Retrying safely

A GET can be repeated freely. For a POST, send an Idempotency-Key header — any unique string of up to 255 characters, a UUID is ideal — and the call will happen at most once however many times you send it:

Idempotency-Key: 8f14e45f-ea6a-4cbb-9a2f-3d1c0b7e21aa

Retry with the same key and the same body and you get the first call's response back, with Idempotent-Replay: true. Nothing runs twice.
The same key with a different body is rejected with 409 idempotency_key_reuse. Generate a key per logical operation, not per process.
A call that failed doesn't hold its key: retrying it runs again, which is what you want after a timeout or a 5xx.
Keys are remembered for 24 hours.

Without the header a retried POST runs again in full. On POST /organization/keys that means a second key you were only ever shown the secret for once, so send the header.

Retrying safely

Idempotency-Key: 8f14e45f-ea6a-4cbb-9a2f-3d1c0b7e21aa

Retry with the same key and the same body and you get the first call's response back, with Idempotent-Replay: true. Nothing runs twice.
The same key with a different body is rejected with 409 idempotency_key_reuse. Generate a key per logical operation, not per process.
A call that failed doesn't hold its key: retrying it runs again, which is what you want after a timeout or a 5xx.
Keys are remembered for 24 hours.

Without the header a retried POST runs again in full. On POST /organization/keys that means a second key you were only ever shown the secret for once, so send the header.