person or company must be provided (never both); requests violating this are rejected with 400 only one of person or company should be present.Idempotency-Key. Sending the header is not an error and has no effect: the request executes every time, and a retry creates a second record. Deduplication is the caller's responsibility. Account-number beneficiaries are not de-duplicated at all, so creating the same one twice silently produces two records (a pay_id is unique platform-wide, which is the asymmetry that catches people).