Middleware, event mesh and third-party APIs
One integration layer for every system and partner, with the failure cases handled
When every connection is its own script
Most businesses depend on services they do not run: a CRM, carriers and 3PL logistics providers, tax platforms, KYC and AML screening, and SaaS tools. Each has its own API, its own limits and its own way of failing.
Connected one at a time, they become a set of point-to-point scripts nobody fully understands. A partner changes its API, a message is lost at night, and the first sign is a customer complaint.
What changes for you
One layer instead of a web of scripts
Systems publish and receive events through one governed layer, so adding a partner does not mean touching every system.
Nothing lost, nothing duplicated
Idempotent writes, retries with back-off and a dead-letter queue, so a failure is caught and replayed instead of lost.
Every flow visible
Traces, error rates and latency per partner, with alerts that say which partner failed and how.
What we deliver
API gateway
One governed front door for the APIs you publish: authentication, rate limits, quotas, versioning and usage analytics.
Event mesh and enterprise service bus
An event mesh is a network of brokers that routes events between systems and sites in real time. Where your estate already runs on an enterprise service bus (ESB), we design and extend that too.
BPMN workflow automation
Processes that span systems and people, such as onboarding or approvals, modelled in BPMN (Business Process Model and Notation) and run by a workflow engine.
Third-party ecosystem connectors
Connectors over REST, SOAP and webhooks, or through an iPaaS (integration platform as a service), for CRM, 3PL logistics, tax and KYC and AML providers.
API contracts and versioning
OpenAPI or WSDL definitions for each interface, with field rules, error codes and limits, and a policy for absorbing partners' changes.
Identity and secrets
Single sign-on with OpenID Connect or SAML, service access with OAuth 2.0, and credentials in a secrets vault, scoped and rotated.
Reliability and monitoring
Idempotency keys, retries, dead-letter queues and a human operations path for every exception, with dashboards and alerts per partner.
How we work
Take stock
We list the systems and partners you depend on, the data each one needs and the failures you see today.
Design the layer
We write the API contracts and choose direct calls, events, an ESB or an integration platform for each flow.
Build the connectors
We build each connector with its error handling, duplicate protection and logging in place from the start.
Test with each partner
We run contract tests and end-to-end scenarios in each partner's test environment, including failures.
Release safely
We release in stages and keep the old path available until the new one is proven.
Run and adapt
We watch error rates and dead letters, and adapt the connectors when partners change their APIs.
Scroll sideways to see the whole drawing.
ERP to third parties: one platform, many partners
Business events leave the ERP once and the integration platform delivers them to each partner in the format it expects. Callbacks come back the same way. A message that still fails after its retries goes to a dead-letter queue and raises an alert with the payload attached.
- Primary flow
- Asynchronous
- Exception path
The flow in 9 steps
The flow, step by step
- From ERP to Integration platform: Business events, over REST · OData · webhook (primary flow).
- From Integration platform to CRM: Customers and orders, over REST/JSON (primary flow).
- From Integration platform to Logistics and carriers: Shipments booked, over REST/JSON (primary flow).
- From Logistics and carriers to Integration platform: Tracking events, over webhook (asynchronous).
- From Integration platform to E-invoicing and tax platform: Invoices for clearance, over SOAP/XML · REST (primary flow).
- From Integration platform to KYC and identity provider: Identity checks, over REST/JSON (primary flow).
- From KYC and identity provider to Integration platform: Check results, over webhook (asynchronous).
- From Integration platform to Dead-letter queue and alerts: Failed after retries, to a dead-letter queue (exception path).
- From Dead-letter queue and alerts to Support team: Alert with the payload and the error (exception path).
Protocols, platforms and standards
If you already own an integration platform, we build on it. Naming a product does not mean a partnership with its vendor.
