# Developer guidelines

Build predictable, secure clients against the published contract.

## Client rules

| Rule | Required behaviour |
| --- | --- |
| Credentials | Keep API keys in trusted server-side memory. |
| Contract | Generate from canonical OpenAPI 3.1.2 and pin SDK versions. |
| Identifiers | Treat UUIDv7 identifiers and cursors as opaque. |
| Diagnostics | Record X-Request-Id with failures and billing questions. |
| Retries | Retry only explicit non-billable retryable responses. |

## Before production

- Validate your query before sending it.
- Bound pagination and concurrency.
- Honour `Retry-After`.
- Handle unknown response enum values.
- Never depend on undocumented fields or implied ordering.