Capstone: design an API integration for your own department
اختتامی منصوبہ: اپنے محکمے کے لیے API انٹیگریشن ڈیزائن کریں
40 min read
Three ways to see it
Step one: state the problem in one sentence. Not the technology. The problem. 'Our compliance team manually verifies the active taxpayer status of 4,000 vendors every quarter, taking 22 person-days each round.' Or 'Our payroll team enters CNIC details one at a time for 1,200 new joiners every year, and 8% have errors that cause salary delays.' If you cannot write the sentence in one breath, you do not yet have a project. You have a topic. Topics do not get funded.
Step two: identify the upstream API that can solve it. For active taxpayer status, that is FBR's Online Verification Services. For CNIC validation, that is NADRA's Verisys if you have an MOU, or a regulated KYC partner if you do not. For company due diligence, that is SECP eServices (currently web-only, so plan a transitional workflow). For IMEI checks, that is PTA DIRBS. The work of step two is not technology selection; it is matching the problem to the contract that already exists or could plausibly be procured.
Step three: draw the data flow as a flowchart on one page. Use four boxes. Box one, your internal trigger (a vendor onboarding form, a payroll spreadsheet, a quarterly review job). Box two, your middleware (the script, the integration platform, the queue) that calls the API. Box three, the upstream API. Box four, your system of record (the ERP, the HRIS, the database) that stores the verified result. Add arrows showing the verb (GET, POST), the data on each arrow (NTN, response status, audit reference), and one error-handling note (what happens on 429, what happens on 5xx). If your flowchart needs more than one page, your scope is too wide. Cut it.
Quick check
Quick check: what makes modern AI different from a rule-based program?
The why-tree
Why-tree level one: why force this much rigour for a small integration? Because every API project that fails in Pakistan fails for the same five reasons. The rigour you do at the planning stage takes one day. The rigour you skip costs three months and a vendor lawsuit later.
Try this with Claude
AI-edge prompt to try with Claude or ChatGPT: 'I am drafting the two-page capstone for an FBR Active Taxpayer verification integration in my procurement department. Critique my draft: where would a sceptical finance director push back, where would legal counsel push back, where is the data-quality assumption wrong? Output: a numbered list of seven concrete weaknesses, each with one sentence on what to add or remove.' Iterate until the critique becomes thin.
Sources
Sources and further reading. Throughout this track: MDN Web Docs on HTTP and APIs (developer.mozilla.org/en-US/docs/Web/HTTP). Postman Learning Center (learning.postman.com). OpenAPI 3.0 (spec.openapis.org). OWASP API Security Top 10 (owasp.org/www-project-api-security). FBR Digital Invoicing portal (fbr.gov.pk). NADRA Verisys overview (nadra.gov.pk). PDPA-2023 text (na.gov.pk). State Bank of Pakistan Open Banking Framework draft (sbp.org.pk).