Idempotency

Every creation needs an Idempotency-Key header, up to 255 visible ASCII characters; a UUID works well. A network failure then never means a duplicate: send the same call again, with the same key.

Idempotency-Key: 6f1d2c1e-8b1a-4d5e-9f0a-2b3c4d5e6f70

• Same key, same body: the same response, with the header Idempotent-Replayed: true.
• Same key, another body or another endpoint: 409 idempotency_conflict.
• Same key while the first call is still running: 409 idempotency_conflict. Try again shortly.
• No key: 422 validation_failed.

Keys are per organizer and last 24 hours. A call we refused (4xx) created nothing, so you can fix it and send it again with the same key. A server error (5xx) is kept as the response, because the creation may have finished: check what exists, and use a new key to try again.

The whsec_ secret of a webhook endpoint is not repeated in a replay: if you lost the first response, rotate the secret.

The reference marks every endpoint that needs the header.