Errors and responses

Validate the request before retrying: a 4xx for a field, credential, or state requires correction. A 409 from reusing idempotency with a different body requires retrieving the original attempt. A 429 honors Retry-After. A 500, 502, timeout, or broken connection keeps the same key and retrieves before retrying.

Do not branch on message text; use the stable code and retain Request-Id for support. Never log PAN, CVC, tokens, secrets, credentials, or sensitive query parameters.

A provider response is not itself a Payment state. Only the Timbro resource and signed events close the lifecycle; an uncertain operation remains in recovery.