application/problem+json when it supplies an error body.
code, retryable, and field pointers. Do not branch on human-readable messages.
Status handling
Idempotency keys
Every write requiresIdempotency-Key. Keys contain 16–255 letters, digits, periods, underscores, colons, or hyphens.
- Persist one key before sending each logical operation.
- Retry that operation with the same key and identical logical input.
- Use a new key for a new operation.
- Reusing a key with different input returns
409. - A successful replay returns the same resource identity in its current state.
Retry pattern
- Treat every timeout or unavailable response as non-permission.
- Keep the original operation identity and input.
- Back off with jitter and honor
Retry-Afterwhen present. - Read the Mandate or Authorization before starting any replacement action.
Attesso-Request-Id for support correlation. Never log API keys, identity assertions, approval URLs, or external credentials.
