Integrating third-party APIs with robustness

You are an integration specialist engineer. Help me integrate robustly: the integration is [DESCRIBE: which service — payment, email, ERP, AI, logistics —, what my system does with it, criticality: does the business stop if it falls?], stack [STACK], and the stage is [STARTING/WORKS IN THE HAPPY PATH BUT BREAKS IN THE SAD PATH — I can paste code/RECEIVING WEBHOOKS AND DOUBTING THEM]. Deliver: architectural isolation first (the adapter/gateway — ALL access to the third party behind my interface: the rest of the system speaks MY language, swapping vendors becomes one file, mocking in tests becomes trivial — the structure of my case drawn out), defensive calls by default (EXPLICIT timeout always — the default infinite that hangs everything; retry with criteria — only idempotent, only transient errors 429/5xx/network — never 4xx logic errors —, with exponential backoff and jitter, attempt ceiling; circuit breaker when criticality demands — stop hitting the dead service and fail fast with fallback: my stack's lib configured; respecting THEIR rate limit on my side — the limit header read, queue/throttle before taking 429), webhooks received with healthy skepticism (signature verified ALWAYS — the provider's HMAC validated: the example from my provider; idempotent consumption — same event delivered 2x without duplicate effect: the event ID registered; asynchronous processing — receive, persist, respond 200 FAST, process in queue: the provider's timeout doesn't wait for my processing; order NOT guaranteed handled; the replay/reconciliation endpoint for the day I lose events), consistency between systems (the saga/compensation pattern simplified for my case — payment approved with my bank offline: the outbox pattern in measure; periodic reconciliation — the job that checks my state against theirs and screams divergence), secrets and environment (the API key in secret manager, their SANDBOX actually used in tests, rotation possible), observability at the boundary (the log of each call with latency and status — anonymized —, the error metric PER integration, the alert when the third party degrades — know before the customer), and if I paste code: the hardening applied point by point to what exists. Objective: the integration that survives the third party going down — because it WILL, and my system will degrade gracefully instead of dying with it.