Idempotency-Key header. If you send the same key with the same
body again, Zquence returns the account it already created instead of creating a second one.
Which endpoints support it?
| Endpoint | How retries are made safe |
|---|---|
POST /v1/accounts | Idempotency-Key header, required. |
POST /v1/tenants/add-user | No header needed. The call is idempotent on email (and phone when sent). |
POST /v1/sanctions/screen | Send requestNonce in the body. |
Idempotency-Key header.
How it works
Build a key from your business event
Use something that stays the same for every retry of the same operation, for example
crm-case-10482-open. A UUID also works if you store it before the first attempt.
Keys must be 8–255 visible ASCII characters with no spaces.Behavior guarantees
- Keys are scoped to the API key and its environment. The same string on a different key never collides.
- Keys don’t expire. A key stays tied to the account it created.
- A replay returns
201 Createdwith the account’s current state. No second account, emails, or webhooks. - Reusing a key with a different body returns
409with codeidempotency_key_reused. - Two bodies count as the same after trimming whitespace, lowercasing
accountType, and ignoring participant order. - A request that fails validation (
400) stores nothing, so you can fix the body and reuse the key.
Example
What to key on
| Scenario | Good idempotency key |
|---|---|
| Opening an account for a CRM case | "crm-case-" + caseId + "-open" |
| Opening an account for an order | "order-" + orderId + "-open" |
externalReference for a second guarantee: even with a new key, Zquence rejects a
second account for the same reference with 409 external_reference_exists.