Skip to main content

Production checklist

Use this checklist before enabling an ARC integration for real customer traffic.

Access and tenancy​

  • The connection stores the exact ARC host and organization association.
  • The tenant is derived from the credential; no user input or header can override it.
  • Each integration has its own API key. A key belongs to one workspace and has no environment of its own, so a separate non-production workspace (if your account has one) needs its own key — see Environments, hosts and test data.
  • Keys have an IP allowlist where the worker has stable egress.
  • The integration uses READ_ONLY unless it genuinely creates or mutates data.
  • User JWT and MCP refresh tokens are stored server-side and encrypted.

Data correctness​

  • Catalog mappings use ARC product, variant, UOM, customer, supplier, and warehouse ids.
  • Prices, tax, totals, due dates, document numbers, statuses, and balances come from ARC responses.
  • Every list operation has a tested pagination/checkpoint strategy.
  • Every create retry uses the same idempotency key.
  • Every optimistic-concurrency mutation handles a stale expectedVersion.
  • Currency code is stored with every amount.
  • The external ledger can reconcile by ARC opaque id and updatedAt.

Error and retry behavior​

  • GraphQL errors are inspected even for HTTP 200 responses.
  • Error codes are mapped to actionable states; message text is not the only discriminator.
  • 401/403/validation/domain errors are not retried blindly.
  • 429/5xx/network failures use bounded exponential backoff and jitter.
  • A timeout after a mutation triggers a read/reconciliation check before another create.
  • Failed imports and asynchronous work have a visible operator path.

Security and operations​

  • Authorization headers and credentials are redacted from logs and traces.
  • Request ids, operation names, tenant-safe external ids, and latency are logged.
  • Access is tested with a least-privileged role/key, not only an administrator.
  • Key revocation and refresh-token rotation have been tested.
  • Alerts exist for repeated authentication failures, idempotency conflicts, and reconciliation drift.
  • The integration has a runbook for revoking credentials and replaying a safe sync.

Release contract​

  • Generated GraphQL client types are pinned to the schema snapshot used in CI.
  • Deprecated fields are tracked with an owner and removal plan.
  • Critical operations have contract tests — against a separate non-production workspace if your account has one, otherwise read-only checks plus the clean-up steps in Environments, hosts and test data.
  • A production smoke test checks host, auth, tenant, one read, and one safe read-only reconciliation.
  • A production write is enabled only after an operator has reviewed a small first batch. ARC has no general dry-run mode; the bulk-import preview is the only built-in preview step.

See API changelog and compatibility before upgrading the schema/client snapshot.