An Idempotency-Key header makes a retried POST safe
A client that times out does not know whether the order was created. With the header, it retries the same request with the same key and gets the same response instead of a second order.
POST /orders
Idempotency-Key: 4a7c…Store the key with the response for 24 hours. A repeat with the same key returns the stored response. The same key with a different body is a 422.
httpapi-design