Idempotency-Key header. Sending one has no effect.
Orders: keyed on quoteId
POST /organization/{organizationId}/order creates at most one order per quote. The order’s id is the quoteId.
So a timed-out request is safe to retry with the same
quoteId:
- Keep the
quoteIdfrom the quote response. - Retry
POST /organization/{organizationId}/orderwith the same organization id andquoteId. - Treat
201and200as success. - On
409conflict, read the order withGET /organization/{organizationId}/order/{id}, using thequoteIdas the id.
Quotes
POST /organization/{organizationId}/quote creates a new quote with a new quoteId on every call. Retrying is safe: a quote does nothing until you create an order from it, and it expires after 2 minutes.
Payment accounts
POST /organization/{organizationId}/payment_account returns the account that organization already holds, with 200, when you register the same account again. We do not change the stored account, except that we retry a rejected direction with the registrationInfo you send, and it goes back to pending. If another organization holds the account, you get 409 payment-account-unavailable.
Webhook subscriptions
POST /webhook_subscription allows one subscription per URL and event. A second request for the same URL and event returns 409 conflict. We return the signing secret only on the first 201, so a retry that gets 409 does not see it. If you lost the secret, delete the subscription and create it again.
Customer organizations: keyed on the id you send
POST /organization accepts an id you generate. If the id is already in use, the request returns 409 conflict.
- Generate the UUID once and store it before the first attempt.
- Send the same UUID on every retry.
- Treat
409conflictas “already created” and read it withGET /organization/{organizationId}.