Integration checklist

Run against the test environment before calling a v1 integration finished. The first block applies to every contract; the contract blocks add to it.

Every contract

Success is decided on a final status, never on the HTTP code.
An unrecognised status leaves the transaction unresolved rather than failing it.
A timeout triggers a retry of the identical request, not a new transaction.
A polling timeout stops polling without marking the transaction failed.
Signatures are computed over the exact bytes sent or received, with no re-serialization.
Callback handlers are idempotent and tolerate out-of-order delivery.
The transaction is re-read after a callback, before goods are released.
Your own transaction reference is generated once and persisted before the call.
Request and response identifiers are logged for every call.

Both Sdk-Partner-Token and X-Signature are sent on every write.
The signature is over compact JSON, in transmitted field order, nulls included, lowercase hex.
One payment taken to paid and one to order_failed.
Whenever a response carries redirect_data, the buyer is sent to redirect_data.url and returns to success_url or failure_url, with 3DS passed there when asked.
GET /sdk-partner/alternative-mobile-pay/mobile-pay/{id}/status is polled from 5 seconds after the create until the status is final.
A partial and a full refund issued, then the same merchant_refund_id replayed.
refunded is not read as "fully refunded" — refunded_amount is checked.

data is base64 of the request JSON and sign is hash_hmac MD5 over that base64 string.
api_key is inside the encoded data, not sent beside it.
Callback sign is verified before the payload is trusted.
status is read as an integer, and 1 is handled as authorization rather than payment.
8 triggers a redirect to the returned payment form rather than a failure.
A refund left at 15 is polled rather than treated as lost.
Card payment credentials are kept separate from the Apple Pay and Google Pay ones.

OK and PROCESSING are handled as non-final.
The MD5 hash is built from the exact field list for that endpoint, concatenated with no delimiter.
A validation failure arriving as HTTP 200 is detected and handled.
A retry never changes the body under an existing id.
check reconciles a transaction whose callback was lost.
Callback HASH is verified and repeated deliveries are ignored.