Libraries tagged by idempotency-key

Tamper-evident seals for Eloquent models (keyed MACs and signatures, key rotation, an append-only ledger with external anchors), idempotency keys, single-use nonces and URLs, and RFC 9421 HTTP message signatures.

Go to Download

RevKeen is a fintech-grade API for payments, subscriptions, invoices, and billing. The canonical production MCP server is available at `https://mcp.revkeen.com/mcp`. **API Version:** `2026-05-01` — Pin with the `RevKeen-Version` header. **Quick Links:** [Full Documentation](https://docs.revkeen.com) | [Authentication](https://docs.revkeen.com/authentication) | [OAuth](https://docs.revkeen.com/oauth) | [SDKs](https://docs.revkeen.com/sdks) | [Webhooks](#webhooks) | [MCP Guide](https://docs.revkeen.com/mcp) ## Authentication Two authentication methods are supported: ### API Keys (recommended for server-to-server REST API integrations) Send your API key in the `x-api-key` header. Get keys from the [Dashboard](https://app.revkeen.com/settings/api-keys). Use `rk_sandbox_*` for test mode and `rk_live_*` for production. ### OAuth 2.1 (recommended for MCP and third-party integrations) Use OAuth 2.1 with PKCE for authorization code flow or client credentials for server-to-server. Tokens are sent via `Authorization: Bearer rk_oauth_*`. See the [OAuth guide](https://docs.revkeen.com/oauth) for setup. - **Authorization Code + PKCE** — user-facing integrations, MCP hosts - **Client Credentials** — server-to-server, automated workflows - **Dynamic Client Registration** — MCP hosts that auto-register ## MCP Integration RevKeen's canonical production MCP server is `https://mcp.revkeen.com/mcp` using Streamable HTTP and OAuth 2.1 bearer tokens. - **Customer launch surface** — read-first customer v1 tools with least-privilege scopes - **Host setup guide** — see the [MCP guide](https://docs.revkeen.com/mcp) for ChatGPT, Claude, and compatible MCP hosts ## API Key Scopes Scopes follow `{resource}:{action}` format (e.g., `invoices:read`, `customers:*`). See [full scope reference](https://docs.revkeen.com/authentication#scopes). | Category | Scope | Description | |----------|-------|-------------| | **Payments & Checkout** | `checkout:read` | View checkout session details | | | `checkout:write` | Create and manage checkout sessions | | | `cart:read` | View cart session details (REV-3511) | | | `cart:write` | Create and mutate cart sessions, line items, add-ons (REV-3511) | | | `payment_links:read` | View payment links | | | `payment_links:write` | Create and manage payment links | | | `charges:read` | View one-time charges | | | `charges:write` | Create one-time charges for customers | | | `payments:read` | View payment details | | | `payments:write` | Capture or void payments | | | `payment_intents:read` | View payment intent details | | | `payment_intents:write` | Create, confirm, capture, and cancel payment intents | | | `setup_intents:read` | View setup intent details | | | `setup_intents:write` | Create, confirm, and cancel setup intents | | | `payment_methods:read` | View saved payment methods | | | `payment_methods:write` | Attach and detach payment methods | | **Billing** | `invoices:read` | View invoices | | | `invoices:write` | Create, update, and manage invoices | | | `subscriptions:read` | View subscriptions | | | `subscriptions:write` | Create, update, pause, and cancel subscriptions | | | `subscription_schedules:read` | View subscription schedule details | | | `subscription_schedules:write` | Create, update, cancel, and release subscription schedules | | | `orders:read` | View orders | | | `orders:write` | Create and manage orders | | | `credit_notes:read` | View credit notes | | | `credit_notes:write` | Create and void credit notes | | **Products & Pricing** | `products:read` | View product catalog | | | `products:write` | Create and update products | | | `prices:read` | View pricing information | | | `prices:write` | Create and update prices | | | `discounts:read` | View discount codes | | | `discounts:write` | Create and manage discount codes | | | `tax_rates:read` | View tax rate configurations | | | `tax_rates:write` | Configure tax rates | | **Usage & Metering** | `meters:read` | View meter configurations | | | `meters:write` | Create and update meters | | | `usage:read` | View usage events and balances | | | `usage:write` | Ingest usage events | | **Customers** | `customers:read` | View customer information | | | `customers:write` | Create and update customers | | | `entitlements:read` | View customer entitlements / feature access | | | `entitlements:write` | Grant and revoke customer entitlements | | | `businesses:read` | View business entities | | | `businesses:write` | Manage business entities | | **Money Movement** | `refunds:read` | View refund details | | | `refunds:write` | Issue refunds | | | `voids:read` | View voided transactions | | | `voids:write` | Void unsettled transactions | | | `disputes:read` | View chargebacks and disputes | | | `disputes:write` | Respond to disputes | | | `payouts:read` | View payout and settlement data | | **Direct Debit** | `mandates:read` | View Direct Debit mandates and collection status | | | `mandates:write` | Create, suspend, reinstate, and cancel Direct Debit mandates | | **Terminal** | `terminal:read` | View terminal devices and card-present payments | | | `terminal:write` | Initiate, cancel, refund, and void terminal payments | | **Data Exchange** | `exports:read` | View and download data exports | | | `exports:write` | Create data exports | | | `imports:read` | View import status and history | | | `imports:write` | Upload and run data imports | | **Analytics & Reporting** | `analytics:read` | View analytics and reports | | | `finance:read` | View financial reports | | **Communication** | `comms:read` | View SMS and email delivery logs | | | `comms:write` | Send SMS, email, and WhatsApp messages | | | `automations:read` | View automations, runs, approvals, and traces | | | `automations:write` | Create automations and trigger runs | | **Integrations** | `apps:read` | View connected applications | | | `apps:write` | Manage app connections | | | `webhooks:read` | View webhook endpoints | | | `webhooks:write` | Manage webhook endpoints | | | `integrations:read` | View integration status and sync logs | | | `integrations:write` | Activate, configure, and sync integrations | | | `events:read` | View webhook event logs | | | `events:write` | Resend and test webhook events | | | `sync:read` | View sync watermarks and state | | | `sync:write` | Update sync watermarks | ## Environments | Environment | Base URL | API Key Prefix | |-------------|----------|----------------| | **Staging** | `https://staging-api.revkeen.com/v2` | `rk_sandbox_*` | | **Production** | `https://api.revkeen.com/v2` | `rk_live_*` | ## Idempotency Include `Idempotency-Key` header (UUID) on mutation requests. Keys are valid for 24 hours. ## Rate Limits | Plan | Requests/min | Burst | |------|-------------|-------| | **Staging** | 100 | 200 | | **Production** | 1000 | 2000 | | **Enterprise** | Custom | Custom |

