Overview
Idempotency ensures that duplicate requests have the same effect as a single request, preventing unintended side effects from network issues, retries, or user errors.How Idempotency Works
Supported Endpoints
The following endpoints support idempotency:POST /organizations- Organization creationPOST /external-payment-instruments- Payment instrument creationPOST /quotes- Quote creationPOST /orders- Order creation
Implementation
Include anIdempotency-Key header with a unique identifier:
Key Requirements
- Format: Use UUID v4 format for maximum uniqueness
- Uniqueness: Each unique operation requires a different key
- Retention: Keys are stored for 24 hours after first use
- Scope: Keys are scoped to the API endpoint and organization
Best Practices
Key Generation
Retry Strategy Integration
Response Behavior
First Request (HTTP 201)
Unique identifier for the created resource
Current status of the created resource
The idempotency key used for this request
Duplicate Request (HTTP 200)
Same response returned with HTTP 200 (not 201), indicating the resource was
not created again but the original response is returned.
Error Scenarios
Invalid Key Format (HTTP 400)
Error code:
INVALID_IDEMPOTENCY_KEYHuman-readable error message explaining the key format requirements
The invalid key that was provided in the request
Key Conflict (HTTP 409)
When the same key is used with different request bodies:Error code:
IDEMPOTENCY_KEY_CONFLICTExplains that the key was already used with different parameters
Hash of the original request body for comparison
Hash of the current request body showing the difference
Enterprise Considerations
Compliance & Auditing
- All idempotency key usage is logged for audit purposes
- Request hashes are stored (not full request bodies) for privacy
- Logs include timestamps, API keys (masked), and response status
High-Volume Integration
- Consider implementing client-side deduplication before API calls
- Use persistent storage for idempotency keys across application restarts
- Monitor idempotency key conflicts as they may indicate integration issues
Key Management
- Development: Use predictable keys for testing (e.g.,
test-{scenario}) - Production: Always use cryptographically secure UUIDs
- Monitoring: Track idempotency key usage patterns for optimization

