Summary: Payment Instrument Mandates and idempotency errors aligned with the API Design Principles

Payment Instrument Mandates

Updated: SCA field limits, idempotency key rejection on /confirm and /cancel, and status=*

Following up on an internal API Design Principles review:

• sca.client_credential_id and sca.signature on POST .../payment_instrument_mandates/{id}/confirm now document maxLength (255 and 2048 respectively).
• POST .../payment_instrument_mandates/{id}/confirm and .../cancel now document 400 when an Idempotency-Key header is sent, since these endpoints don't support one.
• GET .../payment_instrument_mandates now documents status=* to return every status, the same as omitting status.

Idempotency

Changed: Idempotency key conflicts now return 400 instead of 422

Reusing an Idempotency-Key with a different payload or endpoint, or sending a key over 100 characters, now returns 400 Bad Request instead of 422 Unprocessable Entity, matching the idempotency guide error semantics. This affects POST /accounts/{account_id}/orders and payment instrument mandates.