Go to Download

Idempotency key middleware for Yii3 APIs

Go to Download

Portable idempotency keys, immutable replay state and ledger ports.

Go to Download

Generate reproducible idempotency keys from any data format (JSON, XML, YAML, arrays, objects) regardless of key order

Go to Download

Safe request retries for Laravel APIs via the Idempotency-Key header.

Go to Download

The PostBoost REST API lets you publish, schedule, and analyze social media posts on every supported network from a single integration. No OAuth apps to maintain — PostBoost handles platform authorization for you. ## Base URL All workspace-scoped endpoints are prefixed with `/{workspaceUuid}`. Panel/admin endpoints are prefixed with `/panel`. ## Plan access Every workspace-scoped endpoint returns `403` when the workspace's plan does not include API access (capability `api`). ## Dates and times Post dates and times (`date`, `time`, `accounts_schedule`) are read in the request's `timezone` when one is given, otherwise in the workspace timezone. ## Idempotent requests Send an `Idempotency-Key` header (any unique string, for example a UUID) with a `POST`. Repeating the request with the same key within 24 hours returns the stored response with `Idempotent-Replayed: true` and creates nothing new. Reusing a key with a different body returns `422`; a request still in progress with the same key returns `409`. `5xx` and `429` responses are not stored, so they can be retried with the same key. ## Guardrails for automated clients Create and update requests are checked before anything is written: a post whose content matches one created for the same account in the last 24 hours returns `409` (`code: duplicate_post`, override with `allow_duplicate: true`), scheduling past an account's daily cap returns `429` (`code: account_daily_cap_reached`), and scheduling to an account that must be reconnected returns `422` (`code: account_unauthorized` or `account_token_missing`). Use `POST /{workspaceUuid}/posts/validate` for a dry run and `GET /{workspaceUuid}/activity` to review what API clients did. ## Authentication All requests require a Bearer token in the `Authorization` header. Generate tokens in your PostBoost dashboard under **Settings → Access Tokens**. ``` Authorization: Bearer YOUR_API_TOKEN ```

Go to Download

Welcome to the Svix API documentation! Useful links: [Homepage](https://www.svix.com) | [Support email](mailto:[email protected]) | [Blog](https://www.svix.com/blog/) | [Slack Community](https://www.svix.com/slack/) # Introduction This is the reference documentation and schemas for the [Svix webhook service](https://www.svix.com) API. For tutorials and other documentation please refer to [the documentation](https://docs.svix.com). ## Main concepts In Svix you have four important entities you will be interacting with: - `messages`: these are the webhooks being sent. They can have contents and a few other properties. - `application`: this is where `messages` are sent to. Usually you want to create one application for each user on your platform. - `endpoint`: endpoints are the URLs messages will be sent to. Each application can have multiple `endpoints` and each message sent to that application will be sent to all of them (unless they are not subscribed to the sent event type). - `event-type`: event types are identifiers denoting the type of the message being sent. Event types are primarily used to decide which events are sent to which endpoint. ## Authentication Get your authentication token (`AUTH_TOKEN`) from the [Svix dashboard](https://dashboard.svix.com) and use it as part of the `Authorization` header as such: `Authorization: Bearer ${AUTH_TOKEN}`. For more information on authentication, please refer to the [authentication token docs](https://docs.svix.com/api-keys). ## Code samples The code samples assume you already have the respective libraries installed and you know how to use them. For the latest information on how to do that, please refer to [the documentation](https://docs.svix.com/). ## Idempotency Svix supports [idempotency](https://en.wikipedia.org/wiki/Idempotence) for safely retrying requests without accidentally performing the same operation twice. This is useful when an API call is disrupted in transit and you do not receive a response. To perform an idempotent request, pass the idempotency key in the `Idempotency-Key` header to the request. The idempotency key should be a unique value generated by the client. You can create the key in however way you like, though we suggest using UUID v4, or any other string with enough entropy to avoid collisions. Svix's idempotency works by saving the resulting status code and body of the first request made for any given idempotency key for any successful request. Subsequent requests with the same key return the same result. Please note that idempotency is only supported for `POST` requests. ## Cross-Origin Resource Sharing This API features Cross-Origin Resource Sharing (CORS) implemented in compliance with [W3C spec](https://www.w3.org/TR/cors/). And that allows cross-domain communication from the browser. All responses have a wildcard same-origin which makes them completely public and accessible to everyone, including any code on any site.

