Send mobile events

The spike accepts Sentry envelopes through HTTPS. Synthetic Cocoa and Android fixtures test the wire format, not complete SDK integrations.

Send a raw envelope

Use the project ID and public key from your DSN. Send requests to the ingest host.

curl --request POST 'https://INGEST_HOST/api/PROJECT_ID/envelope/' \
  --header 'Content-Type: application/x-sentry-envelope' \
  --header 'X-Sentry-Auth: Sentry sentry_version=7, sentry_key=PUBLIC_KEY' \
  --data-binary @mobile.envelope

Create mobile.envelope with these contents. Include the final newline.

{}
{"type":"event"}
{"event_id":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","platform":"cocoa","level":"fatal","fingerprint":["ios","checkout-crash"],"exception":{"values":[{"type":"EXC_BAD_ACCESS","value":"Checkout crash"}]}}

Generate a new event ID for each event. Gzip and deflate compression are supported through Content-Encoding.

Use a stable client fingerprint until symbolication exists. Do not use the default marker as your custom fingerprint.

Native addresses and obfuscated names cannot provide reliable grouping. The spike does not process dSYM or ProGuard files.

The spike retains debug_meta as event data. It does not use that data for symbolication.

Minimize data before transmission

  • Remove names, email addresses, device identifiers, location data, and user content.
  • Remove credentials, request bodies, sensitive URLs, and private breadcrumb values.
  • Disable screenshots, attachments, session replay, and unnecessary device context.
  • Send only the error fields and log fields required for diagnosis.
  • Test the stored payload with synthetic data before you enable real traffic.

Server redaction filters credential fields and removes user IP addresses. It does not remove all personal data from text.

Treat the DSN as public

A mobile binary exposes its DSN. A DSN permits ingestion only. It does not permit reads or account access.

Use separate keys and projects for mobile and server sources. Revoke exposed keys when abuse occurs.

Limits and retries

Each source allows 15 requests per 10 seconds and 60 requests per minute. Source admission occurs before project request admission.

Request limits apply per Cloudflare location. Stored usage limits apply across locations.

Each key can consume 10% of each monthly organization allowance, with a minimum of one error.

Error allowances of zero or one retain the organization limit.

The source cap counts accepted errors and stored log bytes. Duplicate event IDs do not consume more errors.

Rejected source envelopes store no items. Key rotation creates a new allowance. These caps do not prevent abuse through multiple keys.

Project tiers limit accepted errors plus log entries in each UTC minute: mobile 60, standard 6000, server 60000.

The standard tier applies by default. Operators can set INGEST_PROJECT_TIERS to a JSON object.

{"mobile-project-id":"mobile","server-project-id":"server"}

Set this variable in the active Worker environment. Invalid configuration refuses ingestion with 503.

All existing request, byte, trial, and billing limits still apply. A higher tier does not increase those limits.

Use separate projects to prevent mobile traffic from consuming the server project rate allowance.

Limits return 429 with Retry-After and X-Sentry-Rate-Limits. Honor both headers and use bounded local buffering.

Source quotas return a one-hour retry delay. The allowance resets next month. Project limits return a 60-second delay.

Dropped items

The spike skips attachments and sessions. It stores neither crash attachments nor session statistics.

Unsupported envelope items are skipped. Supported event and log items in the same envelope can still be accepted.

Use POST /api/{project}/envelope/. The spike does not serve /e/errors or artifact uploads.