An Idempotency-Key header makes a retried POST safe
A client that times out can't tell whether the order was created. With the header, it retries the same request with the same key and gets the same response back, not a second order.
POST /orders
Idempotency-Key: 4a7c…Store the key with the response for 24 hours. A repeat with the same key gets the stored response, and the same key with a different body gets a 422.
httpapi-design