Generation and release status
Versioned source packages are generated from the canonical OpenAPI contract for TypeScript, Python, Go, Java, Kotlin, .NET, PHP, Ruby, Rust, and Elixir. Every package includes the same high-level run, wait, retry, cancellation, export, and signed-webhook runtime contract.
Automatic OpenAPI synchronization
OpenAPI is the source of truth. Every contract change regenerates all ten SDK source packages with one pinned generator version, records the exact specification hash, and opens an automatic review pull request on the main branch.
- 1npm run sdk:generate regenerates every package locally
- 2npm run sdk:check fails when committed packages differ from OpenAPI
- 3GENERATION.json binds each package to the API version and SHA-256 digest
- 4The public manifest exposes package and file hashes for release verification
Package identities and support
| Ecosystem | Distribution | Namespace or import | Runtime target |
|---|---|---|---|
| TypeScript | @nordicdevhouse/sdk | @nordicdevhouse/sdk | Node.js 22+ on the server |
| Python | nordic-devhouse | nordic_devhouse | Python 3.11+ |
| Go | github.com/nordicdevhouse/nordicdevhouse-go | nordicdevhouse | Two latest stable Go releases |
| Java | com.nordicdevhouse:nordicdevhouse-java | com.nordicdevhouse.sdk | Java 21+ |
| Kotlin | com.nordicdevhouse:nordicdevhouse-kotlin | com.nordicdevhouse.sdk.kotlin | JVM / OkHttp |
| .NET | NordicDevhouse | NordicDevhouse | .NET 8+ |
| PHP | nordicdevhouse/sdk | NordicDevhouse\Sdk | PHP 8.2+ |
| Ruby | nordic_devhouse | NordicDevhouse | Maintained Ruby releases |
| Rust | nordic-devhouse | nordic_devhouse | Stable Rust with Tokio |
| Elixir | :nordic_devhouse | NordicDevhouse | Maintained Elixir and OTP releases |
Production defaults
| Concern | SDK behaviour |
|---|---|
| Credentials | Read the explicit apiKey option or NORDIC_DEVHOUSE_API_KEY; never expose keys to browser code |
| HTTP timeout | 30 seconds per network request; configurable per client and per call |
| Job wait | 10 minutes overall; polling observes server retry hints and accepts cancellation |
| Retries | At most 3 retries after the initial request for network failures, 408, 429, and 5xx with backoff and jitter |
| Idempotency | Create calls receive one SDK-generated key that is reused across automatic retries unless the caller supplies a stable key |
| Observability | Every result and error exposes request ID, job ID when available, attempt count, and SDK version |
Shared error model
Each language has one root error family and narrows only when recovery differs: exceptions where idiomatic, errors.Is/errors.As in Go, a non-exhaustive enum in Rust, and tagged tuples in Elixir. Authentication, permission, validation, rate-limit, timeout, network, server, and webhook-signature errors retain the server code and request ID.
| Error family | Automatic retry | Caller action |
|---|---|---|
| Authentication / permission | No | Replace credentials or change scope |
| Validation | No | Fix the request fields |
| Rate limit | Yes, within retry budget | Queue or slow work if retries are exhausted |
| Network / timeout / 5xx | Yes, within retry budget | Retry later or surface an operational failure |
| Webhook signature | No | Reject the event and inspect the raw body handling |
Versioning contract
SDK packages use semantic versioning. SDK major version 1 targets REST API v1. New optional fields and resources may be added in minor releases; removing fields, renaming operations, or changing default retry semantics requires a new major version. Each package ships the strongest native type metadata supported by its ecosystem.
- 1One documented deprecation cycle before a breaking removal
- 2Changelog entries identify SDK version, REST version, and migration action
- 3Unknown response fields are preserved or safely ignored
- 4Recorded HTTP fixtures keep all ten implementations behaviourally aligned
Implementation acceptance criteria
An SDK is ready to publish only when the interface in these docs passes contract tests against the same mock server and recorded API fixtures.
- 1Authentication and redaction tests prevent secret leakage
- 2Retry tests cover Retry-After, jitter, cancellation, and exhausted budgets
- 3Webhook test vectors cover valid, stale, and malformed signatures; callers can deduplicate verified event IDs to prevent replayed processing
- 4Every implementation passes the same job-state and error-mapping fixtures
- 5No official SDK sends API keys from browser or client-side application code