Going live

Onboarding steps#

1. Agreement. Sign the integration agreement and its data processing addendum.
2. Sandbox access. Your account manager issues sandbox clients and registers your technical contact (email and phone) for incident and deprecation notices.
3. Build and test against the sandbox, using the simulator to drive every flow you integrate.
4. Review. Send the checklist below with sample logs. Wathiqaty usually reviews it within 3 business days.
5. Production. Production clients are issued, ideally with an IP allow-list. Register your production webhook endpoints.

Checklist#

• Tokens are cached and renewed, not requested per call.
• Every write you might retry sends an Idempotency-Key, and retries reuse it.
• Webhook signatures are verified on the raw body, timestamps older than 5 minutes are rejected, and events are deduplicated by id.
• Your webhook endpoint answers 2xx within 10 seconds and processes the event asynchronously.
• A reconciliation job (change feed or bordereau) catches anything a missed webhook would leave behind.
• Money is parsed as a decimal type, never a binary float.
• You log the X-Request-Id you send (or metadata.requestId) with every call.
• Your client ignores unknown fields and unknown enum values, and answers 2xx to unknown webhook event types.
• Secrets live in a secret manager, not in code or config files.
• Personal data from the API is stored and kept only as long as your policy administration requires (Egypt's Personal Data Protection Law 151/2020).

Support#

Write to your account manager or api-support@wathiqaty.com with the request id, the endpoint, the time and the environment. Production incidents affecting the API are announced to registered technical contacts.