How would you test code that integrates with a third-party HTTP API?

No single layer proves the integration completely. Local protocol tests give speed and failure control; contract checks detect drift; sandbox checks reveal authentication or provider-environment differences; production observability detects what cannot be reproduced. I version fixtures, redact payloads, rotate test secrets, and make provider outages distinguishable from product regressions. When a provider defect escapes, I preserve the response safely and add the smallest regression guard at the layer that can reproduce it.