Third-Party and SaaS Integration Questions

Strategy
I would define a single source of truth per data domain, not one for everything. Source of truth means the system that is allowed to make the final decision for a field. For consent and preferences, I would usually pick one authoritative consent service and make the others read-through or replica systems.

Conflict resolution rules

• Prefer the authoritative system for that field, such as the compliance tool for consent.
• Use timestamps only within the same trust tier, not across all systems blindly.
• If two updates conflict and neither clearly wins, keep the last known safe state and queue manual review.
• Store source, timestamp, and reason so every decision is auditable.

Example
If the website records email opt-out at 10:01 and the CRM sends an older preference snapshot at 10:05, I would still keep the opt-out because the website is the higher-trust source for user actions and the CRM update is likely stale.

Practical rule
For each field, I would document who can write, who can read, and how conflicts resolve. That prevents every team from claiming ownership and makes outages much easier to recover from.

Recommendation
For unsubscribes, I would centralize the consent workflow and let other systems react to the resulting event. This is a case where correctness matters more than loose independence, because one missed suppression can create a compliance problem.

How I would decide

• Centralize if there is one business rule for consent, one audit trail, and a hard deadline before the next send.
• Use choreography only when systems are loosely coupled and temporary delay is acceptable.

Failure modes I would watch

• A service misses the unsubscribe event
• A retry causes duplicate updates
• A campaign send races ahead of the suppression update
• One system updates from stale cache while another is current

Example
If a user opts out at 9:10 and a campaign is scheduled for 9:15, the central consent service should record the change immediately, publish an event, and block sends until all critical destinations confirm receipt or until the campaign filter reads from the central source of truth.

Control plane
I would add retries, dead-letter handling, a reconciliation job, and a pre-send suppression check so the system stays safe even if one downstream service is slow.

Approach
I would resolve identities with a layered matching strategy. Identity resolution means deciding which records refer to the same person. I would use deterministic rules first, then probabilistic rules when the evidence is weaker.

Trust and merge rules

• Treat login-linked identifiers such as verified email or account ID as high trust.
• Treat anonymous cookies as temporary and link them only after a login or strong correlation.
• Prefer source systems that own the data, for example the billing system for account status.
• Keep conflicting attributes as separate fields with lineage when the source is uncertain.

Example
A browser cookie c123 later logs in as jane@example.com and maps to account A77. I would merge those into one person profile because the login creates a strong bridge. If another record also uses jane@example.com but has a different customer since 2021, I would not auto-merge until I verify whether it is a shared inbox or a duplicate account.

Decision rule
Merge when confidence is high and the identifiers form a clear chain. Keep separate when the match could create a false positive, because over-merging is harder to undo than under-merging.

Design
I would insert an anti-corruption layer between the vendor and the rest of the stack. That means the integration layer translates vendor payloads into a stable internal contract, and the downstream systems only see the internal shape.

Components

• Vendor adapter for each API or webhook version
• Canonical schema with versioning
• Transformer service that maps vendor fields to internal fields
• Contract tests that verify each adapter against sample payloads
• Replay pipeline so old events can be reprocessed through the new adapter

Example
If the vendor changes email_address to primary_email, only the adapter changes. Downstream systems still receive email. If the vendor adds a new field, I can ignore it until a consumer needs it, which avoids a cascade of changes.

How this prevents repeat pain
I would document field ownership, use schema validation at the edge, and run a parallel test environment before cutover. Then when the next vendor change arrives, the blast radius stays inside one adapter instead of spreading across every consumer.

Approach
I would make the consumer idempotent. Idempotent means the same event can be processed twice without creating two results. The core pattern is: persist the raw webhook first, dedupe by a stable event key, then process asynchronously.

Design

• Require an event_id from the sender, or derive a fingerprint from source system, object id, and version.
• Store each event in an inbox table with a unique constraint on that key.
• Ack the webhook only after the raw event is durably stored.
• Use upserts in downstream tools keyed by the business entity, such as lead_email or external_lead_id.
• Track event version or updated_at so older events do not overwrite newer state.

Example
If lead 123 arrives twice at 10:01 with the same event_id, the first insert succeeds and the second is ignored by the unique constraint. If a newer update at 10:03 changes the phone number, the processor applies that one because its version is later.

Failure handling
I would add retries with backoff, a dead-letter queue for poison messages, and periodic reconciliation so partial failures do not silently drift.