Risk Assessment

Score: 1/10 — low

This is a documentation-only rewrite. Verified all internal anchor links (#flow-1-capture-a-payment-request, #collecting-a-payment-method-for-future-charges, #context, #testing, etc.) resolve to their corresponding headings, and all cross-file references (paymentrequests.md#add-payment-requests, paymentmethodrequests.md#add-payment-method-request, reservations.md#reservation-parameters, creditcards.md#charge-credit-card, payments.md#add-credit-card-payment, guidelines/environments.md, contact-support/README.md) point to real files and existing headings. GitBook {% hint %} / {% stepper %} syntax matches existing conventions elsewhere in the repo, the new en-dash rule in AGENTS.md is followed throughout the rewritten page (no em dashes found), and the PR's claimed removal (orphaned "merchant ID" row in how-to.md) is reflected in the diff. No stale references to the dropped Secure Fields / tokenized-credit-card flow remain elsewhere in the repo.

Review Summary

Verdict: APPROVE
No findings — the rewrite is internally consistent and well cross-checked against existing repo conventions and operation references.

Overall: docs-only rewrite, high quality — nothing blocking merge. All links, anchors, GitBook blocks, and API fields in the examples were verified against the operation docs at head; the findings below are guidance gaps and minor consistency items.

Agent Task List

Copy and paste the following into your coding agent:

Review the PR at #68 and investigate the following review findings. Verify each one against the actual code before acting on it — the reviewer can be wrong. If a finding doesn't hold up, push back: skip it and explain your reasoning (what you checked and why the reviewer's claim is incorrect) instead of applying a fix you don't agree with. Only fix what you've confirmed is a real issue with the right suggested change.

1. [Medium - Security] connector-api/use-cases/payment-automation.md (Flow 2: Capture a payment) — the charge amount is client-supplied in the load() config with no server-side verification guidance; add a caveat telling partners to reconcile the resulting payment amount via the Connector API instead of trusting the client value.
2. [Medium - Docs] connector-api/use-cases/how-to.md:44 — the "How to add a credit card to the guest profile" row still lists Payment automation as a related use case, but the rewritten page no longer documents that flow; drop the reference (note: PR description says labels were kept "per request" — confirm intent before changing the two Get-all-credit-cards rows).
3. [Medium - Observability] connector-api/use-cases/payment-automation.md (Callback events + Examples) — no example wires up onSuccess/onFailure and the error: string payload is undocumented; add failure-handling to the React example and document/describe possible error values.
4. [Low - Docs] connector-api/use-cases/payment-automation.md (Testing section) — add a warning that dataBaseUrl: 'https://app.mews-demo.com' must be removed in production, otherwise real traffic silently goes to the demo environment.
5. [Low - Code Quality] connector-api/use-cases/payment-automation.md React example — fenced as jsx but contains TypeScript annotations; change the fence to tsx or remove the types.
6. [Low - Docs] connector-api/changelog/README.md:28 — entry dated 2026-07-22 (future); confirm the intended publish/merge date.
7. [Low - Docs] connector-api/use-cases/payment-automation.md — hint callout titles use #### while connector-api/concepts/restrictions.md uses ###; align the heading level.
8. [Low - Docs] PR description — correct two claims: CLAUDE.md links to AGENTS.md (not the reverse), and the hint-title convention reference to restrictions.md.

For each confirmed fix, ensure existing tests still pass and add tests where coverage is missing. Finish with a short summary of which findings you confirmed, fixed, or rejected (and why).