Quality & Performance Standards

Production access is gated on a validated integration: the conformance tables below must pass against your implementation, on a test binding, before your live location is provisioned. This is the same bar Swoop's own connectors are held to — the tables run in Swoop's CI on every commit.

Production requirements

Standard	Requirement
Order injection	Every `orders.notification` you receive must resolve to an accept or deny — silence past the location's SLA (`ackTimeoutSeconds`, typically 690 s) escalates to Swoop staff and counts against your integration.
Webhook acknowledgment	Acknowledge every webhook with a `2xx` within 5 seconds; do the work after. Signature verification (`X-Swoop-Signature`) is mandatory — unsigned processing fails certification.
Duplicate safety	Webhooks are at-least-once and unordered. Duplicate events (same `event_id`) and replayed status POSTs must cause no visible double-processing.
Recovery	Poll `created-orders` (and `created-deliveries` for operators) as your recovery path. A webhook-only integration with no poll fallback does not pass.
Menu mapping	Push your menu snapshot before go-live — unmapped items dead-letter orders.
Status fidelity	Lifecycle pushes must reflect reality (an order marked `ready` must be ready). The platform's rank guard tolerates replays, not fiction.

The conformance tables

Certification is code, not a checklist: the same black-box tables Swoop runs in CI are runnable against your implementation over plain HTTP — auth semantics (401 / foreign-404), resource shapes, accept/deny, idempotent replays, the full status walks for both the Order and Delivery suites, and correct 400s for bad enums.

PARTNER_CERT_BASE_URL=<your adapter host> \
PARTNER_CERT_TOKEN=<your bearer> \
PARTNER_CERT_ORDER_ID=<a created test order> \
go test ./api/partner/ -run TestCertifyDeployed -v

Delivery-operator standards

Two non-negotiables beyond the shared bar:

A deny never cancels the member's order. Denying a dispatch (out of range, too heavy, weather) alerts staff for runner delivery — deny fast rather than letting the SLA escalate.
Vehicle-neutral status only (dispatched → en_route → arrived → completed | failed | returned) — courier semantics don't exist here, and a returned payload must actually be back before you report it.

Go-live

Certification runs against a test binding (test: true): the full pipeline executes, but nothing you do reaches a member. Once the tables pass, go-live is one provisioning call flipping your real location — see Getting Started and the API Changelog for what's changed recently.