- Data and analytics
- Apache Kafka
- Integration
- REST
- SOAP
- GraphQL
- Webhooks
- OpenAPI
- MuleSoft
- Boomi
- Azure Logic Apps
- Apache Camel
- RabbitMQ
- Identity and access
- OAuth 2.0
- OpenID Connect
- SAML 2.0
- SCIM
- Keycloak
- Microsoft Entra ID
- Healthcare standards
- HL7 v2
- HL7 FHIR
Proof in production
For a Tier-1 GCC bank and regional conglomerate, we built an event-driven middleware mesh on Apache Kafka. It connects SAP S/4HANA to banks and tax authorities, with secrets held in HashiCorp Vault.
How to start
A clear list of partners and flows goes straight to a proposal. An undocumented web of existing integrations starts with the Brownfield Diagnostic Bridge.
What happens next
Pre-consulting session
A free 30-minute online pre-consulting session: we go through your goals, systems and constraints.
Readiness review
In a free 48-hour readiness review, a Principal Architect checks your project against the 6-point Definition of Ready and recommends the track that fits.
Choosing the track
Scope-ready projects receive a binding proposal within 3–5 business days. Concept-stage projects start in the Blueprint Studio. A live system that is failing, undocumented or needs integration starts with a diagnostic of 1–2 weeks. The Blueprint Studio and the diagnostic each have a fixed fee, quoted in the proposal.
Delivery in five stages
Mobilisation, sprints with live demonstrations, integration and hardening, acceptance and go-live, then managed services. After launch comes a warranty period, then optional support and maintenance.
Fixed-outcome projects and round-the-clock managed services
Fixed-scope, milestone-driven delivery with named delivery leads, and round-the-clock application managed services under SLA governance.
Embedded specialists and strategic augmentation
Nearshore and on-site principal engineers and specialists, and embedded solution, transformation, PQC and integration architects.
Questions and answers
Should we use an integration platform or custom code?
It depends on how many connections you have and who will run them. An integration platform such as MuleSoft, Boomi or Azure Logic Apps gives you ready connectors, mapping and monitoring in one place, at a licence cost. Custom services give you full control and no licence, but more code to maintain. We compare both for your case.
What is the difference between an ESB and an event mesh?
An enterprise service bus routes and transforms messages through a central hub. An event mesh distributes events through a network of connected brokers, so systems in different clouds and sites publish and subscribe directly. Many estates run both while they move from one to the other.
What happens when a partner's API is down?
Requests that fail for temporary reasons are retried with increasing delays. Every write carries an idempotency key, so a retry never creates a second order or invoice. A message that still fails goes to a dead-letter queue with the payload and the error. An alert reaches your team, and the message is replayed once the partner recovers.
How do you handle API version changes?
For the APIs you publish, we version them, keep old versions running for an agreed period and tell consumers what changes. For the APIs you call, we track each partner's deprecation notices and test new versions in their sandbox. Contract tests catch an unannounced change before it reaches production.
Can you connect our identity provider?
Yes. We add single sign-on with OpenID Connect or SAML 2.0 through providers such as Microsoft Entra ID or Keycloak. Users are provisioned with SCIM where the application supports it. Your identity provider stays the single place where access is granted and removed.
How do you deal with rate limits?
We design around each partner's published limits. We batch requests where the API allows it, cache data that rarely changes, spread scheduled jobs and back off when a limit is near. Monitoring shows how close each flow runs to its limit.
Ready to build? Ask for a proposal.
Send your requirements or RFP. Our architects validate them and return a binding, fixed-scope proposal.
What happens next
Readiness review
In a free 48-hour readiness review, a Principal Architect checks your project against the 6-point Definition of Ready and recommends the track that fits.
Binding proposal
After architecture validation at no cost, you receive a binding, fixed-scope proposal within 3–5 business days: milestones, architecture, team structure and SLAs. We sign a non-disclosure agreement (NDA) with you on request, before you share your requirements.
Mobilisation
Once you sign, our engineering pods begin Sprint 0 within 5–10 business days of contract signature.
Delivery in five stages
Mobilisation, sprints with live demonstrations, integration and hardening, acceptance and go-live, then managed services. After launch comes a warranty period, then optional support and maintenance.