Map systems before endpoints
Start by defining which system owns client identity, account creation, status and permissions. Only then should teams map APIs or connectors.
Account lifecycle events
Document what happens when an account is requested, approved, created, disabled, updated or closed, and which systems must know about each event.
Security and permissions
Use the minimum permissions needed, protect secrets, document access ownership and make operational changes auditable.
Test failure states
Integration testing should include timeouts, duplicate events, rejected actions and provider outages, not only successful requests.
Write down event outcomes and recovery steps
For every integration event, record its source, required fields, permissions and expected result. An account request needs a stable request identifier and a way for operations to inspect its outcome. Avoid deciding the workflow solely from the happy-path screen.
| Case | Expected operational outcome |
|---|---|
| Successful creation | Store the returned account identifier and the request outcome. |
| Repeated request | Recognize the prior outcome instead of accidentally creating a duplicate. |
| Timeout | Check the provider state before deciding whether a retry is appropriate. |
| Rejected action | Display the reason and route the task to the responsible role. |
| Permission change | Verify access and record who approved the change. |
| Service recovery | Reconcile pending events and identify unresolved requests. |
These are acceptance criteria to discuss with the integration team; implementation depends on the available interface and contract. Keep access credentials outside browser code and client-facing forms. During handover, provide a runbook explaining how to find a request and resolve a mismatched account state.
Use the broker CRM scope and stack ownership worksheet to assign responsibility.