# Idempotency

`POST /gasless/submit` is the only POST endpoint. It can be sent again without creating a second trade.

## By trade hash

Every gasless trade has a `tradeHash`: the EIP-712 digest of `trade.eip712`, also returned as `trade.hash` by the quote.

| Same `tradeHash` sent again | Answer |
|---|---|
| From the same app | `200` with the same body `{ tradeHash, type, zid }` |
| From another app | `400 TRADE_ALREADY_SUBMITTED` |

A trade can be executed once: the Permit2 nonce inside the signature is spent by the trade.

## Idempotency-Key header

The optional header `Idempotency-Key` adds request-level replay:

- 1 to 64 visible ASCII characters (`^[\x21-\x7e]{1,64}$`).
- Kept for 24 hours per app.
- Same key and same body: the stored answer is returned.
- Same key and a different body: `400 IDEMPOTENCY_KEY_REUSED`.

A good key is the `tradeHash` without its `0x` prefix (64 hex characters), or your own order id.

```sh
curl -s https://api.qiguard.com/gasless/submit \
  -H "qg-api-key: $QG_API_KEY" -H "qg-version: v1" -H "content-type: application/json" \
  -H "Idempotency-Key: order-2026-10-24-0001" \
  --data @submit.json
```

## GET requests

All other endpoints are `GET` and change nothing, so they can be repeated at any time.