Northstar is a fictional product. People, companies and scenarios in these field notes are illustrative.
The most expensive easy button
A retry button offers a comforting promise: do the same thing again and perhaps it will work. Sometimes that is exactly right. A short-lived service failure may disappear. But a retry can also repeat a business operation, exhaust a rate limit or obscure the first useful diagnostic event.
The operational question is not whether another attempt is possible. It is what new information makes another attempt justified. A useful integration interface puts the last response, environment and delivery state next to the action so the person deciding can answer that question.
Classify before acting
A 401 or 403 is usually a request to repair authorization. Repeating it unchanged will not grant permission. A 429 asks the caller to wait; Retry-After is an instruction, not an inconvenience. A transient 5xx may justify a bounded retry after checking the current operation state.
Timeouts require more care because they describe what the caller observed, not necessarily what the server did. The operation might have committed before the connection failed. Creating a new request can duplicate the effect precisely when the interface appears to be recovering.
Preserve the identity of the attempt
Idempotency gives a repeated request a stable identity. Reuse the same key with the same body after an uncertain response. The server can then return the original receipt. Change the body and you have a new intention, which needs a new key. A conflict should make you inspect the request, not randomly generate keys until one works.
This applies to the public Northstar forms as well as operational APIs. A second click should not become a second lead. The browser prevents concurrent submissions, while the server's idempotency contract protects the retry after a lost response. Both layers matter.
Bound the recovery loop
Northstar's current webhook policy allows five total attempts with increasing delays. Exhausting that budget produces a visible failed delivery that needs an explicit replay. The archived unlimited-retry guide remains available as a source-conflict test, clearly marked as superseded.
A bounded policy lets a team tell the difference between recovery in progress and work that needs a person. That is the practical goal: fewer blind attempts, clearer ownership and a receipt you can trust when the network stops cooperating.