API layer pattern (HTTP) 1) Contract Require Idempotency-Key on POST that creates resources (optional on GET, safe methods). For PUT / PATCH , prefer natural keys (resource URI) + concurrency (ETag) over custom keys. Return Idempotency-Replayed: true on replays. 2) What to persist (TenantId, IdempotencyKey) — unique . Request fingerprint (stable hash of method + path + canonicalized body). First status code , headers (whitelisted), ...