# Partner API Onboarding Kit

Updated: 2026-03-29
Article: https://spec-coding.dev/blog/contract-testing-plan-from-openapi-to-ci

Use this template to plan and execute a partner API integration from initial kickoff through production go-live. Copy each section into your onboarding tracker and assign owners by name.

## Integration Timeline

| Phase | Duration | Deliverable | Owner |
|-------|----------|-------------|-------|
| Kickoff and scoping | Week 1 | Signed integration agreement, use-case inventory | Partnership Lead |
| Credential provisioning | Week 1-2 | API keys issued, IP allowlisting confirmed | Platform Engineering |
| Sandbox development | Week 2-4 | Partner completes all endpoint integrations in sandbox | Partner Dev Team |
| Contract test suite | Week 3-4 | Automated tests pass against sandbox OpenAPI schema | QA / Partner Dev |
| Security review | Week 4 | Pen-test findings resolved, auth flow validated | Security Engineering |
| Production staging | Week 5 | End-to-end smoke test in production with synthetic data | Platform Engineering |
| Go-live | Week 6 | Traffic cutover, monitoring dashboards confirmed | SRE / Partnership Lead |

## Credential Provisioning Checklist

- [ ] Partner organization created in identity provider
- [ ] OAuth 2.0 client credentials issued (client_id + secret)
- [ ] Scopes assigned matching agreed use-case inventory
- [ ] IP allowlist entries added for partner egress IPs
- [ ] Rate limit tier configured (document agreed QPS)
- [ ] Webhook signing secret generated and shared via secure channel
- [ ] Partner confirms credentials stored in a secrets manager (not source control)

## Sandbox Testing Requirements

- [ ] Partner achieves 100% endpoint coverage against the OpenAPI spec
- [ ] At least one test per endpoint exercises a 4xx error path (invalid input, auth failure)
- [ ] Idempotency key handling verified on all POST/PUT mutations
- [ ] Pagination tested to completion on list endpoints returning 100+ records
- [ ] Webhook receiver returns 2xx within 5 seconds; retry backoff confirmed
- [ ] Partner demonstrates graceful handling of 429 (rate limit) and 503 (maintenance) responses

## Go-Live Criteria

All items must be verified before production traffic is enabled:

- [ ] Contract test suite passes in CI on every partner deploy
- [ ] P95 latency in sandbox is below agreed SLA threshold
- [ ] Error rate across all endpoints is below 1% over a 48-hour window
- [ ] Logging captures correlation IDs end-to-end (partner request ID mapped to internal trace)
- [ ] Runbook exists for revoking partner credentials within 15 minutes
- [ ] Billing metering validated: usage records match partner-side call logs within 0.1% tolerance

## Support Escalation Contacts

| Severity | Response SLA | Contact | Channel |
|----------|-------------|---------|---------|
| P0 - Production outage | 15 min | On-call SRE | PagerDuty + dedicated Slack channel |
| P1 - Degraded functionality | 1 hour | Platform Engineering lead | Partner support Slack channel |
| P2 - Non-blocking issue | 1 business day | Developer Relations | partner-support@yourcompany.com |
| P3 - Feature request | 5 business days | Product Manager | Partner portal ticket |

## Notes

- Distribute this kit to the partner at kickoff. Review it jointly in week 1 so expectations are explicit.
- Store completed checklists alongside the integration agreement for audit purposes.
- Re-run the sandbox testing checklist after any breaking schema change (major version bump).
