Third-Party System Integrations

API integration is outbound (pull): your application calls the third-party API to request data or trigger an action - for example, calling the Razorpay Orders API to create a payment order, or calling the Salesforce REST API to create a contact. Webhook integration is inbound (push): the third-party system calls your application when an event occurs - for example, Razorpay sends a webhook POST request to your server when a payment is captured. Most production integrations require both: APIs to send commands to third-party systems (create payment, create shipment) and webhooks to receive event notifications from them (payment completed, shipment delivered). The critical rule: never trust only the payment redirect for order confirmation - always use the payment webhook, which is server-to-server and cannot be intercepted or forged.

Razorpay integration has three components: (1) Frontend: load Razorpay Checkout.js, call the Orders API from your backend to create an order with amount, currency, and notes (including your internal order ID), then open the Razorpay checkout modal with the order ID. (2) Backend: create an order via the Razorpay Orders API before the checkout modal opens, so the payment amount is server-authorised (not client-controlled). After payment, the frontend sends the payment ID, order ID, and signature back to your server for verification. (3) Webhook: register a webhook endpoint in the Razorpay dashboard for payment.captured events. The webhook handler verifies the X-Razorpay-Signature header (HMAC-SHA256 of the raw body using your webhook secret), checks idempotency (event not already processed), updates the order status, and triggers downstream actions (WhatsApp notification, shipment booking). Never fulfil orders based on frontend redirect alone - only on verified webhook.

WhatsApp Business is the free app for small businesses - one phone, one person, no API access, limited to 256 recipients per broadcast. WhatsApp Business API (now Meta Cloud API) is the platform for medium and large businesses - programmatic message sending at scale, template messages to opted-in customers, automated chatbots, and CRM integration. Key differences: WhatsApp Business API requires Meta verification of your business, registration of message templates (transactional templates are pre-approved within 24 hours; marketing templates require explicit customer opt-in), and either direct Meta Cloud API access or a BSP (Business Solution Provider) like Interakt, Wati, or Gupshup. Transactional messages (order confirmations, payment receipts, shipping updates, OTPs) can be sent to any customer who has given their WhatsApp number. Marketing messages require explicit opt-in. In India, WhatsApp has 500M+ users - WhatsApp Business API integration typically delivers higher open rates (98%) and click-through rates than email or SMS.

SAP integration depends on which SAP system and version: SAP S/4HANA Cloud exposes REST/OData APIs via the SAP API Business Hub - the preferred modern integration approach. SAP ECC (on-premise, older version) integration uses RFC/BAPI (Remote Function Call / Business Application Programming Interface) via the Node.js RFC library or SAP JCo (Java Connector), or IDocs (Intermediate Documents) for batch integration. SAP BTP (Business Technology Platform) Integration Suite provides a managed integration middleware for connecting SAP to cloud applications, with pre-built connectors for Salesforce, Microsoft 365, and others. For Indian manufacturing, the most common SAP integration requirement is: custom dealer or customer portal → SAP Sales Order creation (SD module via RFC/BAPI), SAP stock availability check before order confirmation, and SAP order confirmation number returned to portal. Tally integration is simpler: the Tally XML API accepts HTTP POST requests with XML payload for creating vouchers, ledgers, and stock items.

iPaaS (Integration Platform as a Service) is a managed platform for connecting SaaS applications without custom code - Zapier, Make (formerly Integromat), and n8n are the most common. Zapier is best for simple trigger-action automation (event in App A → action in App B) with minimal data transformation, when speed of implementation matters more than cost per run. Make (Integromat) handles more complex scenarios - multi-step workflows with conditional logic, data transformation, error handling and retry - at lower per-operation cost than Zapier. n8n is a self-hosted open-source alternative with full code support for complex scenarios and no per-operation pricing. Choose iPaaS when: the integration is between two popular SaaS platforms both supported by the iPaaS connector list, the workflow is relatively straightforward, and the volume is moderate. Choose custom API integration when: the integration involves an unsupported platform, requires complex business logic, involves high volume (1,000+ events/hour where iPaaS per-operation pricing becomes significant), or requires guaranteed reliability with custom error handling and retry.

DLT (Distributed Ledger Technology) registration is a mandatory TRAI (Telecom Regulatory Authority of India) requirement for all commercial SMS communications sent to Indian mobile numbers, effective since 2020. Without DLT registration, transactional and promotional SMS are blocked by Indian telecom operators and never delivered. DLT registration requires: entity registration (your company registers on the DLT portal - Vi, Jio, Airtel, or BSNL portals are all interconnected), header registration (registering your Sender ID - the 6-character alphanumeric code appearing as the SMS sender, e.g., EVOINF), and template registration (every message template must be pre-approved, with the exact text and variable placeholders submitted to the operator). Template categories: transactional (OTPs, account alerts - no DLT approval needed per message, just template pre-registration), service-implicit (order confirmations, delivery updates - for customers who have transacted), and promotional (marketing - requires opt-in and strict delivery time restrictions). All SMS gateway providers (MSG91, Exotel, Kaleyra) require your DLT-registered header and template ID when sending messages.

Spaghetti integration - where every system connects directly to every other system - is the result of adding integrations incrementally without architectural planning. Ten systems with direct peer-to-peer integrations require up to 45 direct connections (n×(n-1)/2 for bidirectional). The alternative is hub-and-spoke or event-driven architecture: a central integration hub (custom middleware, iPaaS, or a message bus) that all systems connect to, rather than connecting to each other. Event-driven architecture is the most scalable pattern: when an order is placed, a single 'order.placed' event is published to a message bus (AWS SQS, RabbitMQ, or Azure Service Bus). Multiple consumers subscribe to this event independently - the CRM consumer creates a deal, the ERP consumer creates a sales order, the logistics consumer books a shipment, the notification consumer sends WhatsApp. Each consumer is independent - adding a new integration (e.g., an analytics event) requires adding a new consumer, not modifying existing integrations. This architecture eliminates direct dependencies between systems, makes each integration independently testable, and allows any single integration to fail without affecting others.

CRM integration (Salesforce, Zoho, HubSpot, Dynamics 365), ERP integration (SAP, Oracle, Tally, Dynamics BC), payment gateway (Razorpay, Stripe, PayU), WhatsApp Business API (Meta Cloud API + BSPs), logistics (Shiprocket, Delhivery, FedEx, DHL), communication APIs (MSG91, SendGrid, Twilio), and iPaaS automation (Zapier, Make, n8n).

Yes - Razorpay Orders API, Checkout.js, Subscriptions API, Smart Collect (UPI autopay), Razorpay X for payouts, Route for marketplace, and webhook handler with HMAC-SHA256 signature verification and idempotent processing.

Yes - SAP ECC via RFC/BAPI (BAPI_SALESORDER_CREATEFROMDAT2, BAPI_AVAILABILITYCHECK, custom RFCs), SAP S/4HANA Cloud via OData REST APIs, and SAP BTP Integration Suite for managed cloud integration.

Yes - Meta Cloud API setup (WABA registration, phone number, template approval), webhook for inbound messages, transactional and marketing template implementation, and BSP integration (Interakt, Wati, Gupshup).

Every webhook endpoint implements: HMAC-SHA256 signature verification (raw body, webhook secret), idempotency check (deduplication by event ID), structured logging, retry-safe processing (return 200 on failure, retry via internal dead letter queue), and separate DLQ for events failing after maximum retries.