Idempotency-Key — any unique string up to 255 characters, a UUID by
convention:
Where it is required
POST /v1/calls and POST /v1/billing/topups — the two paths that spend money.
Omitting it returns 400 missing_idempotency_key. Other mutating endpoints
honour the header if you send it.
What happens on a retry
Replaying the same key with the same body returns the original response — same status, same body — with an extra header:Two ways it can refuse
Generate a new key per logical operation, not per attempt. Retrying a failed
call with a fresh key is a second call. Retrying it with the same key is the
same call.

