Idempotency

POST endpoints with side effects accept an optional header:

X-Idempotency-Key: <uuid-or-opaque-string>

Replays with the same key within 24h return the original response, unchanged. Replays with the same key but a different request body return 409 conflict.

Always send an X-Idempotency-Key on POST requests so retries after a timeout or a 5xx don't double-create a resource. GET, PATCH and DELETE are naturally idempotent and don't need one.

curl https://api.inbox.kobana.com.br/v1/inboxes \
  --cert ./client.crt --key ./client.key \
  -H "Authorization: Bearer $JWT" \
  -H "Content-Type: application/json" \
  -H "X-Idempotency-Key: $(uuidgen)" \
  -d '{ "label": "Support — Triage" }'