060 279 5587 info@sitect.co.za 139 Davies Street, Doornfontein, Johannesburg, 2001 Gauteng, SA
Software · API Design & Integration

APIs that scale — and integrations that don't break.

We design REST and GraphQL APIs that other developers actually like consuming, and wire up the messy 3rd-party integrations that keep your business running. Versioned, documented, monitored, and idempotent — production-grade from the first deploy.

From R14k · per project 1–4 weeks typical OpenAPI 3.1 + auto-docs
api.sitect.co.za · v1 OpenAPI 3.1 · 23 endpoints
Orders
GET/v1/orders
POST/v1/orders
GET/v1/orders/:id
PUT/v1/orders/:id
DEL/v1/orders/:id
Customers
GET/v1/customers
POST/v1/customers
Webhooks
GET/v1/webhooks
POST/v1/webhooks
REQUEST Create order cURL · v1
POST /v1/orders
Authorization:Bearer sk_live_••••a3f9
Content-Type:application/json
Idempotency-Key:ord_8j2x_4621
{
  "customer_id": "cus_8j2xK",
  "currency": "ZAR",
  "items": [
    {"sku": "SO-BRB-250", "qty": 2, "unit_price": 285.00},
    {"sku": "HB-MSK-100", "qty": 1, "unit_price": 310.00}
  ],
  "shipping": "aramex_overnight",
  "vat_inclusive": true
}
RESPONSE 201 Created 142 ms
201 Created Idempotent · cached 142 ms · af-south-1
X-Request-Id:req_01HC8K2X4M
X-RateLimit-Remaining:847 / 1000
Location:/v1/orders/ord_01HC8
{
  "id": "ord_01HC8K2X4M",
  "status": "awaiting_payment",
  "subtotal": 880.00,
  "vat": 132.00,
  "total": 1012.00,
  "currency": "ZAR",
  "created_at": "2026-05-17T14:23:04Z",
  "_links": {
    "self": "/v1/orders/ord_01HC8",
    "payment": "/v1/payments/pay_01HC8"
  }
}
Where most APIs & integrations rot

The 4 ways APIs silently kill product velocity

APIs that look fine in week one become the slowest part of your roadmap by month six. The cause is almost always one of these four — and each is fixable with the right discipline up front.

Failure 01

The "API" is whatever endpoints happened to ship.

Inconsistent naming, mix of REST + RPC + ad-hoc shapes, status codes that mean different things on different routes, errors returned as 200 with `{success:false}`. Every consumer needs a per-endpoint cheat-sheet to use it.

What it costs: every integration takes 3× longer than it should, support load skyrockets, partners walk away.
Failure 02

Webhooks that fire once, fail, and never retry.

No signature verification, no idempotency, no exponential backoff, no replay UI. When the consumer is briefly down — and they will be — the event is lost forever. Reconciliation becomes a weekly cron job everyone secretly fears.

What it costs: orphaned orders, double-charges, finance teams reconciling by hand at midnight.
Failure 03

"v1" exists. So do "v1_new", "v1_temp", "v1.5".

No versioning strategy means every breaking change becomes its own world. Old clients break silently, new clients can't trust contracts, and you can never deprecate anything because nobody knows who's still on the old shape.

What it costs: permanent maintenance tax, fear of changes, accumulated tech debt with no exit ramp.
Failure 04

The docs are a screenshot in Confluence from 2022.

Docs hand-written and out of date the moment the next PR merges. No interactive console, no schema validation, no examples for partner devs to copy-paste. Onboarding a new integrator takes a week of Slack threads.

What it costs: integrator drop-off, support burden, slow partner onboarding, blocked partnerships.
What we build for you

Four flavours of API work — pick the one that fits

The "API" word covers a lot of jobs. Here's how we slice the engagement based on what you actually need.

1. Public API — partner / developer-facing

You're opening up your product to integrators, building a marketplace, or shipping APIs as a paid product. The bar is "third-party developers love consuming it" — versioned, rate-limited, documented, monetised.

  • REST or GraphQL with OpenAPI 3.1
  • Tokens, scopes, rate-limits per plan
  • Interactive docs portal
  • Outbound webhooks for events

2. Internal API — backend for frontends

Your web app, mobile app, and admin dashboard all need the same backend. We design it as one versioned API surface so the team isn't writing the same logic three times.

  • Single source of truth for clients
  • Auth, RBAC, multi-tenant scoping
  • Generated TypeScript SDK clients
  • Contract tests in CI

3. 3rd-party integrations

You don't need to build the API — you need to consume someone else's properly. Stripe, Xero, Sage, HubSpot, Salesforce, SAP B1, SARS eFiling. We wire them up so the data is right, the failures are loud, and the recon is automatic.

