Optional first pass: use the public integrator sandbox workbench (/developer/account signup → JWT in browser only) before wiring production credentials

Obtain Keycloak client credentials / user JWT for the target tenant (client_admin or platform_admin as required)

Confirm API base URL and TLS

GET /v1/health and GET /v1/readyz succeed

POST /v1/intake/submit returns 201 with submission id

Retry POST /v1/intake/submit with the same Idempotency-Key and body returns the same 201 (no second submission)

Same Idempotency-Key with a different body returns 409 IDEMPOTENCY_KEY_MISMATCH

GET /v1/intake/submissions/{id} returns the submission

POST /v1/webhooks/subscriptions with HTTPS FQDN returns 201 and a one-time secret

Persist secret offline; confirm GET /v1/webhooks/subscriptions does not return secrets

Implement signature verification with scripts/integrator/verify_webhook_signature.py (or equivalent)

Confirm 422 on http:// webhook URL and private IP targets

Confirm 401 without Bearer token

Confirm 429 behavior under load (optional soak)

OpenAPI subset still validates: python3 scripts/qa/validate_integrator_openapi.py --live <staging>/openapi.json

Note P6-056 status before relying on live callback delivery

Go-live checklist — Integrator API

Go-live checklist — Integrator API