Integration & APIs

Cutover runbook builder

A runbook skeleton with rollback points marked and the go/no-go placed where rollback still fits in the window.

A runbook skeleton with the rollback points marked. Durations are left blank on purpose — nobody can tell you how long your steps take except a rehearsal.

Interfaces moving18

Window length (hours)8

Trading partners are involvedRollback has been rehearsed and timed

Window: 8h
Rollback budget: 2h
Go / no-go: T plus 6h
Steps: 24

Rollback duration has not been measured, so the budget above is a guess at 30% of the window. Rehearse and time it — the figure is usually longer than people expect.
Partner verification is inside the window but partner remediation is not. If a partner fails verification, the decision is to roll back or run split routing — decide which, in advance.

PreparationT minus 30 to T minus 7 days

Everything that can be done before the window, done before the window.

P-01Freeze changes on both platformsChange manager
Agreed change freeze on legacy and target, with a named approver for exceptions.
P-02Confirm rollback has been rehearsed and timedTechnical lead
A rollback that has not been executed in a non-production cutover is an assumption. Record the measured duration.
P-03Verify certificates and keys do not expire in the windowSecurity
Include partner certificates. Renew anything expiring within three months.
P-04Confirm environment parityPlatform
Target configuration matches what was tested, including endpoints, credentials and scheduler entries.
P-05Agree go/no-go criteria in writingProgramme
What specifically must be true to proceed, and who decides. Vague criteria become an argument at 2am.
P-06Confirm every partner is re-certified and readyPartner manager
Written confirmation per partner, including that their allow-lists point at the new egress addresses.
P-07Book the people, not just the windowProgramme
Named individuals on call for each source and target system, with a contact route that has been tested.

Final checksT minus 24 hours

Confirm nothing has changed since preparation.

F-08Re-run smoke tests on the targetTest lead
Same tests that passed in the last rehearsal, against the current configuration.
F-09Confirm backup and restore pointPlatform
Legacy platform state captured and verified as restorable, not merely taken.
F-10Confirm business stakeholders are availableProgramme
Whoever accepts the outcome must be reachable during the window, not the following Monday.
F-11Go / no-go: proceed to windowdecisionProgramme
First decision point. Cheap to stop here.

Cutover windowT zero to T plus 8h

Execute, with a rollback point before every irreversible step.

C-12Quiesce the legacy platformrollback pointPlatform
Stop schedulers and inbound listeners. Let in-flight messages drain and record the count.
C-13Confirm zero in-flight messagesTechnical lead
Queues, staging tables and file landing zones empty. This is the point where a partial state becomes recoverable.
C-14Capture reconciliation baselinerollback pointTechnical lead
Record counts and control totals from the legacy platform for comparison after cutover.
C-15Switch routing to the target platformPlatform
Redirect 18 interfaces. Sequence by dependency, not alphabetically.
C-16Confirm partner connectivity on the new endpointsrollback pointPartner manager
One transaction per partner, acknowledged both ways. Not a ping — a real message.
C-17Run verification transactions end to endTest lead
One per interface tier, traced from source through to the system of record.
C-18Go / no-go: commit or roll back (by T plus 6h)decisionrollback pointProgramme
The last point at which rollback still fits in the window. After this the only route is forward. Budget 2h for rollback.
C-19Enable schedulers and inbound listeners on the targetPlatform
Bring traffic up in tiers, highest criticality last so problems surface on lower-risk traffic first.
C-20Reconcile against the baselineTechnical lead
Compare counts and control totals. A discrepancy here is easier to explain now than at month end.

StabilisationT plus 1 to T plus 14 days

Prove it holds under real conditions before anyone declares success.

S-21Elevated monitoring and daily reconciliationRun team
Daily comparison of volumes against the equivalent period before cutover.
S-22Keep the legacy platform recoverablePlatform
Do not decommission, do not reuse the infrastructure, do not let licences lapse.
S-23First month-end or peak processedBusiness
The real test. Most latent defects surface on a period boundary rather than on day two.
S-24Formal acceptance and handover to rundecisionProgramme
Against evidence, not against a date in the plan.

The structure is the easy part. The judgement is where the go/no-go sits, what evidence is enough to pass it, and whether a partner failing verification means rollback or split routing — all of which depend on the estate. The risk register covers what typically goes wrong around it.

Durations are left blank deliberately. A runbook with invented timings is worse than one with gaps, because people plan against the numbers instead of measuring them. The one thing asserted here is that the go/no-go must sit where rollback still fits in the remaining window — without that, it is a one-way door with a checklist attached.

Other tools

These exist because the underlying problem is real. If the numbers you just put in look uncomfortable, that is usually worth a conversation.

Tell us what you're running