  • Idempotent, retry-safe consumers
  • Reconciliation cron + alerting
  • Mock servers for local dev
  • Failure playbooks documented

4. Webhook + event architecture

Inbound webhooks from gateways and partners. Outbound webhooks to your customers. Internal event buses for decoupled microservices. Everything signed, retried, and replayable.

  • HMAC signed payloads
  • Exponential-backoff retries
  • Dead-letter queue + replay UI
  • Customer-facing delivery log
Our 8 API design principles

What separates a forgettable API from one developers love

These are the principles every Sitect API ships with. They're not optional, they're not negotiable, and they're not "phase 2".

01

Consistent resource shape

Every entity follows the same envelope: `id`, `created_at`, `updated_at`, a stable shape across endpoints. Predictable to consume, easy to type, easy to cache.

02

HTTP status codes mean what they say

2xx for success, 4xx for caller error, 5xx for our error. No 200 OK with `{success:false}` ever. The status is the first signal — make it accurate.

03

Errors are typed, structured, helpful

Every error returns `error.code`, `error.message`, `error.field`, `error.docs_url`. Clients can pattern-match on codes; humans can read the message.

04

Idempotency on every write

Every POST/PUT accepts an `Idempotency-Key` header. Retried requests return the original response. No duplicate orders, ever.

05

Pagination is a first-class feature

Cursor-based pagination for performance. `next_cursor` + `has_more` in the response. No "page=999 timeout" surprises.

06

Versioning that doesn't break

Major versions in the URL (`/v1`, `/v2`). Additive changes only within a version. Deprecation announced 6 months ahead with `Sunset` headers.

07

Rate-limits are explicit and friendly

`X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` headers on every response. Per-plan tiers. 429s include retry hints.

08

Observability built in

Every request gets a `X-Request-Id`. Logs include request ID + tenant + user. Tracing across services. "Tell me which request failed" → instant answer.

3rd-party integrations we ship

The systems we already know intimately

Every one of these has been wired up by Sitect at least twice. We have the war stories, the working patterns, and the integration runbooks.

Stripe

Payments · Billing · Webhooks

Yoco

Card · Recurring · Reporting

Payfast / PayGate

SA gateways · Webhooks

Xero

Invoices · Contacts · Ledger

Sage Pastel

Stock · Customers · GL

SAP Business One

ERP · BOM · Orders · GL

SYSPRO

SA ERP · Inventory · Recon

HubSpot

CRM · Deals · Marketing

Salesforce

Accounts · Opportunities

WhatsApp Business

Twilio · 360dialog · Meta

Aramex · TCG · Pargo

SA courier APIs

OpenAI / Anthropic

LLM · Embeddings · Vision

We work in all the right shapes

REST · GraphQL · gRPC · Webhooks — we use what fits

Each protocol has its sweet spot and its disaster zone. We pick by job, not by what's trendy this year. Here's how we think about each.

REST

Best when · ~80% of cases

Predictable, cacheable, easy to consume from any language. Our default for public APIs and most internal APIs. OpenAPI 3.1 specs generated from the code.

GraphQL

Best when · BFFs & rich UIs

When clients need flexible field selection or aggregate data from multiple resources in one round-trip. Schema-first, with per-field auth + complexity limits.

gRPC

Best when · service-to-service

Internal high-throughput service-to-service calls where Protobuf strictness and bidirectional streams matter. Not for partner-facing endpoints.

Webhooks & Events

Best when · async flows

Push-based notifications for long-running or async work. Signed, idempotent, retried with exponential backoff. Dead-letter queue + replay UI standard.

What you walk away with

Every API engagement ships the same package

Code is necessary but not sufficient. An API isn't real until the docs are usable, the monitoring is on, the SDKs work, and the SLAs are documented.

Production code

Tested, deployed, MIT-licensed in your repo. Domain logic separated from HTTP concerns so the API can evolve without rewriting business rules.

OpenAPI 3.1 specs

Auto-generated from code annotations, always in sync. Used to drive interactive docs, client SDKs, and contract tests.

Interactive docs portal

Scalar / Redoc / Stoplight portal at `docs.api.yourdomain.com` with try-it-now console, code samples in 6 languages, search.

Tests + contract tests

Unit + integration test suites. Contract tests in CI that fail if a breaking change ships without a version bump. Mock server for consumers.

Monitoring + SLOs

Per-endpoint latency + error-rate dashboards, SLO definitions, alerting to your on-call. The day a customer hits a bug you know first.

60-day warranty

Any defect we ship gets fixed free for 60 days. We watch your logs daily during the window and respond inside 1 business day.

How a build runs

A predictable 5-step engagement

Most engagements run 1–4 weeks depending on scope. The flow below applies whether we're designing a brand-new API or wiring up a 3rd-party integration.

