Idempotent order writes

Every request that places, modifies, cancels or closes an order or position accepts an Idempotency-Key header: the MT5 routes under /api/external/instances/:accountId/{orders,positions} (including close-by-symbol), the broker routes POST/PUT/DELETE /api/external/brokers/.../orders, and the v2 writes under /api/v2/connections/:id/{orders,positions}. Use a new random value (a UUID) for each order, and reuse it when you retry that order. The official SDK does this for you.

curl -X POST "$ATLAS_BASE_URL/api/external/instances/12345678/orders" \
  -H "Authorization: Bearer $ATLAS_API_KEY" \
  -H "Idempotency-Key: 6f1c2a2e-1d0b-4c55-9b7c-0d6a8f3e2b11" \
  -H "Content-Type: application/json" \
  -d '{"symbol":"EURUSD","type":"BUY","volume":0.1}'

• A retry returns the first answer. Once the first request has reached the terminal, every request with the same key gets its stored response back, with the header Idempotent-Replayed: true, and nothing is sent again. This includes a 504: the outcome is still unknown, so check positions and orders before sending the order again under a new key.
• Concurrent duplicates are refused. While the first request is still running, another one with the same key gets 409 with code IDEMPOTENCY_IN_PROGRESS. Wait a moment and retry with the same key. If the first request never finished recording its outcome (more than 5 minutes ago), the key answers 504 with code OUTCOME_UNKNOWN: check positions and orders before sending the order again with a new key.
• Nothing sent, nothing stored. If the request failed before any order command reached the terminal (validation, terminal offline, runner unreachable, position not found), the key is released and a retry with it runs normally.
• One key, one request. The same key with a different method, path or body is refused with 422 and code IDEMPOTENCY_KEY_REUSED. The body is compared byte for byte, so a retry must resend the exact same bytes: keep the serialized body rather than re-serializing it (key order and whitespace count).
• Keys are 1 to 255 printable ASCII characters without spaces (400 otherwise), are scoped to your account, and are kept for 24 hours. If the key could not be recorded you get 503 with code IDEMPOTENCY_UNAVAILABLE and nothing is sent; retry with the same key.
• Without the header, order writes behave as before: every request is executed.