October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix NowOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk9 min

How to Add Idempotency and Retries to Agent-Facing APIs

A practical design guide to server-side idempotency contracts and bounded client retries for agent-facing APIs—without promising exactly-once delivery.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

To make an agent-facing API safe to retry, define a server-side deduplication contract for mutations that could create duplicate effects, and give clients a bounded retry policy for failures the API identifies as transient. The key does not guarantee exactly-once delivery: it lets the service recognize the same logical operation within a defined scope and retention period. Because a timeout can occur after a mutation commits, the client must preserve the original key and request when retrying—and report an ambiguous outcome when it cannot establish what happened.

What idempotency guarantees—and what it does not

RFC 9110 defines an idempotent method by its intended effect: sending multiple identical requests has the same intended server effect as sending one. That does not require identical responses, nor does it prevent the server from logging each request or keeping separate request history.

As an Amazon Associate I earn from qualifying purchases.

HTTP method semantics are a useful starting point, not a substitute for an endpoint contract. RFC 9110 identifies safe methods, PUT, and DELETE as idempotent, but cautions clients against automatically retrying a non-idempotent request unless they know its semantics are idempotent or can determine that the original request was never applied. A POST that starts a workflow, sends a payment, or creates a resource can cause a second effect if an agent repeats it after losing the response. For such actions, explicitly define deduplication behavior.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

An idempotency key is a client-provided identifier for one logical operation. The server stores enough information to recognize a replay and apply the documented replay behavior. The client must keep using the same key for retries of that operation; a new key represents a different operation and can therefore permit another side effect.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Specify the server contract before clients retry

A key is useful only when both sides know how the service interprets it. Document the accepted key format, its scope, request matching rules, replay behavior, concurrency behavior, and retention period. These are API design choices, not universal HTTP rules.

Scope keys to the caller and operation

Associate a key with an authenticated principal or another explicit caller scope, the operation identity, and a fingerprint of the request parameters that affect the operation. This prevents an unrelated caller or endpoint from accidentally colliding with the same string. Define which request details are included in the fingerprint: semantically meaningful inputs belong in it; transport-only details should not turn a valid retry into a mismatch.

The precise storage schema and transaction pattern are implementation-specific. The contract should nevertheless make the effective scope understandable to clients and sufficiently narrow to avoid treating a different action as a replay.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Define matching and replay behavior

For the same key and matching request, return the saved outcome or a documented in-progress response. For the same key with different meaningful parameters, reject the request rather than silently treating it as a new operation. Stripe documents parameter comparison and an error for a mismatch as one concrete implementation; it is an example, not a general HTTP requirement.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

State what “saved outcome” means. An API might replay the original status and response body, or return a stable operation reference that the client can use to retrieve current status. The contract should explain what happens if the original operation is still running and what information a caller may use to resolve an uncertain result.

Make concurrent duplicates explicit

Two retries may arrive while the first request is still executing. Specify whether the second request waits, receives an in-progress response, or gets another documented result. Stripe says a request that conflicts with one already executing is not saved as an idempotent result and can be retried. Other APIs may choose differently; clients cannot safely infer the behavior from the presence of a key alone.

Publish retention and key limits

Deduplication is only as durable as the server’s record. Stripe says it may prune keys automatically after they are at least 24 hours old; reusing a pruned key can create a new request. That is Stripe’s policy, not a universal retention period. Publish your own retention window and tell clients not to reuse a key for a new logical action. If a client may retry after the record expires, it needs another recovery path, such as checking the operation’s status, rather than assuming the old key still protects it.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Stripe also documents a maximum key length of 255 characters. That is a Stripe-specific limit; set and document a limit if your API needs one instead of assuming the same limit applies elsewhere.

Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

Keep the operation record and side effect consistent

A dangerous failure is one in which the business side effect commits but the deduplication record does not, or vice versa. A later retry can then duplicate an effect or incorrectly report that it already happened. Design persistence and recovery so the recorded outcome cannot diverge silently from the actual mutation. The exact database transaction, outbox, or recovery mechanism depends on the system; there is no single implementation recipe established by the cited HTTP and vendor guidance. Test partial failures at the boundary between recording the key and performing the operation.

Implement the request lifecycle

The following sequence is a practical contract pattern, not a protocol mandated by HTTP. It makes the server’s decision points explicit and gives agent runtimes behavior they can reason about.

  1. Identify a logical action. The client creates one unique key for the intended mutation and retains it with the exact request inputs. It must not generate a fresh key merely because a response was delayed.
  2. Authenticate and establish scope. The server resolves the caller and operation identity before looking up the key. It should not let an untrusted caller use another principal’s key namespace.
  3. Look up the key and compare the request. If there is no record, the server reserves the key for the request. If a matching completed record exists, it follows the documented replay behavior. If the key exists with different semantic parameters, it rejects the mismatch.
  4. Handle an in-progress match. If another request with the same key is executing, the server returns the documented in-progress or conflict behavior. It must not accidentally start a second copy merely because the first has not yet written a completed result.
  5. Commit the mutation and outcome coherently. The service records enough information to recover or replay the result consistently with the side effect. On completion, the client receives the result or a stable operation reference.
  6. Expire records according to the published policy. After retention ends, the service may no longer recognize a reused key. Clients should use status recovery or a new deliberate action, not treat expired deduplication as indefinite protection.

