# CRM Vendor Integration Checklist

## Access

- [ ] Sandbox application created.
- [ ] Sandbox API key received, for example `sandbox_xxxxxxxxxxxxxxxxxxxxxxxx`.
- [ ] Sandbox signing secret received, for example `sandbox_secret_xxxxxxxxxxxxxxxxxxxxxxxx`.
- [ ] Production API key requested only after certification passes.
- [ ] Signing secret stored securely.
- [ ] HMAC signature generation implemented.
- [ ] Timestamp and nonce headers implemented.
- [ ] Test calls to `/health`, `/capabilities`, and `/version` completed.
- [ ] Sandbox calls use `/api/v1/sandbox/crm/...` and do not touch production data.

## Property Lifecycle

- [ ] Create property.
- [ ] Update property.
- [ ] Send media.
- [ ] Send documents.
- [ ] Withdraw property.
- [ ] Archive property.
- [ ] Restore property.
- [ ] Reactivate property.
- [ ] Delete property.

## Reliability

- [ ] Idempotency key or event id sent on every request.
- [ ] Provider retries use the same idempotency key.
- [ ] `already_processing` handled safely.
- [ ] `rate_limited` handled with backoff.
- [ ] Network timeout retry policy tested.

## Validation

- [ ] Required fields mapped.
- [ ] Public error details shown in integration logs.
- [ ] External references are path-safe or URL-encoded.
- [ ] Media and document URLs are accessible by Quardlyn.

## Certification

- [ ] Run the black-box certification client using only public artifacts:

```bash
QUARDLYN_CERT_BASE_URL="https://your-quardlyn-host.example" \
QUARDLYN_CERT_SANDBOX_KEY="sandbox_xxxxxxxxxxxxxxxxxxxxxxxx" \
QUARDLYN_CERT_SANDBOX_SECRET="sandbox_secret_xxxxxxxxxxxxxxxxxxxxxxxx" \
php docs/crm-api/certification/fake_crm_certification.php
```

- [ ] Confirm authentication, invalid signatures, expired timestamps and replay protection pass.
- [ ] Confirm create, update, patch, withdraw, archive, restore, reactivate and delete pass.
- [ ] Confirm image, floorplan, EPC and brochure URL uploads pass.
- [ ] Confirm required fields, invalid enums, invalid status, invalid media and unknown fields are rejected.
- [ ] Confirm all documented canonical fields submit, validate, store and return correctly.
- [ ] Confirm sandbox webhook simulations/replay, pagination, sync and 1/100/1000 property performance tests pass.
- [ ] Move to production credentials only after the report summary is `FAILED 0`.
- [ ] Confirm the production integration uses CRM -> Quardlyn API only; outbound Quardlyn -> CRM webhooks are Beta / Sandbox Simulation Only.


## Go-Live Checklist

- [ ] Production credentials issued: API key and API/HMAC signing secret.
- [ ] Production base URL configured: `https://api.quardlyn.co.uk/api/v1/crm`.
- [ ] HMAC authentication uses `X-CRM-Key`, `X-CRM-Timestamp`, `X-CRM-Nonce` and `X-CRM-Signature`.
- [ ] Required canonical fields are always sent on create/upsert: `property.external_ref`, `property.department` and `property.display_address`.
- [ ] `external_ref` is stable and unique per authenticated CRM connection.
- [ ] Media, floorplan, EPC and brochure fields contain public `http` or `https` URLs, not embedded binary data.
- [ ] Lifecycle/status handling covers create, replace, patch, withdraw, archive, restore, reactivate and delete.
- [ ] Error handling logs HTTP status, error code, message, field and request id where present.
- [ ] Retry logic uses backoff for retryable failures and reuses the same idempotency key for the same CRM event.
- [ ] Certification/report artifacts are submitted with the production access request when required by the Developer Console workflow.
- [ ] Outbound Quardlyn -> CRM webhooks are treated as Beta / Sandbox Simulation Only.