Skip to content
DevSecure API

Idempotency

A network error can leave you unsure whether a request reached DevSecure. Operations that create or start something accept an Idempotency-Key header, so you can retry them without doing the work twice. They include starting scans, requesting autofixes, triage actions, exception and pentest-target requests, and creating webhooks.

Terminal window
curl -s https://api.devsecure.io/v1/scans \
  -H "Authorization: Bearer $DEVSECURE_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: nightly-acme-api-2026-10-01" \
  -d '{"type": "code", "repository_url": "https://github.com/acme/api", "branch": "main"}'
  • Key format. 1 to 255 characters of letters, digits, _, -, : and .. Use a UUID, or a name that is unique per action.
  • Same key, same request, within 24 hours: the first response is returned again, with Idempotent-Replayed: true. Nothing runs twice.
  • Same key, different request (another path or body): 409 idempotency_conflict.
  • Same key while the first request is still running: 409 idempotency_conflict. Retry a moment later.
  • Errors are not remembered. If the first request failed (4xx or 5xx), a retry with the same key runs again.
  • Scope. Keys are per credential. Two credentials can use the same key without affecting each other.
  • Secrets are never replayed. If the first response contained a new secret (for example a webhook signing secret), the replay returns null in its place. Store secrets from the first response.