Choose a bounded client retry policy

Retry only when the failure is transient according to the API contract, and only when the operation is inherently idempotent or protected by a valid key. The absence of a response is not proof that a mutation did not happen: the connection may have failed after the server committed it. If the operation is non-idempotent and has no deduplication mechanism, an agent should not blindly repeat it after an ambiguous timeout.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A useful policy has four inputs: retryable failure classification, delay and jitter, an attempt cap, and an overall deadline. Set them together. A high attempt limit is not safe if the operation can outlive the agent’s task deadline, and a generous deadline is not a reason to retry a permanent validation error.

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

Classify failures using the API’s contract

Document which failures are retryable for each endpoint. Transient service unavailability or throttling may be candidates; malformed requests, authorization failures, and semantic key mismatches generally require a change or intervention rather than repetition. There is no single universally correct retryable status-code list established by the sources here, so do not copy a generic list without checking the service’s behavior.

Distinguish a known rejection from an ambiguous result. A received response may say the server rejected the action; a timeout or dropped connection after sending the request may leave its outcome unknown. For an ambiguous result, retry with the same key or query the operation status if the API supports it. Do not create a new key simply to make the uncertainty disappear.

Use exponential backoff with jitter

Exponential backoff increases the wait after successive attempts; jitter randomizes that wait so many agents do not retry in synchrony. AWS SDK standard mode documents this formula: random(0, 1) × min(20,000 ms, base_delay × 2^retry). In that AWS-specific mode, the maximum backoff is 20 seconds, the transient-error base delay is 50 ms, and the throttling base delay is 1,000 ms. These are AWS SDK parameters, not universal recommendations; SDK, mode, and configuration matter.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Google Cloud IAM guidance describes truncated exponential backoff with a random component and a maximum-backoff cap. Both approaches illustrate the same useful controls: increase delay as retries accumulate, randomize it, and cap it. Choose the cap and base delay to fit your service contract and latency budget rather than importing a vendor’s numbers as defaults for every API.

Set attempt limits and an overall deadline

Stop when either the attempt budget or the caller’s deadline is exhausted. Google Cloud IAM guidance explicitly describes stopping after a deadline. AWS SDK standard mode also uses a retry quota that can be exhausted, at which point it fails fast. These are vendor-specific mechanisms; your API client should document its own limits and terminal behavior.

For agent runtimes, the deadline should fit inside the agent’s remaining task budget. Reserve time to return a useful result or perform a status check instead of spending the entire budget sleeping between attempts. The exact attempt count and deadline are service- and task-specific; the cited guidance does not establish one value suitable for all clients.

Honor Retry-After without outliving the deadline

RFC 9110 defines Retry-After as either an HTTP date or a non-negative number of seconds. On a 503 response, it indicates how long the service is expected to remain unavailable. Parse the header in either form, treat the specified delay as a minimum wait, and do not retry earlier than requested. If that wait exceeds the remaining deadline, stop and report the outcome instead of retrying forever. Where jitter is used, add it without reducing the server-requested minimum.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Return an actionable terminal result to the agent

When retries stop, the runtime needs more than “request failed.” It should preserve whether the operation is known to have succeeded, known to have failed, or remains ambiguous; state whether retrying is allowed; and include the operation or key reference needed to check status where available. This response shape is a design recommendation, not a standard-defined agent schema.

For example, a runtime can expose a structured result with fields such as outcome, retryable, operation_id, and retry_after. A timeout after sending a keyed mutation might be represented as an unknown outcome that is safe to resolve using the same operation identity. Avoid instructing an agent simply to “try again”: without the original key and an explicit retryability decision, that instruction can turn uncertainty into a duplicate side effect.

How the cited policies differ

The standards and vendor documents answer different questions. RFC 9110 establishes HTTP semantics and the meaning of Retry-After; it does not define a universal idempotency-key protocol. Stripe, AWS, and Google Cloud document implementation policies within their own products.

Source What it establishes Important boundary
RFC 9110 Idempotency concerns intended effect; clients should not automatically retry non-idempotent methods without a safety basis. Retry-After can be an HTTP date or delay in seconds. Does not prescribe an idempotency-key header, storage model, retention window, or universal status-code retry list.
Stripe API documentation One key-based policy: request parameter comparison, defined behavior for a concurrent conflict, automatic pruning once keys are at least 24 hours old, and a documented 255-character key maximum. These are Stripe behaviors, not general HTTP guarantees.
AWS SDK standard mode Exponential backoff with jitter, a 20-second maximum backoff, cited transient and throttling base delays, and a retry quota. Values and quota behavior are AWS SDK mode/configuration specific.
Google Cloud IAM guidance Truncated exponential backoff with jitter, a maximum-backoff cap, and stopping after a deadline. Does not establish one delay or attempt count for every API client.

Review the contract before shipping

  • Can the API say whether a repeated request is the same logical operation, and is the caller and operation scope clear?
  • Will a matching retry replay a saved outcome or return an explicitly documented in-progress result?
  • Does the server reject a reused key with changed semantic parameters?
  • Are concurrent duplicates and key expiry behavior documented, including the recovery path after retention?
  • Can the service keep the business mutation and its deduplication record consistent through partial failure?
  • Does the client retry only contractually transient failures, preserve the same key, honor Retry-After, and stop at an attempt cap or deadline?
  • Will the agent receive a terminal result that distinguishes known failure from an ambiguous outcome?

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.