# Provider self-certification checklist

Record each item as `CONFORMANT`, `NON-CONFORMANT`, `NOT IMPLEMENTED`, `NOT APPLICABLE`, or `NOT VERIFIED`, with sanitized evidence.

## Authentication and isolation

- [ ] HTTPS with trusted certificate; redirects disabled
- [ ] Bearer authentication; correct 401 and 403 behavior
- [ ] Separate staging/production keys and integration audience isolation
- [ ] API keys, callback tokens, webhook secrets, and PII are redacted
- [ ] Tenant/account/master-store isolation is enforced

## Create and idempotency

- [ ] Every documented field and validation boundary is handled
- [ ] `platformReference` is persisted and preserved
- [ ] Idempotency is durable across restart and multiple instances
- [ ] identical, concurrent, omitted-callback, and conflicting replays behave correctly
- [ ] timeout ambiguity cannot create a second delivery
- [ ] accepted response always contains a provider delivery ID

## Callback and multi-brand routing

- [ ] per-delivery callback is validated and stored immutably
- [ ] precedence is per-delivery, global fallback, then polling
- [ ] no callback token or HMAC secret is logged
- [ ] two deliveries using the same Provider credentials route only to callbacks A and B respectively
- [ ] omitted callback on replay retains the original; changed callback conflicts

## Update, status, tracking, cancel, return

- [ ] every declared mutable field is tested; null/omitted means unchanged
- [ ] status uses only the complete published vocabulary
- [ ] unknown internal statuses never become terminal `failed`
- [ ] tracking, driver, location, ETA, and URL nullability is accurate
- [ ] unknown delivery returns 404 consistently
- [ ] cancellation covers pending, accepted, picked-up, duplicate, final, and unknown
- [ ] return is enabled only when declared and certified

## Webhooks and convergence

- [ ] event vocabulary and required fields match the contract
- [ ] `platformReference` is present on every event
- [ ] HMAC is over exact raw bytes and sent as lowercase hex
- [ ] invalid/missing signatures cannot be mistaken for successful delivery
- [ ] retries preserve logical identity and event time and honor response classes/Retry-After
- [ ] duplicate, stale, and out-of-order events are safe
- [ ] driver location and ETA events converge with polling
- [ ] terminal events stop later nonterminal events

## Errors, limits, and capability declaration

- [ ] stable sanitized error envelope for 400/401/403/404/409/422/429/5xx
- [ ] 429 includes valid `Retry-After`; rate limit is not reported as 500
- [ ] request and response size/field limits are enforced
- [ ] every true capability has staging evidence
- [ ] `supportsProofOfDelivery=false`