API layer pattern (HTTP)

1) Contract

Require Idempotency-Key on POST that creates resources (optional on GET, safe methods).

For PUT/PATCH, prefer natural keys (resource URI) + concurrency (ETag) over custom keys.

Return Idempotency-Replayed: true on replays.