Sprint 7.4 · API + Marketplace · M15

1. 🎯 Sprint Summary

2. 🧩 Module Scope

• Public REST API: /v1 · 40+ endpoints · OpenAPI 3.0 spec · Patient/Encounter/Prescription/LabOrder/etc · pagination · filtering
• GraphQL API: /graphql · same model surface · subscriptions for real-time
• OAuth 2.0 + Scopes: client_credentials + auth_code flows · 20+ scopes · per-tenant grant · token refresh
• Rate Limiting: Per-token + per-IP · adaptive · paid tier increase · burst allowance
• Developer Portal: dev.medieco.alesa.my · sign-up · sandbox tenant creation · API key management · usage analytics
• SDKs: PHP (Laravel) · Python · Node.js · auto-generated from OpenAPI · published to packagist/PyPI/npm
• Sandbox Tenants: Auto-provisioned per developer · synthetic patients · isolated · 30-day lifetime
• 3rd-Party App Marketplace: apps.medieco.alesa.my · listing · install per tenant · permission grants
• Revenue Share Billing: Stripe Connect · 70/30 dev/MediEco · monthly payouts · per-app billing
• Webhook Subscriptions: Tenant subscribe to event types · retry · signature verification · replay protection
• Marketing Launch Site: public-facing platform pitch · 5 anchor partner apps showcase · launch event
• 5 Anchor Partner Apps: insurance claim app · pharma rep app · clinic accounting integration · patient education content app · medical research recruitment

3. 🏗️ Architecture

┌─────────────────────────────────────────────────────────────┐
│              dev.medieco.alesa.my (Developer Portal)         │
│  · Sign-up · Sandbox tenants · API keys · Docs · Analytics  │
└─────────────────────────┬───────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────┐
│           apps.medieco.alesa.my (App Marketplace)            │
│  · App listing · Install per tenant · Permission grants      │
│  · Stripe Connect · 70/30 revenue share · Monthly payouts    │
└─────────────────────────┬───────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────┐
│              api.medieco.alesa.my (API Gateway)              │
│  · OAuth 2.0 · Scopes · Rate limiting · Webhook delivery    │
│  · /v1 REST · /graphql GraphQL · /webhook subscriptions      │
└─────────────────────────┬───────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────┐
│           Backend (Laravel 11 + Filament 3 cluster)         │
│  · Multi-tenant · Per-tenant region pinning · Federated     │
│  · M9 audit · Cross-tenant isolation · PDPA compliant       │
└──────────────────────────────────────────────────────────────┘

4. 🚦 Pre-Sprint Gate Checklist

• Sprint 7.3 closeout · M14 Cardiology live
• OpenAPI 3.0 spec drafted · 40+ endpoints reviewed
• GraphQL schema drafted · cross-checked with REST
• OAuth 2.0 + scopes catalogue approved (20+ scopes)
• Stripe Connect account onboarded · revenue share model approved
• Rate limit policy drafted · paid tier matrix
• SDK auto-generation toolchain (OpenAPI Generator) tested
• 5 anchor partner apps committed · LOIs signed
• Public platform launch event venue booked (2 Apr)
• Developer relations consultant onboarded (4 weeks)
• Compliance Lead reviewed API surface · pen-test scope updated

5. 📅 Day-by-Day Plan (20 days · 4-week sprint)

6. 📦 Deliverables

7. 👥 Team Capacity

8. 🔔 Sprint Ceremonies

• Mon 6 Mar 9am — Sprint Planning (90 min · longer 4-week sprint)
• Daily 9am — Standup (15 min · DevRel joins Tue/Thu)
• Fri 10 + Fri 17 + Fri 24 Mar 4pm — Mid-sprint demos (60 min each · 3 mid-demos in 4-week sprint)
• Tue 28 Mar 4pm — Pen-test debrief + production readiness review (90 min)
• Mon 2 Apr 9am — Public Platform Launch Event (90 min · live-streamed)
• Mon 2 Apr 11am — Sprint Demo (60 min · internal)
• Mon 2 Apr 1pm — Sprint Retro (60 min)

9. 🩺 Sign-off Items

• REST API: 40+ endpoints functional · OpenAPI spec accurate · 95% test coverage
• GraphQL parity with REST · subscriptions working · 5 sample queries
• OAuth 2.0 + 20 scopes · sandbox + production flows · token refresh
• Rate limiting: 1000/min per token · burst tested · paid tier increase verified
• Developer portal sign-up flow: 50+ test accounts created · keys generated
• Sandbox tenant: auto-provisioned · isolated (no cross-leak verified) · 30-day TTL
• SDKs: 3 languages · packagist/PyPI/npm published · 5 sample apps each · doc complete
• Marketplace: 5 anchor apps installable · permission grants · Stripe payouts tested
• Webhook delivery: 99% success · retry logic · signature verified
• Pen-test light: 0 critical · 0 high · ≤ 3 medium with mitigations
• Public launch: 50+ developer accounts · 10 marketplace apps · launch event success
• Compliance attestation: API + marketplace surface complies with PDPA
• Final sign-off (2 Apr) — Founder + Compliance Lead + Doc Zam + DevRel consultant

10. 🎬 Public Platform Launch — 2 Apr 9am (90 min · live-streamed)

11. 🛡️ Contingency