Keep the systems that are worth keeping.
RetailHawk is being designed to operate around a fieldwork programme rather than forcing every client to replace every existing tool on day one.
External survey providers
Provider configuration and authenticated completion evidence are in build. The design keeps provider secrets server-side and treats provider confirmation, not simple link-open, as authoritative completion evidence.
Public API
The internal API and event foundations exist. Tenant-scoped public API exposure is planned after the core business journeys are stable.
Webhooks
Outbound event delivery is planned on top of the existing job/outbox reliability model, with bounded payloads and idempotent consumers.
Integration principles
No secrets in tenant data
Credentials and provider endpoints belong in server-side configuration, not customer-visible records.
No silent fallback
If an external provider is unavailable, the workflow fails explicitly rather than pretending a different completion path succeeded.
Historical integrity
Published work keeps the provider/version context it was issued with; later provider changes should not rewrite historical assignments.
API after domain stability
We are prioritising a sound business model and tenant boundary before exposing a broad public integration surface.