Third-party integrations release incidents

Third-party integrations: 7 published incident types backed by 21 public reports.

The root-cause stage named most often in this group is code, in 5 of 7 incident types.

7 incident types published · 1 withheld · 21 public reports

Incident types in this group

Third-party integrations


Certificate expired	Likelihood: medium (4 public reports in 5 years)	Impact: medium (4 of 4 reports: availability)	4
Dependency removed from registry	Likelihood: not published (1 public report in 5 years)	Impact: medium (3 of 3 reports: availability)	3
Email or SMS provider template broken	Likelihood: not published (1 public report in 5 years)	Impact: medium (1 of 2 reports: availability)	2
OAuth callback URL not whitelisted	Likelihood: low (2 public reports in 5 years)	Impact: medium (3 of 3 reports: availability)	3
Provider API change breaks contract	Likelihood: medium (4 public reports in 5 years)	Impact: medium (2 of 4 reports: availability)	4
SDK upgrade changes behaviour	Likelihood: medium (3 public reports in 5 years)	Impact: medium (2 of 3 reports: availability)	3
Third-party rate limit hit	Likelihood: low (2 public reports in 5 years)	Impact: medium (2 of 2 reports: availability)	2

Withheld in this group: Map or geocoding quota exhausted. Reasons per route

Risk grid

Risk grid: count of incident types per likelihood and impact cell, from data/risk.json
Likelihood \ Impact	Impact: high	Impact: medium	Impact: low
Likelihood: high	0	0	0
Likelihood: medium	0	3	0
Likelihood: low	0	2	0
Impact unrated or likelihood not graded	2

Table equivalent: incidents per cell

Incident	Likelihood	Impact
Certificate expired	medium	medium
Dependency removed from registry	not-published	medium
Email or SMS provider template broken	not-published	medium
OAuth callback URL not whitelisted	low	medium
Provider API change breaks contract	medium	medium
SDK upgrade changes behaviour	medium	medium
Third-party rate limit hit	low	medium

Root-cause stages

Stage	Incident types naming it
code	5
third-party	4
config	2
infra	1
migration	1
release-process	1
build	1

Median time to detection across the group: 1311 minutes from 3 reports that state both the change time and the detection time (values above the site-wide 95th percentile excluded).

Only on this page

Certificate expired is the incident type in this group whose root causes do not include the code stage; its causes are introduced at infra.

Group checklist

The first pre-release item of each published incident type in the group.

GR-01Certificate expired: List every certificate the service presents or trusts, including internal service-to-service and LDAP backend certificates, with its expiry date and renewal owner. config
GR-02Dependency removed from registry: Run a clean dependency install from the public registries with no local cache on a daily CI schedule and fail on any package or version that is not found. integration
GR-03Email or SMS provider template broken: Add a unit test that renders PASSWORD_RESET_CONFIRM and every review template and fails on any variable, such as lostPasswordUrl, that has no registered value. unit
GR-04OAuth callback URL not whitelisted: Run the SAML login flow against a test identity provider registered with the redirect_uri an existing customer used before the change, and confirm login succeeds. e2e
GR-05Provider API change breaks contract: Run the integration suite against the provider sandbox on a daily schedule, not only on commits, and alert when a previously passing test fails with no code change. integration
GR-06SDK upgrade changes behaviour: Run the object storage integration suite against every third-party compatible provider the product supports as a custom endpoint, not only against the SDK vendor's own service. integration
GR-07Third-party rate limit hit: Send one webhook event for a single entity and confirm the sync cache keeps its entries for every other entity. integration

Questions

What causes Third-party integrations incidents?

Published incident types in this group name these root-cause stages: code (5), third-party (4), config (2), infra (1), migration (1), release-process (1), build (1).

Which pipeline stage introduces most Third-party integrations incidents?

The code stage, named in 5 of 7 published incident types in the group.

Which test classes catch Third-party integrations incidents?

Test classes listed on the group's incident pages: integration tests (5), synthetic monitoring (4), configuration and environment tests (3), end-to-end tests (2), contract tests (2), unit tests (1), load and performance tests (1), canary and progressive delivery checks (1).

How quickly are Third-party integrations incidents detected in public reports?

The median time to detection is 1311 minutes across 3 reports that state both the change time and the detection time.

How likely are Third-party integrations incidents compared with each other?

Certificate expired: medium likelihood, medium impact; Dependency removed from registry: not-published likelihood, medium impact; Email or SMS provider template broken: not-published likelihood, medium impact; OAuth callback URL not whitelisted: low likelihood, medium impact; Provider API change breaks contract: medium likelihood, medium impact; SDK upgrade changes behaviour: medium likelihood, medium impact; Third-party rate limit hit: low likelihood, medium impact.

What should a release checklist for Third-party integrations include?

The group checklist collects the first pre-release item of each of the 7 published incident types; each item names the test class that checks it.