Skip to main content
Attesso uses application/problem+json when it supplies an error body.
Branch on code, retryable, and field pointers. Do not branch on human-readable messages.

Status handling

Idempotency keys

Every write requires Idempotency-Key. Keys contain 16–255 letters, digits, periods, underscores, colons, or hyphens.
  • Persist one key before sending each logical operation.
  • Retry that operation with the same key and identical logical input.
  • Use a new key for a new operation.
  • Reusing a key with different input returns 409.
  • A successful replay returns the same resource identity in its current state.

Retry pattern

  1. Treat every timeout or unavailable response as non-permission.
  2. Keep the original operation identity and input.
  3. Back off with jitter and honor Retry-After when present.
  4. Read the Mandate or Authorization before starting any replacement action.
Log the safe Attesso-Request-Id for support correlation. Never log API keys, identity assertions, approval URLs, or external credentials.