Skip to content

Capstone: design an API integration for your own department

اختتامی منصوبہ: اپنے محکمے کے لیے API انٹیگریشن ڈیزائن کریں

40 min read

Three ways to see it

  1. Step one: state the problem in one sentence. Not the technology. The problem. 'Our compliance team manually verifies the active taxpayer status of 4,000 vendors every quarter, taking 22 person-days each round.' Or 'Our payroll team enters CNIC details one at a time for 1,200 new joiners every year, and 8% have errors that cause salary delays.' If you cannot write the sentence in one breath, you do not yet have a project. You have a topic. Topics do not get funded.

  2. Step two: identify the upstream API that can solve it. For active taxpayer status, that is FBR's Online Verification Services. For CNIC validation, that is NADRA's Verisys if you have an MOU, or a regulated KYC partner if you do not. For company due diligence, that is SECP eServices (currently web-only, so plan a transitional workflow). For IMEI checks, that is PTA DIRBS. The work of step two is not technology selection; it is matching the problem to the contract that already exists or could plausibly be procured.

  3. Step three: draw the data flow as a flowchart on one page. Use four boxes. Box one, your internal trigger (a vendor onboarding form, a payroll spreadsheet, a quarterly review job). Box two, your middleware (the script, the integration platform, the queue) that calls the API. Box three, the upstream API. Box four, your system of record (the ERP, the HRIS, the database) that stores the verified result. Add arrows showing the verb (GET, POST), the data on each arrow (NTN, response status, audit reference), and one error-handling note (what happens on 429, what happens on 5xx). If your flowchart needs more than one page, your scope is too wide. Cut it.

Quick check

Quick check: what makes modern AI different from a rule-based program?

The why-tree

Why-tree level one: why force this much rigour for a small integration? Because every API project that fails in Pakistan fails for the same five reasons. The rigour you do at the planning stage takes one day. The rigour you skip costs three months and a vendor lawsuit later.

Try this with Claude

AI-edge prompt to try with Claude or ChatGPT: 'I am drafting the two-page capstone for an FBR Active Taxpayer verification integration in my procurement department. Critique my draft: where would a sceptical finance director push back, where would legal counsel push back, where is the data-quality assumption wrong? Output: a numbered list of seven concrete weaknesses, each with one sentence on what to add or remove.' Iterate until the critique becomes thin.

Sources

Sources and further reading. Throughout this track: MDN Web Docs on HTTP and APIs (developer.mozilla.org/en-US/docs/Web/HTTP). Postman Learning Center (learning.postman.com). OpenAPI 3.0 (spec.openapis.org). OWASP API Security Top 10 (owasp.org/www-project-api-security). FBR Digital Invoicing portal (fbr.gov.pk). NADRA Verisys overview (nadra.gov.pk). PDPA-2023 text (na.gov.pk). State Bank of Pakistan Open Banking Framework draft (sbp.org.pk).

Previous lesson