Reliability
Circuit breaker
Stop hammering a destination that is down, and probe it until it recovers.
When a destination keeps failing, retrying every queued event only makes things worse for a service that is already struggling. The circuit breaker steps in, and steps back out when the service is healthy again.
States
- Closed. Deliveries flow normally.
- Open. After 10 failed attempts in a row, Ensue stops sending to that destination and notifies you (
destination.breaker_opened). Events keep queueing; they are not failed. - Probing. Ensue sends one trial delivery after 1 minute, then 5 minutes, 30 minutes, and then every hour. The first probe that succeeds closes the breaker and the queue drains (
destination.breaker_closed).
Events already scheduled for a retry keep their place and wait with the rest.
What counts, and what doesn’t
| Counts as a failure | Doesn’t count |
|---|---|
5xx, timeouts, network errors, and other answers that fail the attempt |
A 429, because the service is up and asking for less; the event’s backoff and Retry-After already handle it |
| A transformation that could not run, which says nothing about your service |
While the breaker is open, a 429 to a probe still counts as a failed probe.
Resetting by hand
If you have fixed the destination and don’t want to wait for the next probe, open it in the dashboard and choose Reset circuit breaker, or call:
curl -X POST https://api.getensue.com/v1/destinations/dst_…/breaker/reset \
-H "authorization: Bearer ens_<key>"Deliveries resume at once. A breaker can be reset by hand twice before a probe has to succeed on its own, so a destination that is still down cannot be forced open repeatedly. Changing the destination’s URL also resets the breaker, and does not use one of those resets.
A manual retry of a single event is sent immediately and acts as a probe.