Why fail-open?
As a billing engine, Autumn sits in the critical path of your application. If your app callscheck() to gate access to a feature, and Autumn is unreachable, that call would throw an error — effectively blocking your users from accessing your product.
Fail-open ensures your users are never blocked by an Autumn outage. Usage events may be lost during the outage, but your customers stay unaffected.
Behavior
Fail-open is enabled by default. When Autumn is unreachable (network errors, timeouts, or server errors returning 5XX status codes), the SDK returns safe defaults:
Customer and entity operations, including
customers.getOrCreate(), customers.get(), entities.get(), and entities.create(), propagate errors even when fail-open is enabled. Only check() and track() return fail-open defaults.
When fail-open triggers
Fail-open activates when the SDK encounters:- Server errors — Autumn returns a 5XX status code (500, 502, 503, etc.)
- Network failures — DNS resolution failure, connection refused, connection reset
- Timeouts — The request to Autumn times out
Configuration
Disabling fail-open
If you prefer strict error handling and want all Autumn errors to propagate:Detecting fail-open responses
Whencheck() fails open, the response will have allowed: true with empty values: