Idempotency

Writes that list an Idempotency-Key header in the reference take one: 1 to 255 visible ASCII characters. A repeat within 24 hours answers what the first call recorded, with Idempotent-Replayed: true; the first answers Idempotent-Replayed: false. The same key with other arguments, or on another operation, is a 409 conflict on idempotency_key. A write that fails records nothing.

A key is the token's and the store's: another token, or another store, starts afresh. When the first answer could not be kept (it was too large, a customer of the store was erased, or the token lost a scope it was read under), a repeat is a 409 with current: "applied": the write landed once, so read the state back.

Any other operation refuses the header as invalid at the path headers.idempotency-key. POST /orders and POST /products/{product}/portfolio_events carry their own key in the body (source_key, idempotency_key).