Great stuff James, can't wait to see it in production!

Hi Stephen, this is a valid approach however you will lose information about problematic calls such as json can't be parsed or API key in headers is wrong. I prefer to actually save the http call in full as http generic message and then call a process or operation with transformation to the proper message format, as Alex demonstrated in his third example. You can still call operation manually if you want, passing the parsed message. 

Yes you can use $system.Encryption.TOTPValidate() function https://docs.intersystems.com/iris20243/csp/documatic/%25CSP.Documatic.c...

See also https://community.intersystems.com/post/systemencryptiontotp-synchroniza...