PROTOCOL ATLAS / DATASET 016 PROVIDERS
The same HTTP.
Six different dialects.
Authentication, limits, pagination, retries, and webhook signatures are where “standard REST” stops being standard. This atlas records the fields that matter during integration incidents and links each profile to its primary source.
Stripe
Payments
- Credential
- Secret key / restricted key
- Limit model
- Global, endpoint, concurrency, and resource-specific limiters
- Limit evidence
Stripe-Rate-Limited-ReasonRetry-After- Pagination
- Cursor parameters on list APIs
- Webhook verification
- Stripe-Signature; timestamped HMAC; raw body required
- Idempotency
- Idempotency-Key; v1 and v2 retention semantics differ
GitHub
Developer platform
- Credential
- Bearer token / GitHub App token
- Limit model
- Primary resource windows plus secondary point and concurrency limits
- Limit evidence
x-ratelimit-limitx-ratelimit-remainingx-ratelimit-reset- Pagination
- Link header with page relations
- Webhook verification
- X-Hub-Signature-256; HMAC-SHA256
- Idempotency
- Endpoint-specific; no universal REST write header
Shopify
Commerce
- Credential
- X-Shopify-Access-Token
- Limit model
- GraphQL query cost; REST leaky bucket on legacy endpoints
- Limit evidence
X-Shopify-Shop-Api-Call-LimitRetry-After- Pagination
- Cursor-based; REST page offsets deprecated
- Webhook verification
- X-Shopify-Hmac-Sha256; base64 HMAC
- Idempotency
- Selected GraphQL mutations use idempotency keys
Slack
Collaboration
- Credential
- Bearer token with granular scopes
- Limit model
- Method tiers and special per-feature limits
- Limit evidence
Retry-After- Pagination
- Cursor-based for supported collection methods
- Webhook verification
- X-Slack-Signature + X-Slack-Request-Timestamp; v0 base string
- Idempotency
- Workflow-specific identifiers; no universal Web API header
OpenAI
AI models
- Credential
- Bearer API key scoped to a project
- Limit model
- Model and project request/token limits
- Limit evidence
x-ratelimit-limit-*x-ratelimit-remaining-*x-ratelimit-reset-*- Pagination
- Endpoint-specific cursors
- Webhook verification
- Platform webhooks use signed delivery verification
- Idempotency
- Request-type dependent; design tool calls separately
Anthropic
AI models
- Credential
- x-api-key plus anthropic-version
- Limit model
- Organization-level request and token rate limits
- Limit evidence
anthropic-ratelimit-*-limitanthropic-ratelimit-*-remainingretry-after- Pagination
- Endpoint-specific
- Webhook verification
- No general tool-delivery webhook contract
- Idempotency
- Application-owned for side-effecting tools
READING THE ATLASNOT A BENCHMARK
Fields, not feature scores.
The atlas does not rank providers. It records wire-level decisions that change client implementation: which header carries remaining quota, whether pagination state is a page number or cursor, what bytes are signed, and where idempotency lives.
Limits and product behavior change. Each profile names the primary source and review date so a production decision can be checked against the provider’s current documentation.
CONTINUERELATED SECTIONS
Status codes are the first branch. Provider codes, headers, and request state narrow the repair.
Open section →Reference deskHTTP and API header referenceRate budget, authentication challenge, cache validator, and CORS policy all arrive as header fields.
Open section →Reliability deskAPI reliability protocolsRetry policy, idempotency, pagination, and error shape are architecture decisions, not implementation details.
Open section →