Integration checklist

Before switching to live keys, confirm each item:

1. Keys are stored server-side only, one key per system, each with the fewest scopes and fleets it needs; tracking-data keys are separate from management keys.
2. Every POST, PATCH and DELETE sends an Idempotency-Key derived from your own record (order line, customer id), and retries reuse it.
3. Activations send external_order_reference and a unique external_request_id per intended action.
4. Customers and fleets are found again by external_reference rather than by name or email.
5. Your system treats 202 Accepted as "requested", not "active", and only shows a service as active after service.activation_completed or a completed operation.
6. Your webhook endpoint verifies the signature on the raw body, rejects old timestamps, answers 2xx within 10 seconds and processes the event afterwards.
7. Events are deduplicated by id, tolerated out of order, and your code re-reads the resource when the order matters.
8. You handle every error code in Errors, honour Retry-After, and back off on 429 and 503.
9. Cancellations in your system call the deactivation endpoint; your customer's retail cancellation never stops Fleetalyse charges by itself.
10. Your interface shows service state, device connectivity and SIM state separately and marks tracking data older than 10 minutes as stale.
11. Lists follow next_cursor until has_more is false.
12. You tested failures with the magic identifiers, including an unknown outcome (…0002).
13. Someone on your team receives the Partner account's security and billing emails.