Python, PHP and Go SDKs

Status. The three SDKs are package WP-54 (sdks/python, sdks/php, sdks/go, branch wp/WP-54-sdks-py-php-go, commit 3ecf821) and were not yet merged when this page was written. Nothing is uploaded to PyPI, Packagist or pkg.go.dev. No licence is chosen (UNLICENSED or proprietary placeholders: verify with the owner), and the package names (resilientlang, resilientlang/resilientlang, github.com/lawleys/language/sdks/go) are placeholders until the product name and domain are decided. There is no default API URL in any SDK; you always pass one. Install from the repository path for now.

They sit beside the JavaScript SDK, the rl CLI and the .NET client and behave the same way.

SDK	Page	Runtime	Dependencies
Python	Python quick start	3.9+	None (standard library); `cryptography` is an optional accelerator
PHP	PHP quick start	7.4+ and 8.x, `ext-sodium`	PSR-18, PSR-17 and PSR-7 interfaces only; bring your own HTTP client
Go	Go quick start	1.21+	None (`net/http`)

Every SDK has the same surface: sites, strings (single and batched submit), scan, translate, publish, jobs (get and wait), translations (list and manual override), glossary, usage and quota, export and import (file and JSON), secret keys (list, create, rotate, revoke), cursor pagination, a webhook signature verifier and a published-bundle verifier. /v1/discover is browser-only and is not wrapped. A test in each SDK walks openapi.json and fails when an operation has no client method.

Behaviour shared by all three#

Key handling. Only secret keys (rl_sec_live_..., rl_sec_test_...) are accepted. A site key (rl_site_...) is refused at construction without echoing the value. The key sits behind a redacting type (printing, JSON, var_dump, print_r, repr and Go's %v all show rl_sec_***), is sent only as Authorization: Bearer to the configured base URL, and never appears in an error message.
Transport safety. https is required (plain http only for localhost, 127.0.0.1 and ::1, or an explicit opt-in). Credentials in the URL are refused, redirects are never followed, and every attempt has a timeout.
Errors. One error type carries the status, the problem code, field errors, import issues, the extra problem members and the retry delay, with a plain-language hint for 402, 403 and 503. See SDK error handling.
Idempotency. Every write carries an Idempotency-Key: a v4 UUID generated once per call and reused across retries, or your own. Key creation and rotation never carry one, because the server never replays secrets.
Retries. 429 is always retried (the server refused it before doing work), honouring Retry-After up to a cap. 502, 503, 504 and network errors are retried only for GET and for writes that carry an Idempotency-Key. Backoff is exponential with jitter, 2 retries by default, and never after a 5xx on a key create or rotate.
Pagination. list_all, listAll and ListAll follow nextCursor with limit=100.

Tests (by the package's author; not re-run here)#

Each SDK runs offline against a local fake HTTP server plus the shared vectors, and has a suite that runs against a locally composed platform (nothing deployed). The three languages pass the shared signature and canonicalisation vectors. The default test commands are python3 -I -m unittest discover -s tests (Python), composer install && vendor/bin/phpunit (PHP) and go test -race ./... (Go).