Thanks @dave. I've seen a couple of hints towards Redis, but I'm not sure how that's meant to work when your primary persistence mechanism is some other technology like Postgres.
Is it something like:
1. Secure lock in Redis
2. Perform transaction in Postgres
3. Remove lock in Redis
If something goes wrong between 2. and 3., the client will retry the request, and hopefully remove the lock in Redis then, without repeating the transaction in Postgres.
Out of interest, how have you typically handled idempotency requirements for POST / PATCH requests?
Options I've seen / considered:
1. Don't bother, and just risk duplicate handlings of the request
2. Let the client generate the entity ID itself and have the database enforce uniqueness (although this case would better fit a PUT request)
3. Have some route level idempotency mechanism like the one I've described above.