FEDSLOW - PARTNER INTEGRATION API
==========================================

1. Webhook delivery testing
---------------------------
Register a callback URL and we will POST a sample payload to verify your
endpoint is reachable before we enable live traffic.

    POST /api/integrations/webhook/test
    Content-Type: application/json

    {"url": "https://your-host.example/hooks/mf", "payload": {...}}

Callback hosts must be publicly routable. Private, loopback, link-local and
carrier-grade NAT ranges are rejected. Redirects are not followed.
Rate limited to 5 requests per 2 minutes per source address.


2. Internal request signing
---------------------------
Services behind the integration gateway authenticate with a shared secret:

    sig = SHA256(secret + canonical)

where `canonical` is the URL-decoded query string in declaration order,
excluding the trailing `&sig=` parameter. Parameters are applied in order,
so a repeated key takes its last value.

Worked example
~~~~~~~~~~~~~~
    canonical : nonce=8f3a1c&exp=1791590400&path=/health
    sig       : 8d9834f8073927b33d003b0842ff37176a2ebfba26f1e2c09e258875b0fac862

    POST https://gateway.internal/forward
           ?nonce=8f3a1c&exp=1791590400&path=%2Fhealth&sig=8d9834f8073927b33d003b0842ff37176a2ebfba26f1e2c09e258875b0fac862

Arbitrary bytes may be percent-encoded for transit; the gateway decodes
before verifying, so what you sign is what we check.

`exp` is a Unix timestamp. Expired requests are rejected.
Permitted upstream paths: /health, /api/v1/*