Duplicate API Request

Overview

A duplicate API request is a repeated API call that represents the same intended operation as an earlier request, whether caused by retry logic, network uncertainty, user action, or message redelivery. A duplicate request is an input condition; it does not prove that a duplicate payment occurred. Overly broad detection can suppress legitimate repeated operations, while weak key scoping can allow one merchant or endpoint to collide with another.

The receiving service determines duplication using an idempotency key, request identifier, operation fingerprint, or business identifier. These records support Payment Retry and let an operator reproduce the result from authoritative evidence rather than relying on a dashboard snapshot or a provider’s latest status alone.

Duplicate API Request should remain distinct from Payment Retry and Duplicate Payment, because each can represent a different stage, record, control, or financial outcome.

The final control should feed Duplicate Payment , preserve the original evidence, and document any correction, override, or manual action. Important failure modes include duplicate or out-of-order delivery, incompatible schemas, lost acknowledgements, unbounded retries, stale consumers, forged messages, and replay that creates a second financial action.

It should return the stored result or a deterministic conflict instead of executing the financial side effect again when the original operation already completed. Controls should retain the request payload hash, authentication context, idempotency key, first-seen time, response, expiration policy, and linked payment object. Retries must use the same key and materially identical parameters for the same logical operation. The contract should define identifiers, schema and version, authentication, ordering, idempotency, retry behavior, error handling, and the service responsible for authoritative state.