# Skill: API Integration

Skill ID: `api-integration`

Rules
- HTTP requests: `wp_remote_get/post/request` with timeout, SSL verify, explicit headers.
- Never use cURL or `file_get_contents` for API transport.
- Sanitize outbound payload fields before encoding.
- Validate API keys and authentication tokens before protected API actions.
- Validate source/target language against allowlist.
- Validate response status and shape before processing.
- Sanitize response payload before storage/rendering.
- Return user-safe errors; keep details in logs only.
- Webhooks: verify signature with `hash_hmac` + constant-time comparison.
- Webhooks: validate authenticity via signatures/tokens before payload processing.
- Webhooks: validate schema, allowed statuses, and idempotent updates.
- Rate limiting: enforce user/IP thresholds and backoff.
- Never log API keys, webhook secrets, or auth headers.
- API key storage uses `autoload = false`; encrypt when feasible.
- Sensitive data (API keys/secrets) must never be logged.
- Never log API keys or sensitive settings.
- Authenticated frontend API calls include nonce (`X-WP-Nonce` or payload nonce).
- Authenticated frontend fetch calls use `credentials: 'same-origin'`.
- Optional abuse guard: prevent self-targeted moderation/report actions where applicable.

Mistakes to avoid
| Mistake | Fix |
|---|---|
| cURL/file_get_contents for API calls | Use `wp_remote_*` |
| Missing webhook signature validation | Verify HMAC before processing |
| Exposing raw API errors | Return generic UI-safe errors |
| Missing nonce in authenticated API flow | Include nonce header/payload |
| No rate limiting | Enforce user/IP throttling + backoff |
| Unknown language/status accepted | Validate with strict allowlists |