Overview

This section consolidates practical implementation guidelines for building robust SIBS Payment Gateway (SPG) integrations.

It focuses on how to implement the concepts defined in previous sections, ensuring:

• Correct handling of asynchronous flows
• Consistent transaction state management
• Resilient behavior under real-world conditions

The emphasis is on operational reliability, not on API usage details.

Adopt a State-Driven Design

Integrations must be designed around explicit transaction states, not request/response flows.

Guidelines

• Model transactions using states such as:
  • Pending, Success, Declined, Timeout
• Persist state transitions explicitly
• Ensure state transitions are:
  • Deterministic
  • Forward-only

Rationale

SPG is inherently asynchronous and event-driven, making state-based modeling essential for correctness.

Separate Technical and Business Logic

Maintain a strict separation between:

• Technical processing
• Business actions

Guidelines

• Use returnStatus for:
  • API validation
  • Technical success/failure
• Use paymentStatus for:
  • Business decisions
  • Transaction outcome
• Never trigger business actions based solely on:
  • HTTP status
  • returnStatus.statusCode

Treat Pending as a First-Class State

Pending is a normal and expected state, not an exception.

Guidelines

• Always support Pending in:
  • Persistence model
  • Business workflows
• Design processes to:
  • Wait for final confirmation
  • Handle long-lived pending states

Rationale

Many payment methods (e.g., MB WAY, Multibanco Reference) rely on external or delayed confirmation.

Use Webhooks and Status API Complementarily

Do not rely exclusively on a single mechanism.

Guidelines

• Use webhooks for:
  • Real-time updates
  • Event-driven processing
• Use the Status API (GET <ROOT_URL>/api/v2/payments/{transactionID}/status) for:
  • Final state confirmation
  • Recovery from missed or delayed events

Implement Idempotent Processing

All transaction processing must be idempotent by design.

Guidelines

• Ensure that:
  • The same event can be processed multiple times safely
• Use identifiers such as:
  • transactionID
  • merchantTransactionId
• Protect against:
  • Duplicate webhook deliveries
  • Retried operations

Rationale

Distributed systems cannot guarantee single delivery.

Enforce Safe State Transitions

Prevent invalid or inconsistent state changes.

Guidelines

• Do not allow transitions such as:
  • Success → Pending
  • Declined → Pending
• Define final states:
  • Success
  • Declined
• Reject updates that attempt to overwrite final states

Design for Eventual Consistency

Assume that systems are temporarily inconsistent.

Guidelines

• Do not assume:
  • Immediate synchronization between systems
• Expect:
  • Delayed updates
  • Out-of-order events
• Always validate final state using the Status API (GET <ROOT_URL>/api/v2/payments/{transactionID}/status)

Implement Reconciliation Mechanisms

Reconciliation is mandatory for production systems.

Guidelines

• Periodically query transactions in:
  • Pending
  • Timeout
• Detect and resolve:
  • Missing updates
  • Inconsistent states
• Maintain audit logs for:
  • All state transitions

Handle Timeouts and Uncertain States Properly

Timeout does not mean failure.

Guidelines

• Treat Timeout as:
  • Uncertain state
• Always:
  • Confirm via the Status API (GET <ROOT_URL>/api/v2/payments/{transactionID}/status)
  • Delay business decisions until resolved

Ensure Observability and Traceability

Visibility is essential for debugging and operations.

Guidelines

• Log:
  • Requests and responses
  • Webhook payloads
  • State transitions
• Correlate using:
  • transactionID
  • merchantTransactionId
• Ensure logs support:
  • Debugging
  • Audit and reconciliation

Control Retry Strategies Carefully

Retries must be intentional and controlled.

Guidelines

• Retry only when:
  • Errors are temporary (e.g., transient or recoverable failures)
• Avoid:
  • Blind retries
  • Duplicate transaction creation
• Use:
  • Backoff strategies
  • Status API checks (GET <ROOT_URL>/api/v2/payments/{transactionID}/status)

Summary

Robust SPG integrations require:

• State-driven design
• Strict separation of concerns
• Idempotent and resilient processing
• Explicit handling of asynchronous behavior

By applying these practices, integrators ensure:

• Reliable transaction processing
• Accurate financial outcomes
• Stability under real-world operational conditions