The problem

A non-profit’s intake form registers people for a partner medical program. Submission data has to reach the partner’s external patient-management API — but that API is slow, occasionally times out, and requires a separate call per uploaded document after the patient record itself is accepted. The naive approach — send everything synchronously when the form is submitted — meant visitors staring at a spinner, and any hiccup on the partner’s side silently losing a submission.

What I built

A queue-based integration that treats “talk to a flaky third-party API” as its own problem, decoupled from the form submission itself:

Every submission becomes a durable job, not a fire-and-forget request. The form handler’s only responsibility is to save the data and schedule work — nothing about the external API can block or lose the submission.
Two-phase delivery with WP-Cron. The patient record is sent first; once accepted, attached documents are uploaded one at a time in their own scheduled steps, so a failure on file 3 of 5 doesn’t require re-sending the whole batch.
Exponential backoff retries on both phases, with a hard attempt cap so a permanently broken job surfaces instead of retrying forever.
A database-backed fallback. If in-memory form data ever came through incomplete, the queue re-reads the original submission from the form plugin’s own storage before giving up — trading a bit of redundancy for zero silently-lost patients.
A full admin dashboard: live job status, per-job attempt counters, one-click retry or restart, and a searchable, filterable log viewer — because “check the server error log” is not an acceptable debugging story for a non-technical ops team.
File integrity checks before upload — minimum size and content-type validation, so a broken or HTML-error-page “document” never gets forwarded as a real file.

Why it matters

None of this is glamorous — it’s queueing, retries and logging. But it’s the difference between “the integration works in the demo” and “the integration has survived a partner API outage without anyone noticing.” A scheduled fallback worker sweeps for stuck jobs every five minutes, so recovery doesn’t even require a human to click retry.