BPN does not standardize an Idempotency-Keyheader across the platform. Except for the Wallet
deposit-whitelist APIs listed below, merchants must use the business fields in this table. Treat it as a
stable contract.
| Product | Key | Endpoint | Required? |
|---|---|---|---|
| Convert | merchantOrderId | POST /v1/stable/order/submit-order | Strongly required for integration |
| Wallet Withdraw | requestId | POST /v1/wallet/withdraw | Yes (fund safety) |
| Wallet Transfer | requestId | POST /v1/wallet/transfer | Recommended |
| Wallet deposit whitelist | Idempotency-Key header (plus requestId in the body) | deposit-whitelist addresses / disable / submit | Yes on every write |
| VA Payout | requestId (exact VO name) | POST /v1/virtual-account/order/payout | Required |
| Payment Link | requestId | POST /v1/stable/collect/create-payment-link | Optional |
| Collect v2 (non-core) | requestId | accept / reject / usd-payout | Per API |
| Partner (separate OAS) | request_id / partner_order_id | /api/v1/* | Do not mix with merchant APIs |
processing: do not change the key; poll detail or wait for webhook.success / fail: do not retry the same key expecting a different outcome.requestId to identify a Payment Link create request. When the outcome is unknown, retry with the samerequestId. A duplicate returns ODR00000040 rather than the original create result. QueryPOST /v1/stable/collect/payment-links with the same requestId to recover the Payment Link.| Type | Rule |
|---|---|
| Amounts | Decimal string (e.g. "100.50"), never JSON float |
| Timestamps | Epoch milliseconds integer |
requestId | UUID recommended |
Idempotency-Key request header. Reuse the same key when10000105 means the platform recognised a duplicate; read the outcome of the first10000104 is not a timeout. Poll GET /v1/wallet/transaction/detail