FEDSLOW - PARTNER INTEGRATION API
==========================================

1. Webhook delivery testing
---------------------------
Register a callback URL and we will POST a sample payload to verify your
endpoint is reachable before we enable live traffic.

    POST /api/integrations/webhook/test
    Content-Type: application/json

    {"url": "https://your-host.example/hooks/mf", "payload": {...}}

Callback hosts must be publicly routable. Private, loopback, link-local and
carrier-grade NAT ranges are rejected. Redirects are not followed.
Rate limited to 120 requests per minute per source address.


2. Internal request signing
---------------------------
Services behind the integration gateway authenticate with a shared secret:

    sig = SHA256(secret + canonical)

where `canonical` is the URL-decoded query string in declaration order,
excluding the trailing `&sig=` parameter. Parameters are applied in order,
so a repeated key takes its last value.

Worked example
~~~~~~~~~~~~~~
    canonical : nonce=8f3a1c&exp=1800000000&path=/health
    sig       : 34fd7300c1dbe3d17fff4f21fe329cb66b1046869a73f55a0780376bcd7f400d

    POST http://gateway.internal:8080/forward
           ?nonce=8f3a1c&exp=1800000000&path=%2Fhealth&sig=34fd7300c1dbe3d17fff4f21fe329cb66b1046869a73f55a0780376bcd7f400d

Arbitrary bytes may be percent-encoded for transit; the gateway decodes
before verifying, so what you sign is what we check.

`exp` is a Unix timestamp. Expired requests are rejected.
Permitted upstream paths: /health, /api/v1/*

Deployment note (partner-facing)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
`gateway.internal` resolves only inside our private integrations fabric
(10.201.0.0/16) and is not reachable from the public edge. Peer services
reach it directly by IP on TCP 8080 over plain HTTP -- there is no TLS on
the internal hop, so sign and send the canonical exactly as shown above.