# LegaBot Data partner certification checklist

## Security and access

- Store API keys in a managed secret store; never in URLs, repositories or logs.
- Use the minimum scopes required for Core Data, Optional Media, Stream and Webhooks.
- Treat HTTP 401 as credential failure, 403 as missing scope and 429 as backpressure.
- Rotate keys without interrupting the active consumer, then revoke the old key.

## Core Data lifecycle

- Discover fixtures and retain the stable `FixtureId`.
- Initialize from Snapshot and commit its global `Sequence` atomically with the payload.
- Apply Deltas, SSE events or Webhooks strictly in ascending Sequence order.
- Deduplicate by `MessageGuid` or `StateFingerprint` and ignore already-applied sequences.
- Resume from the last durably committed cursor; use Replay after any gap.
- Apply `correction` messages and retain `CorrectionOfSequence` for audit.
- Respect suspended and closed market states; never treat a null price as tradable.
- Confirm final Results and Settlements before closing the match in downstream systems.

## Webhooks

- Require `X-LegaBot-Signature-Version: v1`; reject unknown signature versions.
- Verify `X-LegaBot-Signature` against the exact raw body before parsing JSON.
- Reject timestamps older than five minutes.
- Return 2xx only after durable processing; retries use the same delivery ID.
- Deduplicate using `Idempotency-Key`.
- Exercise a failed delivery, confirm backoff/alerting, then redrive the same
  delivery ID from the Owner console after the receiver is healthy.

## Launch gate

- Complete a full prematch → live → result → settlement rehearsal.
- Confirm all active prices are within 1.0–1000.0 and probabilities are valid.
- Confirm material events produce a durable suspension before repricing.
- Confirm substitutions are excluded from this contract.
- Confirm Core Data continues when Optional Media is unavailable.
- Confirm scheduled and live reports are phase-aware and may remain `incomplete`
  only for controls belonging to future phases.
- Obtain a `passed` `legabot-delivery-certification.v2` response from
  `/api/v1/certification/report` for the completed rehearsal match.