Is it normal to accept delivery without API integration testing, or should we have made it a contract requirement?

I've been managing these kinds of projects for years; the agency is trying to pawn off scenario testing—the most tedious part—onto you. An endpoint returning 200 means nothing. What happens if the bank approves the charge but your system times out right then? You never launch an untested payment setup.

The critical piece in payment setups is webhook handling. If the user closes their browser or loses connection, can they handle the async notification in the background? How does the API behave on refunds or partial cancellations? They are obligated to run these in a sandbox with mock requests and provide you with the logs.

Block that final payment immediately. Email the agency: "Per our acceptance criteria, no sign-off will be given until 5 core scenarios (successful charge, insufficient funds, 3D secure drop, timeout and automated refund) are documented in the payment provider's sandbox." Watch how fast their tune changes.

We made a similar mistake two years ago on an 18,000 EUR tour booking project. We took the agency's word and launched; first week, 22 charges went through without booking slots on the calendar. We had to refund 3,100 EUR and shut down the platform for 10 days. Skipping three days of testing cost us two whole weeks.

Does the contract you signed mention acceptance testing or go-live procedures? If they slipped in a boilerplate clause like "deemed accepted if no objection is raised within 14 days of delivery," you need to file your written objection right away before that window closes.

tbh I doubt the agency even has developers qualified to write integration tests. Usually they just install an off-the-shelf plugin, paste two API keys, and call it a day. That's why they're dodging. Even if you push them, they probably won't be able to deliver a proper test matrix.

Demand these three deliverables before signing off: 1) A results matrix of scenarios executed in the sandbox, 2) Screenshots of customer-facing error messages on failed attempts, 3) A reconciliation report matching test-card transactions between the payment gateway dashboard and your website database. Without these, it's not a completed delivery.

don't stress but don't back down either. devs hate writing tests because fixing the bugs that pop up delays their payout and stand your ground on the money—not a cent of that 4,000 EUR leaves your account until you see a test report.

I felt relieved reading this answer, so it's not just me. If acceptance criteria aren't written, when the work is done is open to debate.

If you don't write this down from the start, it leads to arguments later.

Let me summarize what's been said so far. The system lives on after delivery; maintenance is a separate line item.

Payment schedules should be tied to project phases, not calendar dates. Proven by experience.

You're right, I've been down that road too. The system lives on after delivery; maintenance is a separate line item.

Implementing a change request process doesn't slow things down, it speeds them up. That's all, sorry if I went on too long.

Exactly, and not many people know this. The system lives on after delivery; maintenance is a separate line item.

I'm also curious if anyone does it differently.

I didn't know that. When making a decision, first look at what data you have on hand.

Of course it varies if your situation is different.

Good call starting this thread.

Could you elaborate on that? The system lives on after delivery; maintenance is a separate line item.

Just leaving this note, it might be useful.

There's a part I don't understand. The biggest time-waster for us was not knowing who had the final say.

I've been down this road let me tell you. I mean mistakes made on the api integration testing side are usually reversible but expensive.

Just leaving this note it might be useful.

Following.