Optional idempotency token for authenticated POST and PATCH requests. Reusing the same key and body returns the cached response for 24 hours, except credential operations that explicitly document a 409 because one-time secret material is never cached; reusing it with a different body returns 409 IdempotencyKeyConflict. Use 1-255 printable ASCII characters.

Optimistic-concurrency precondition. On PATCH and lifecycle action POSTs against resources with mutable lifecycle (Invoice, Payable, PayrollRun, Credit, Deduction), supply the ETag returned on the most recent read. Mismatch yields 412 Precondition Failed. If-Match: * accepts any current ETag.

Select the Account for an Account-scoped operation. A direct ServiceAccount API key MUST supply this header, and the target must be within the ServiceAccount owner's or Authorization grant's Account boundary. A Person bearer may select an Account on which it has an active Stakeholder, and an Account session may select its bound Account (or a descendant only when the session explicitly includes descendants).

Generated from available response content types