Which failure is the safest to retry automatically?

"A GET /products/42 that returned 503 Service Unavailable" is the safest to retry. A 503 means a temporary problem. A GET is idempotent, so running it again has no extra effect. So retrying with backoff is safe.

"A POST /charges with no idempotency key that timed out" is the dangerous one. The charge may have gone through before the timeout. Retrying without an idempotency key risks charging the customer twice.

The 400 Bad Request and 401 Unauthorized errors will fail the same way every time, so retrying them does not help.