An idempotency key that a consumer reused for a different body

A documented idempotency contract, and the first consumer to exercise the conflict case.

POST /api/v2/payments
Idempotency-Key: 6f0a8c2e-1d4b-7a91-b3c5-0e8f2a4d9b17
{ "amount": 4900 }

→ 201 Created

same key, different body:
{ "amount": 9800 }

→ 409 Conflict
  "This key was used with a different request body."

which is the documented behaviour, and the consumer's
bug: a key generated per customer rather than per
operation.

The conflict response is the part of an idempotency contract that has to be specified, because without it a client reusing a key silently receives the wrong stored response. Returning 409 with an explanation turned a silent double-charge into a support conversation that lasted one email, and the consumer’s key generation was the actual defect.