Idempotency

Idempotency-key support (an Idempotency-Key header that makes replaying the same POST request safe) is part of this API's design and documented here so integrations can build against the intended contract, but it is not yet enforced by the endpoints shipping today.

Until it lands, treat every POST as non-idempotent: don't blindly retry a purchase-type request without first checking whether the original call actually succeeded (e.g. via the matching GET .../orders/:id).