integration-engineeringlisted

# Integration Engineering The boundaries between systems — public APIs, webhooks, connectors, data sync — are where enterprise products break. This skill makes them contract-driven, idempotent, resilient, and secure. Backs the `integration-engineer`; consumes contracts from the `solution-architect`; security-reviewed before release. Honors `secure-coding`. User > skills > default. ## Fits in the pipeline Stage 4 (contracts in the module map), Stage 6 (implementation with backend-engineer), Stage 7 (security review of the integration boundary + contract tests). ## API design (public REST) - **Resource-oriented**, plural nouns, no deeper than collection/item/collection; never mirror the DB schema. Correct HTTP semantics + status codes. **OpenAPI is the versioned contract** (source of truth; spec diffs are a breaking-change review gate). **Every breaking change = a new explicit version.** - **Idempotency:** PUT/DELETE idempotent; mutating **POST/PATCH MUST accept an `Idempotency-Key`** and dedupe server-side. **Pagination** with a continuation token + an **enforced server-side max page size** (cap oversized `limit` to prevent DoS). **Errors = `application/problem+json` (RFC 9457)** (`type`/`title`/`status`/`detail`/`instance`). **Rate-limit** per client → `429` + retry hints. ## Webhooks - Assume **at-least-once** (duplicates, out-of-order). **Sign + verify HMAC over the RAW body BEFORE parsing** (parsing first corrupts the signed bytes); bind `id.timestamp.body`