What does "Uniqueness of the key MUST be defined by the resource owner" mean?

[darrelmiller]

The document states:

The idempotency key MUST be unique and MUST NOT be reused with another request with a different request payload.

Uniqueness of the key MUST be defined by the resource owner and MUST be implemented by the clients of the resource. It is RECOMMENDED that a UUID {{!RFC4122}} or a similar random identifier be used as an idempotency key.

If we were to remove the sentence "Uniqueness of the key MUST be defined by the resource owner and MUST be implemented by the clients of the resource." would the document be missing important information?

Looking at the first four existing implementations mentioned in the document, there appear to be no hard requirements on the format of the key. One stated that it had to be less than 36 characters, and one suggested using UUID. However, there doesn't seem to be any strict coordination needed. Also, a number of the services don't require the idempotency key to be sent. It appears to be an opt-in feature. The current wording in this document would seem to make those implementations non-compliant.

[mikekistler]

If "Uniqueness of the key MUST be defined by the resource owner" were removed, it seems that a resource owner could choose a non-obvious definition of "uniqueness", e.g. case-insensitive compare, that could cause unintended consequences for users.

How about:

Uniqueness of the key SHOULD be determined by exact character match of key OR MUST be defined by the resource owner

?

[sdatspun2]

If we were to remove the sentence "Uniqueness of the key MUST be defined by the resource owner and MUST be implemented by the clients of the resource." would the document be missing important information?

Key is one important component of the protocol between the resource owner and the client for idempotency. If key is not unique, that protocol breaks. Resource owners would not rely only on the key to determine uniqueness but they would assume its uniqueness and correlate the key with something like fingerprint of payload. Resource owners do not have to declare how they determine the fingerprint (or similar) but they do have to declare their assumptions behind uniqueness of the key that clients would provide.