Skip to main content
MasterID requires an Idempotency-Key header on POST /verifications and POST /collections. A valid key ensures that retried requests do not create duplicate operations, even if the original call timed out or returned an error.

When idempotency is required

GET requests are inherently safe and do not need an idempotency key.

Key format

The Idempotency-Key header must satisfy this pattern:
  • 8 to 100 characters
  • Allowed characters: letters, digits, period, underscore, colon, hyphen
Keys outside this range or containing other characters return HTTP 400.

Safe retry rule

Retry with the same key and identical JSON body. MasterID returns the saved outcome without starting a second operation. Never change the request body under a used key. If you need different input, generate a new key.

Conflicts (409)

If you reuse a key but change the request body, MasterID returns HTTP 409. Resolve this by either:
  1. Sending the exact same body again (safe retry), or
  2. Generating a new idempotency key (only if the change was intentional)

Interrupted requests

If a POST /verifications or POST /collections call is interrupted (network timeout, connection reset), the operation may already be processing. Because the outcome is unknown, do not create a duplicate with a new key. Instead:
  • Use the saved session ID or collection reference to poll for the result, or
  • Contact support with the request ID if you have it

Body size limit

The maximum JSON body is 20,000 characters. Requests exceeding this return HTTP 413.

Generate and persist keys

Generate a unique key for every new operation and store it alongside the returned reference so you can retry safely.
Persist the idempotency key before you send the request. If your server crashes mid-call, you can safely retry with the same key without creating duplicates.