Protect External API Integrations

Goal

Make external API integrations resilient to failures without hiding errors or retrying unsafe operations blindly.

Repository Context

This service integrates with a third-party Payments API.

billing-api/
├── src/
│   ├── integrations/
│   │   └── payments/
│   ├── services/
│   └── routes/
├── tests/
├── package.json
└── AGENTS.md

External API calls can fail because of:

• timeouts,
• rate limits,
• temporary provider failures,
• invalid responses,
• or network errors.

The repository follows these rules:

• External calls must have explicit timeouts.
• Integration errors should retain enough context for diagnosis.
• Retries are only appropriate for operations that are safe to retry.
• Retry behavior must be bounded.
• Non-idempotent operations must not be blindly retried.

Current AGENTS.md

# Project Instructions

## External APIs

- Keep Payments API integration code in `src/integrations/payments`.
- Retry failed external API requests until they succeed.
- External requests do not need explicit timeouts because the provider handles failures.
- Catch integration errors and return a generic success response so users are not affected.

## Validation

- Run integration tests after changing Payments API behavior.

Your Task

Repair the external API instructions.

Require explicit timeouts, preserve meaningful error handling, and ensure retries are bounded and limited to operations that are safe to retry.