Idempotency

For async-enqueue endpoints (any /service/* call with ?async=true), pass an Idempotency-Key header to make retries safe.

POST /service/bankid/auth?async=true
X-API-Key: cert_...
Idempotency-Key: 6c1f2cdc-3b3e-4f1a-8e91-1a2b3c4d5e6f
Content-Type: application/json

Semantics

• Same key, same organisation → returns the original job's job_id and poll URL. No duplicate enqueue. The request body is not compared — the original job wins, so never reuse a key for a different request.
• Missing key → request is treated as new, no replay protection.
• Jobs (and their idempotency keys) are retained for 7 days, after which the key becomes reusable.

Choosing keys

Use a UUIDv4 per logical request (e.g. one per checkout session). Don't reuse keys across unrelated operations.

Scope

The key is scoped to your API key's organisation, so two different organisations can use the same key value without collision.