Patch object

A unique key (UUID or any opaque string up to 255 chars) for an authenticated POST, PUT, or PATCH request. The server retains the initial claim for 24 hours and replays a completed non-5xx response only when the method, path, and request body all match. Reusing a non-expired key with a different method, path, or body returns 409 idempotency_key_mismatch; reusing it after expiry returns 409 idempotency_key_stale, so use a new key. Replays include the idempotent-replay: true response header.

Optimistic concurrency. Pass back the etag header from a previous GET of this record; the write only proceeds if the record hasn't changed since. Mismatch → 412 precondition_failed. Use * to require the record exists (any ETag accepted).