I develop a custom module to store and retrieve users data from an API. I used the user entity hooks to call the API on registration, edition and consultation of the Drupal users.
It works well, and we use it on several website all using the same partner API.

To update or save the data, we use a POST method with the fields in the body and without URL parameters.

In some cases, when 2 users are registering or saving their account at the same time (max 3 seconds delay), then the information return in the POST response of the second call is the same as the first one.

Here is the method I’m using to call the API:

/**
 * Make the Calls to the API.
 *
 * @param string $function
 *   The API endpoint to call.
 * @param string $method
 *   The method (GET / POST / ...).
 * @param array $data
 *   The data to POST to the API.
 *
 * @return array
 *   Array of data from the API, can be empty if error or no results.
 */
public static function callApi($function, $method = 'GET', array $data = []) {
  $srv_url = 'https://someapi.com/';

  if ($srv_url === '/') {
    return FALSE;
  }

  $headers = [
    'Content-Type' => 'application/json;charset=UTF-8',
  ];

  $token = self::getToken($srv_url);
  if ($token === FALSE) {
    return FALSE;
  }
  elseif ($token !== TRUE) {
    $headers['Authorization'] = 'Bearer ' . $token;
  }

  $options = [
    'headers' => $headers,
  ];
  $full_url = $srv_url . $function;

  if ($method === 'POST') {
    $options['body'] = Json::encode($data);
  }
  else {
    $full_url .= '?' . UrlHelper::buildQuery($data);
  }

  try {
    $client = Drupal::httpClient();
    $mthd = strtolower($method);
    $response = $client->$mthd($full_url, $options);

    $statusCode = $response->getStatusCode();
    // Expected result.
    $jresp = Json::decode($response->getBody());

    // No result (GET).
    if ($statusCode == 204) {
      return [];
    }

    if (isset($jresp['code']) || !in_array($statusCode, [200, 201])) {
      // Something went wrong.
      $code = isset($jresp['code']) ? $jresp['code'] : $statusCode;
      if (isset($jresp['error'])) {
        $msg = $jresp['error'];
      }
      elseif (isset($jresp['message'])) {
        $msg = $jresp['message'];
      }
      else {
        $code = $statusCode;
        $msg = $response->getReasonPhrase() . '<br>' . $response->getBody()->getContents();
      }
      $message = "Response API {$method} - {$function} : {$code}<br>{$msg}<pre>" . print_r($response, TRUE) . '</pre>';
      Drupal::logger('mymodule')->error($message);
      return [];
    }

    // Log posted result.
    if ($method === 'POST' && $function === 'contact') {
      AtixTools::debug('atix_crm_cible', ["Result API {$method} - {$function}" => ['options' => $options, 'resp' => $jresp]]);
    }
    if (isset($jresp['body'])) {
      return $jresp['body'];
    }
    return $jresp;
  }
  catch (RequestException $e) {
    watchdog_exception('mymodule', $e);
  }

  return [];
}

Here are an example of two calls where the data have been mixed. In the arrays are the options used for the POST request and the Body answered by the API.

Array
(
    [options] => Array
        (
            [headers] => Array
                (
                    [Content-Type] => application/json;charset=UTF-8
                    [Cache-Control] => no-cache
                    [Authorization] => Bearer XXXXXXX
                )

            [body] => @"email":ttf-test54@yopmail.com,"sms":"","nom":"ttf-test54","prenom":"ttf-test54","date_de_naissance":"","code_postal":"","ville":"","langue":"fr","id_filiale":9
        )

    [resp] => Array
        (
            [0] => Array
                (
                    [langue] => fr
                    [nom] => ttf-test54
                    [upd_date] => 2021-08-26 14:18:22
                    [id_contact] => 53550
                    [prenom] => ttf-test54
                    [email] => ttf-test54@yopmail.com
                )
        )
)

The second one has the same answer

Array
(
    [options] => Array
        (
            [headers] => Array
                (
                    [Content-Type] => application/json;charset=UTF-8
                    [Cache-Control] => no-cache
                    [Authorization] => Bearer XXXXXXX
                )

            [body] => @"email":ttf-test55@yopmail.com,"sms":"","nom":"ttf-test55","prenom":"ttf-test55","date_de_naissance":"","code_postal":"","ville":"","langue":"fr","id_filiale":9
        )

    [resp] => Array
        (
            [0] => Array
                (
                    [langue] => fr
                    [nom] => ttf-test54
                    [upd_date] => 2021-08-26 14:18:22
                    [id_contact] => 53550
                    [prenom] => ttf-test54
                    [email] => ttf-test54@yopmail.com
                )
        )
)

The people from the API assure me their is no cache on the server side, specially for a POST. The API is developed just for this purpose and is hosted on AWS (Amazon).

How is it possible that 2 calls to the API using Guzzle from two web pages are giving back the same set of data ?
Is their a way Drupal or Guzzle are caching the response from the server ?

I looked a lot to find a solution to resolve this trouble, try using no cache header (like in this example), try reproducing it with Postman or a scenario in integromat without any success.

Thanks for some help.