Go to Download

Send documents for signature and follow them, from your own software. **Authentication.** Send `Authorization: Bearer `. Make keys in Settings → Developers → API keys and give each only the scopes it needs (there are 12 in all): `documents:read`, `documents:write`, `people:read`, `plays:read`, `plays:write`, `drafts:write`, `templates:read`, `templates:write`, `webhooks:read`, `webhooks:write`, `account:read`, `embedded:write`. A key that starts `dsk_test_` works in **test mode**: documents it sends are practice runs (emailed only to the sender, stamped TEST, never counted or billed), it can only see and act on test documents (any other document answers `404`), and it can sign them itself with `POST /api/v1/documents/{id}/test-sign`. A key can also be limited to a list of addresses, given an expiry, or made **draft-only**. **Draft-only keys.** A draft-only key can make and edit drafts but cannot send. Asking it to send answers `202` with an `approval`, the document stays a draft, and a person approves or declines in Settings → Developers → Approvals. Keys can also have a daily limit of drafts and sends; past it you get `429`. **Payments.** A template may contain payment fields (text tag `type=payment` with a set `amount`, optionally a `deposit`, or an amount you give when you send it with `amount=custom.`). The signer pays on Stripe's hosted page; the money goes to your own connected Stripe account; Docustay's fee is 2% on the Free plan and 0% on Pro, plus Stripe's own fees. The document's `payments` list shows each payment, its receipt and the fee. Card details never reach Docustay. **Idempotency.** Requests that create a document or a template, or send one, need an `Idempotency-Key` header (8–200 characters). Repeating a request with the same key and body returns the first answer instead of doing it twice. **Your own reference.** Documents and templates take `externalId` (your id for it) and `metadata` (up to 20 short key/value pairs). List with `externalId=` or `metadata[key]=value` to find them again, and both come back in webhooks. **Errors.** Every error is `{ "error": { "kind", "message", "requestId", "retryable" } }`. `kind` is one of `invalid`, `unauthenticated`, `forbidden`, `not_found`, `conflict`, `rate_limited`, `dependency`, `timeout`. Quote the `requestId` to support, or search it in Settings → Developers → API log. **Plan limits** are `403 forbidden` with `error.detail.code`: `plan_document_limit` (the plan's documents this month are used) or `plan_template_limit` (Free: 5 new templates a month; a new version of a template you have does not count). Both carry `detail.used`, `detail.limit` and `detail.resetsAt` (the first of next month, UTC). Everything already made keeps working. Pro and self-hosted installs have no template limit. **Rate limits.** Each key has its own per-minute budget. Every answer carries `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds); over the budget you get `429` with a `Retry-After` header. **Versions.** Every answer carries `Docustay-Version`, a date. A change that could break a caller gets a new date and is announced in the changelog before it ships; additions (a new field, a new route) are not breaking and do not change the date. **Pagination.** Lists take `limit` (1–200) and `cursor`; the answer carries `page.nextCursor` (null on the last page). **Signing links.** No response contains a signing link or access code, with one exception you control: a seat you send in `embedded` can be given an embedded signing session (`POST /api/v1/documents/{id}/embed-session`), a one-hour link for a frame on a website you listed. A key can start and follow a signature, and put your own signer in front of the form for seats you marked yourself; it cannot sign for anyone.

Go to Download

Idempotency-Key middleware for safe POST retries

Go to Download

HTTP request idempotency for Symfony using Idempotency-Key, request fingerprints, shared state, and Symfony Lock.

Go to Download

Composable PHP middleware helpers — security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, X-Content-Type-Options), CORS with preflight, CSRF, request-id, maintenance mode, rate limiting, idempotency keys. PSR-7 compatible, zero magic strings.

Go to Download

Official server-side SDK for the CryptoLike merchant API: signed requests, automatic Idempotency-Key, retries with backoff, webhook signature verification. PHP 7.4-8.x, no runtime dependencies, works without Composer (autoload.php).

Go to Download

Laravel middleware and drivers for handling Idempotency Keys (Cache, Database, Redis).

Go to Download

A Laravel library that manages idempotency keys for a request

Go to Download