Idempotency-Key
header solves that: the server remembers the key and answers a repeat the same way it
answered the first request, without creating anything again.
Where it works today
Creating a document
SendIdempotency-Key with POST /documents and a repeat of the same request
returns the same document instead of a second one.
A key lives 24 hours and belongs to your API key, so two API keys may use the same
string without colliding. The key is claimed before the document is created,
which is what stops two simultaneous requests with one key from producing two
documents — the double-submit case.
A repeat is not served from a cache: the server re-reads the document through the
normal path, so permissions are checked on every reply and the data is current.
Ingest
You choose the key and send it as a header. It must be unique per batch content: the same batch keeps its key, a new batch gets a new one.
The
409 is not a bug in your logic; it confirms the first attempt landed. Treat it
as success and do not resend the batch.
Living without idempotency
UseIdempotency-Key for document creation. For the other writes, lower the risk
like this:
1
Record your own identifier before the call
Store the intent (“create an order for employee X from template Y”) together with
your own operation key, and only then call the API.
2
After a drop, do not retry blindly
First check whether the document already exists:
GET /documents?type_id=…&created_after=…&search=…. If it does, store its id
and skip the retry.3
Retry reads and explicitly safe actions only
GET requests are free to repeat. Repeating _approve or _sign on a slot that
already acted returns a state error rather than creating a duplicate.