What the SDK Sends

The exact fields the SDK transmits, what it never captures, and how to inspect every payload before you enable it.

This page is for engineers and security reviewers who need to know what leaves your servers. It describes SDK version 1.1.

The payload

Each request to POST /ingest carries one JSON object with an environment, an array of events and a small meta object:

json

{
  "environment": "PRODUCTION",
  "events": [
    {
      "method": "POST",
      "path": "/api/orders/:id/refund",
      "statusCode": 500,
      "responseTime": 412,
      "payloadSize": 0,
      "ip": "203.0.113.47",
      "userAgent": "okhttp/4.12.0",
      "timestamp": "2026-10-12T09:14:03.218Z",
      "consumer": "acct_4412",
      "errorType": "TimeoutError",
      "traceId": "4bf92f3577b34da6a3ce929d0e0e4736"
    }
  ],
  "meta": {
    "release": "2026.10.2",
    "service": "orders-api",
    "sdk": { "version": "1.1.0", "dropped": 0, "queued": 0, "sendFailures": 0 }
  }
}

The example is illustrative. The SDK uses the route template your framework reports (/api/orders/:id/refund) when it has one, so identifiers in URLs usually do not appear.

Field reference

| Field | Meaning | Always sent | | --- | --- | --- | | method | HTTP method | Yes | | path | Route template, or the request path without its query string. At most 256 characters | Yes | | statusCode | Response status. The Node.js SDK reports 499 when the client disconnects before the response finishes | Yes | | responseTime | Milliseconds from request start to response end | Yes | | payloadSize | The response Content-Length, or 0 when the response has none | Yes | | timestamp | When the response finished, as a UTC ISO 8601 string. Nolax shows it in West Africa Time (WAT) by default | Yes | | ip | Client IP address | Unless captureIp is false | | userAgent | The User-Agent header, at most 255 characters | Unless captureUserAgent is false | | consumer | The value your consumer callback returns, at most 64 characters | Only if you set the callback | | errorType | The class name of an exception the SDK caught, never its message | Only after a caught exception | | traceId | The 32-character trace id from a valid W3C traceparent header | Only if the request has one | | meta.release, meta.service | Values you configure, at most 64 characters each | Only if you set them | | meta.sdk | SDK version and counts of dropped events, queued events and failed sends since the previous batch | Yes |

What the SDK never captures

Request or response bodies
Query strings (everything after ? is removed)
Cookies, authorization headers and any other header except those listed below
Exception messages or stack traces

The SDK reads three request headers: User-Agent, traceparent (only the trace id is kept) and, if you configure ipHeader, that one header to find the client address.

Limiting what is sent

| Goal | Option | | --- | --- | | Do not send IP addresses | captureIp: false | | Do not send the User-Agent | captureUserAgent: false | | Skip health checks and similar routes | ignorePaths | | Skip methods such as OPTIONS | ignoreMethods | | Change or remove any field of any event | beforeSend |

beforeSend runs on each event before it is queued. Return the changed event, or nothing to drop it. If your callback throws, the event is dropped.

Inspect every payload first

Set dryRun and the SDK prints each batch, with the API key masked, and sends nothing. A reviewer can run the application, make requests and read exactly what would be transmitted.

Setting the environment variable NOLAX_DRY_RUN=1 does the same without a code change.

Where the data goes

Events go over HTTPS to the endpoint option, which defaults to https://server.nolax.net/ingest. The SDK does not follow redirects. See Batching and Retries for delivery behaviour.