Api-Design

In the Czech Data Box system (ISDS), an application that logs in and lists received messages causes their legal delivery and starts their deadlines. A nightly polling cron, or a staging copy of the production database, does that too. Here is how an Odoo integration defaults to on demand and neutralizes copies.

An annual exchange rate that exists only months after the year ends, a cache keyed so that corrections cannot be stored, and three Postgres gotchas from making it immutable.

An instrument catalog looked mandatory for a tax engine. Its main attribute only decides whether an event happens, and the ledger already records that. Ask what each attribute changes before you maintain data for it.

End-to-end encryption fails when the server is the calculator. Disk encryption still lets the operator read everything. List what the computation needs, then give each reader its own zone and key.

Design notes from a Go MCP server in front of a shared password vault: annotations that never fire, schema tags that enforce nothing, a fence the JSON encoder rewrites, and error paths that talk to the model.

Map public SDK integration tests to API operations to prioritize authorized investigation without mistaking missing tests for vulnerabilities.