Scope Idempotency Keys by Tenant
Bind idempotency records to the caller, tenant, operation, and request meaning.
An idempotency key is meant to make a retry safe. If the store uses the raw key alone, another tenant can collide with it and receive the first tenant's result or block its operation. The key needs a namespace that reflects the authorization context and operation. This is a design issue in shared API infrastructure, not only a payment concern.
Idempotency store contract
Record the key fields before implementation.
| Dimension | Why it matters |
|---|---|
| Tenant or account | Separates organizations |
| Caller or client where needed | Separates independent actors |
| Operation name and method | Prevents cross-function reuse |
| Resource owner | Binds target to permitted context |
| Request digest | Detects changed payload on retry |
| Expiry | Bounds stored results and replay |
Derive tenant and caller from verified authentication, not a client header. Store a digest of the relevant request shape, not a raw sensitive body. Decide whether a repeat returns the original result, a status, or a conflict when the payload changes. Never return a prior private response to a caller who has since lost permission without a documented current-access check.
Run collision tests
In an owned environment, have Tenant A and B use the same harmless key string for different synthetic operations. Both should remain isolated. Repeat an A request with the same body and confirm one side effect. Repeat it with a changed body and confirm the documented conflict. Remove A's permission and retry; record whether the service rechecks access before returning a stored result.
The OWASP Multi Tenant Security Cheat Sheet supplies the shared-resource boundary. The OWASP API Security Top 10 supports action-level authorization. The artifact is a store-key schema with these test cases. It does not prove the full endpoint is idempotent; verify downstream jobs and notifications too.
Check how long a stored response remains available. A previous result can contain private data after the caller loses access. Decide whether retries reauthorize before returning the saved body, then test that choice after role revocation and cache expiry.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.