Hi Rocky,

There is definitely a lot here to cover. To start, take a look at https://docs.q2developer.com/guides/networking/web_requests.html#third-party-services .

I will address most of your points with my understanding of using the Q2 ecosystem thus far. Heads up, lots of docs incoming...

1. Yes, the docs linked above are a great starting point, then https://docs.q2developer.com/tutorials/online_banking/q2_requests.html?highlight=q2_requests for an implementation example, and finally, https://docs.q2developer.com/api_references/q2_sdk/core/q2_requests.html?highlight=q2_requests#module-q2_sdk.core.q2_requests for module docs. Definitely take note of the "Allow list" notes in the docs. Basically, you need to let Q2 know what endpoints your logic plans to hit in production if it is an external resource, everything is blocked by default.
2. q2_requests should handle this for you. It is built on top of https://docs.python-requests.org/en/master/
3. The requests library should support this: https://2.python-requests.org/en/master/user/advanced/#ssl-cert-verification and q2 provides Vault storage: https://docs.q2developer.com/guides/performance_and_security/vault.html?highlight=vault
4. https://2.python-requests.org/en/master/user/advanced/#timeouts provides some "best practice" for timeouts using the library.
5. Sorry, I don't have a definitive answer on this one. Someone from Q2 may be able to answer this definitively.
6. Q2 has a built in memcache service baked in: https://docs.q2developer.com/tutorials/online_banking/caching.html?highlight=cache that you could leverage for this perhaps, using the online user id as part of the key and having it live for a short duration then check it on POST?

I hope that this helps you on your journey. Honestly, the fact that you are asking these questions is great, and you are on the right track to secure and efficient extensions. Good luck!