1

Discovery

Map use-cases, consumers, auth model, data shapes, SLAs, edge cases.

Day 1–2
2

Schema-first design

OpenAPI / GraphQL schema drafted & reviewed before code is written.

Day 3–5
3

Build & test

Endpoints implemented against the schema, unit + integration + contract tests.

Week 2–3
4

Docs & observability

Interactive docs portal, SDKs generated, dashboards + alerts in place.

Week 3
5

Launch + warranty

Production deploy, partner onboarding, 60-day defect warranty active.

Week 4
What "wired right" earns

The compounding gains of good API hygiene

Indicative metrics across SA API + integration engagements, measured 60 days post-launch. The biggest wins come from disciplined webhooks + clean contracts.

~3 days
Partner-onboarding time
Down from ~3 weeks · interactive docs
−94%
Webhook orphan rate
Idempotent + retried + DLQ
99.95%
API uptime · year 1
Across active integrations
~0
Breaking-change incidents
Contract tests catch in CI
Indicative pricing — ZAR, ex VAT

Three engagement shapes

Every API project is scoped per build — these are the bands we usually land in. 50% on signature, 50% on go-live.

API Audit

Review your existing API + improvement plan
R5 000 · once-off
5 days · graded report + roadmap
  • 30-point API design review
  • Webhook architecture audit
  • Security & auth review
  • Ranked fix-list with effort estimates
  • 60-min handover & Q&A call
  • Audit fee credits if you commission a build
Order an audit

Multi-Integration

3+ 3rd-party integrations with reconciliation
From R30 000 · ex VAT
4–8 weeks · 90-day warranty
  • 3+ first-class integrations
  • Event bus / queue architecture
  • Daily reconciliation cron
  • Dead-letter queue + replay UI
  • Mock servers for local dev
  • Failure-mode playbooks documented
Talk to us about Multi
FAQ

The questions we get asked most

Honest answers about REST vs GraphQL, when an API is "real", what we won't build, and how to know if you need this work.

REST or GraphQL — which should I pick?
Default: REST. It's predictable, cacheable, easy to consume from any language, and the 80% answer for public APIs. Choose GraphQL when (1) clients need flexible field selection to keep payloads small, (2) you're aggregating from multiple resources in one round-trip, or (3) you have a small number of trusted clients (your own apps). We avoid GraphQL on broad public APIs because per-field auth + complexity limits become a permanent tax.
Do I need an API at all, or can I just use webhooks?
Webhooks alone are great for push-based notifications, but they don't replace a read API. Most production systems need both: a request/response API for "give me the data I want right now" and webhooks for "tell me when something changes". We design them together so the events fired by webhooks correspond exactly to what's queryable via the API.
What about microservices?
Most companies should not start with microservices. We default to a well-structured monolith (Laravel or NestJS) and extract services only when there's a clear scaling or team-boundary reason. If you already have services, we'll work with what you have — but we'll honestly tell you if consolidating two services is the better move.
Can you work alongside our existing engineering team?
Yes — about 40% of our API work is augmenting an in-house team. We can lead the design and have your team build, build alongside them in pair-programming mode, or be the "API team" while they focus on product. We share ADRs, OpenAPI specs, and code-review playbooks so the work is collaborative, not parallel.
How do you handle authentication for public APIs?
For partner / developer APIs we default to OAuth 2.0 with API keys + scopes, plus per-plan rate limits. For machine-to-machine integrations we use bearer tokens with rotation. For end-user mobile/web apps, JWT with refresh-token rotation. SAML/SSO for enterprise customers in your SaaS upgrade path. Whatever fits — we don't force a single pattern.
What if the 3rd-party API I need is awful?
A lot are. We've integrated with SARS eFiling, ageing SOAP services from SA banks, and the WhatsApp Business API which has its own ideas. The work in those cases is mostly defensive: idempotent consumers, schema validation at the boundary, dead-letter queue for malformed payloads, reconciliation cron for missed events. We absorb the badness so your domain code doesn't have to.
Will you maintain it afterwards?
Optional. The 60-day defect warranty is included. Beyond that, you can take over (the code is yours and uses mainstream tech) or retain us via a monthly engineering retainer from R10k/mo for ongoing maintenance, new endpoints, and integration upgrades. We don't lock you in either way.
Can you audit our existing API without rebuilding it?
Yes — that's our Audit tier (R5k). We run a 30-point review covering design consistency, auth, idempotency, webhook architecture, versioning, docs, observability, security. You get a graded report with a fix-priority list. If you commission the fix work afterwards, the audit fee credits towards the build. Many clients start here.

Send us your API docs (or the gap where they should be) — we'll send back a teardown.

Whether you have an existing API to audit, a partner you need to integrate, or a clean-slate design for a new platform — share the context, and we'll come back with a recommended tier and an indicative budget.