Idempotency

Every POST, PATCH, and DELETE requires an Idempotency-Key header.

Idempotency-Key: order-create-2026-04-30-abc123

Format: 1–64 chars, [A-Za-z0-9_-:.]. We cache the response for 24 hours per key. Replays return the cached response with Idempotency-Replay: 1.

Use a stable, unique value per logical operation (e.g., a UUID generated client-side).