Same key + same body replays the original response with Idempotent-Replay: true. Same key + different body is rejected with 422 idempotency_key_reuse. Concurrent identical requests: one runs, the rest get 409 request_in_progress.

If a request is rejected before any write (validation, not-found, duplicate reference), the key is released and immediately retryable. If it fails with uncertain completion (5xx, timeout, a failure after the write), the key is held — same-key retries return 409, and once the claim expires you are told to use a new key. This is deliberate: the API will never automatically re-run a mutation that may already have committed. Money endpoints add stronger guarantees on top (see Payment Links and Arrangements).