across your service and vendor dashboards

What is not included

Writing production code on your behalf (we may suggest patches as snippets)
Load testing at scale unless agreed as a separate sprint
Legal review of vendor contracts—see vendor due diligence for API-specific clauses

Process and timeline

Intake (week 0): NDA if needed, read-only repo access, sample webhook payloads, and vendor doc links.
Analysis (week 1–2): Async review with one midpoint call for clarifications.
Delivery (week 2–3): Report, diagram updates, and walkthrough with your team.

Typical calendar duration is three weeks; expedited two-week delivery is available when schedules allow.

Delivery

Remote by default. On-site working sessions in Cape Town can be added for the walkthrough day.

Pricing basis

Fixed fee from R 48 000 ex VAT for a single primary vendor integration and up to two webhook event types. Additional vendors or event families are quoted per scope. See rate guidance.

Next step

Send integration context Include the vendor name, languages/frameworks, and your target go-live date.