---
id: sdks.delivery
title: SDK Delivery and Recovery
summary: Understand batch identity, retries, memory buffering, shutdown and processing outcomes across SDKs.
kind: reference
product_area: developer_tools
status: stable
updated: 2026-10-31
canonical: /docs/sdks/delivery-and-recovery
---

# SDK Delivery and Recovery

## Definition

Your application chooses what to capture, how to redact it, how long to wait and how to retain source records. The SDK preserves captured data and logical batch identity during submission.

## Fields, states, or lifecycle rules

| Acknowledgement | What it establishes |
| --- | --- |
| Ingestor `add` / `Add` returns | A copied record is in memory |
| Submission returns a receipt | Durable server admission is known |
| Receipt becomes `processed` | Processing finished; inspect all row counts |
| Receipt is `failed`, `cancelled` or `deleted` | Terminal outcome to inspect |

Buffers are memory-only, with no disk outbox or crash-delivery guarantee. Keep original records until admission is known.

## Immutable batches and retries

Prepare a batch once and retain its bytes and application-owned key. Transient `429`, `502`, `503`, `504` and uncertain network failures retry identical bytes/key. `Retry-After` is honored independently of backoff. Permanent failures return directly.

Default retry counts and operation durations are uncapped unless the caller supplies limits or cancellation. Choose explicit application policies. A deadline stops the wait, not durable server work.

Python `Batch.restore`, TypeScript `Batch.restore` and Go `RestoreBatch` retain original bytes for caller-owned recovery. Keep these bytes secure. Re-encoding changed content under the same key can conflict.

## Continuous ingestion and shutdown

Capacities default to uncapped; caller-selected capacities include in-flight rows and can apply backpressure. Automatic dispatch has no imposed delay. Explicit flush and close drain serially.

A failed batch remains pending and pauses automatic flushing. Inspect status/pending batch, correct the failure and retry flush or close. Close stops new input and scheduling, consumes an in-flight result and attempts to drain. A failed or timed-out close can be retried.

Receipt callbacks report admission, not processing. Return promptly. Python callbacks can run on background threads; callbacks must not close their own ingestor. Go callbacks run outside locks.

## Privacy and errors

Select and redact captured content before submission; the SDK does not automatically scrub it. Keep keys on the server. HTTPS is required outside loopback; credentials do not follow redirects. SDKs do not emit telemetry or discover stored login credentials.

Inspect structured API errors and processing receipts. A processed batch can have rejected or conflicting rows; an unknown transport outcome is not a confirmed rejection.

## Related task pages

{% related-card-grid %}
- [Python](/docs/sdks/python)
- [TypeScript](/docs/sdks/typescript)
- [Go](/docs/sdks/go)
- [Fieldloop troubleshooting](/docs/troubleshooting/fieldloop)
{% /related-card-grid %}