What actually breaks when you integrate a third-party API
Rate limits, auth expiry and silent schema changes — the failure modes that don’t show up until a partner’s API changes under you.
The demo works. The edge cases are the project
Connecting to a third-party tool looks like a two-day job because the happy path is a two-day job. Authenticate, call the endpoint, map the fields, show the result. What takes the remaining weeks is everything the demo did not do: the record with a missing field, the duplicate that arrives twice, the customer whose name contains a character the other system rejects.
Scoping an integration from the demo is how projects end up half-finished. We scope in phases and deliver working software at each milestone precisely because the second phase is usually where the real shape of the data becomes visible, and a fixed plan written before that is a plan written without the facts.
Rate limits, retries and the state in between
Every API has a ceiling, and a bulk import is the thing most likely to hit it. What happens at that point decides whether the integration is trustworthy: a job that stops halfway and cannot tell you where it stopped leaves someone reconciling two systems by hand, which is the work the integration was supposed to remove.
That means retries with a sensible backoff, idempotency so a retried write does not create a second record, and a log that records what succeeded rather than only what failed. It is unglamorous engineering and it is the difference between an integration your team trusts and one they check manually every morning.
The other system will change, and nobody will tell you
Third-party APIs get versioned, deprecated and quietly altered. A field that was always present becomes optional; a response that was a string becomes an object. If the integration assumes the shape it saw on the day it was built, it will fail on a morning nobody is expecting.
So we validate what comes back rather than trusting it, fail loudly where a silent failure would corrupt data, and hand over documented source and deployment scripts so the code can be maintained by whoever comes next — including your own team. An integration nobody can read is a dependency, not an asset.
Full-time teams in Chile and India, about nine hours apart. Chile covers your working day; India picks the file up as you sign off, so weekday work does not wait overnight.
Tier 3 is the top of our creative scale — and the only tier we run. The thinking behind this article is the same thinking behind every brief we take on.