SDK Delivery and Recovery
Definition
Your application chooses what to capture, how to redact it, how long to wait and how to retain source records. The SDK preserves captured data and logical batch identity during submission.
Fields, states, or lifecycle rules
| Acknowledgement | What it establishes |
|---|---|
Ingestor add / Add returns | A copied record is in memory |
| Submission returns a receipt | Durable server admission is known |
Receipt becomes processed | Processing finished; inspect all row counts |
Receipt is failed, cancelled or deleted | Terminal outcome to inspect |
Buffers are memory-only, with no disk outbox or crash-delivery guarantee. Keep original records until admission is known.
Immutable batches and retries
Prepare a batch once and retain its bytes and application-owned key. Transient 429, 502, 503, 504 and uncertain network failures retry identical bytes/key. Retry-After is honored independently of backoff. Permanent failures return directly.
Default retry counts and operation durations are uncapped unless the caller supplies limits or cancellation. Choose explicit application policies. A deadline stops the wait, not durable server work.
Python Batch.restore, TypeScript Batch.restore and Go RestoreBatch retain original bytes for caller-owned recovery. Keep these bytes secure. Re-encoding changed content under the same key can conflict.
Continuous ingestion and shutdown
Capacities default to uncapped; caller-selected capacities include in-flight rows and can apply backpressure. Automatic dispatch has no imposed delay. Explicit flush and close drain serially.
A failed batch remains pending and pauses automatic flushing. Inspect status/pending batch, correct the failure and retry flush or close. Close stops new input and scheduling, consumes an in-flight result and attempts to drain. A failed or timed-out close can be retried.
Receipt callbacks report admission, not processing. Return promptly. Python callbacks can run on background threads; callbacks must not close their own ingestor. Go callbacks run outside locks.
Privacy and errors
Select and redact captured content before submission; the SDK does not automatically scrub it. Keep keys on the server. HTTPS is required outside loopback; credentials do not follow redirects. SDKs do not emit telemetry or discover stored login credentials.
Inspect structured API errors and processing receipts. A processed batch can have rejected or conflicting rows; an unknown transport outcome is not a confirmed rejection.