Live sandbox

An API you can actually break.

This is a real HTTP service implementation, compiled down to JavaScript and running in this tab. No backend, no network calls — but the routing, status codes, idempotency store and rate limiter all behave the way they would in production. Try the same request twice, then open the network tab and notice nothing leaves your browser.

Requestno auth required

Endpoint

Request body

Send an Idempotency-Key header

Ctrl / Cmd + Enter sends. The limiter allows 5 requests per second per client.

Response idle —

// Send a request to see a response. // // Things worth trying: // 1. POST /v1/orders with the idempotency toggle on, // then press "Send twice" — the second call replays // the stored response instead of creating a second order. // 2. Turn the toggle off and press it again — now you // get two orders, which is exactly the bug idempotency // keys exist to prevent. // 3. Press "Burst ×6" and watch the 6th request get a 429 // with a Retry-After header.

— request log —

What this demonstrates

Three things clients get wrong.

Idempotency

A retried POST must not create a second order. Keys are stored with the response, not just the request.

Rate limiting

429 is a contract, not an accident: it carries Retry-After and the client is expected to honour it.

Pagination

Cursor-based, not offset. The response carries next_cursor so a page never shifts under you.

How the idempotency layer is written

The sandbox mirrors the pattern we use in production — a unique constraint on the key, the completed response stored alongside it, and an in-flight marker so two simultaneous retries don't both execute.

-- the row that makes retries safe
CREATE TABLE idempotency_keys (
  key           text        PRIMARY KEY,
  account_id    text        NOT NULL,
  request_hash  text        NOT NULL,
  status_code   int,
  response      jsonb,
  locked_until  timestamptz,
  created_at    timestamptz NOT NULL DEFAULT now()
);

Second request with the same key either replays response, or returns 409 while the first one is still in flight — never a duplicate side effect.

The full write-up, including the concurrent-retry case →