# Idempotency

> Retry POST requests safely with the Idempotency-Key header.

Source: https://shopassist.coec.dk/docs/api/idempotency · Updated 2026-10-01

Send an `Idempotency-Key` header (up to 255 printable ASCII characters, a UUID works well) on any `POST`. If you retry with the same key, you get the original response instead of a second execution.

```bash
curl -X POST https://api.shopassist.coec.dk/v1/stores/sto_…/privacy-requests \
  -H "Authorization: Bearer $SHOPASSIST_API_KEY" \
  -H "Idempotency-Key: 6f1c2f8e-3c1b-4e9b-9a51-1b0c7d0e2a44" \
  -H "Content-Type: application/json" \
  -d '{"type":"delete","subject":{"email":"shopper@example.com"}}'
```

* Keys are stored for 24 hours per API key.
* A replayed response carries `Idempotent-Replayed: true`.
* The same key with a different body gets `422 idempotency_key_reused`.
* A retry while the first request is still running gets `409 idempotency_in_progress`; wait and retry.

The key is **required** on privacy requests (it becomes the request's external reference) and on Catalog Push API batches.