Idempotency

All create endpoints under /public/v1 require an idempotency key so retries do not duplicate quotes or orders.

Header

Idempotency-Key: 01J8Z3V…   # or any opaque string ≤ 128 chars

Recommendations:

• Use a UUID / ULID per user submit action.
• Persist the key with your form submission id.
• Reuse the same key when retrying after timeouts.
• Use a new key for a genuinely new submission.

Behavior

Case	Result
First request with key	Processed; full response body stored with status and resource id
Replay, same key + same body fingerprint	Original response replayed (same resource id and body)
Replay, same key + different body	409 idempotency_conflict
Key expired (retention ~72 hours)	Treated as new

Retention and purge: public-api-spec.md §8.

Example

KEY=submit-10482-attempt
curl -sS "$AF_API/public/v1/quotes" \
  -H "Authorization: Bearer $AF_API_KEY" \
  -H "Idempotency-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d @payload.json
# network blip — safe to repeat with same KEY