Rules & Process Flow

​

1) Rules

​

Authentication & Security

• Never expose API keys/secrets in logs, traces, or error messages.
• Encrypt sensitive data (API secrets, private keys) at rest and in transit.
• Scope tokens to products; use the correct token for Collections vs Payouts/Remittance.
• Store Bearer tokens server-side; rotate and revoke when necessary.

​

Data Validation & Integrity

• Validate all inputs before processing (type, length, format, enums).
• Enforce mandatory fields (reject null/empty).
• Constrain types/lengths to prevent overflows and unexpected errors.
• Ensure request bodies conform to your JSON Schema (reject on validation errors).
• Defend against SQL Injection, XSS, and deserialization attacks.

​

Message Queue Processing (RabbitMQ & NATS)

• Use durable queues to prevent message loss.
• Configure DLQs (dead-letter queues) for failures.
• Make messages idempotent (e.g., use transaction.reference as the idempotency key).
• Implement retries with exponential backoff for transient errors.

​

Logging & Monitoring

• Log requests/responses without sensitive fields (no secrets/tokens/signatures).
• Use structured logging (JSON fields for correlation IDs, reference IDs, user agent).
• Monitor MQ depths, DLQ rates, and processing latencies; alert on anomalies.
• Maintain audit logs for critical ops (logins, config changes, key rotations).

​

2) Collections Request - Contract (post-auth validation)

• Missing/invalid token → 401 Unauthorized.
• Missing transaction.service_code → 403 Forbidden.
• Duplicate transaction.reference → handle gracefully (idempotent response).

Authorization: Bearer <JWT Token>
Content-Type: application/json