Troubleshooting

Start with the Event in DeadHook, then inspect the Delivery and its latest Attempt. The HTTP status, result, and error usually identify the layer that failed.

Invalid webhook signature

Symptoms: 401 invalid_signature, or missing webhook-id / webhook-timestamp / webhook-signature (400 invalid_request).

Check:

1. You signed the raw bytes actually sent, not a re-serialized JSON object.
2. Standard Webhooks uses webhook-id + "." + timestamp + "." + body and a base64 HMAC.
3. The Source secret is the one for this Source; rotation keeps the old secret valid for only 24 hours.
4. The timestamp is within 300 seconds.
5. Your proxy did not rewrite the body or timestamp header.
6. The ingestion URL is from the intended Source, not another Project.

Do not disable verification to make a test pass.

Dashboard access

If you cannot see or change a resource, check that:

• you are signed in to the intended Organization;
• your role includes the action (for example, Viewers cannot replay or stop retries);
• the Project filter is not hiding the resource.

Dashboard access is managed through your Organization membership; it is not an ingestion credential.

Source not found or disabled

• 404 source_not_found: the ingestion URL does not match an available Source.
• 403 source_disabled: re-enable the Source. New requests are rejected; existing Deliveries continue.

Destination unavailable

Inspect the attempt:

• Timeout — Destination did not complete within its configured 1–30 second timeout.
• Network error — DNS, connection, or TLS transport failed.
• TLS certificate invalid — policy-blocked; fix the certificate chain.
• Blocked Destination — the URL resolved to a private, local, metadata, reserved, or non-HTTPS target, or a redirect was attempted.
• HTTP failure with 5xx/429 — retryable; check Destination health and rate limits.
• Terminal status with 3xx/4xx — DeadHook will not retry. Fix the endpoint, then replay.

DeadHook does not follow redirects. Use the final public HTTPS URL.

Duplicate incoming Event

• Same upstream ID + same body → 200 duplicate, same Event, no new Delivery.
• Same upstream ID + different body → 409 upstream_event_conflict.
• Different upstream ID + same body → a new Event by design.

For generic bearer, provide X-Event-ID if you need deduplication. Without it, body equality is not identity.

Plan limit reached

• 409 plan_limit_reached — the Organization's monthly accepted-Event quota is exhausted, or a Source/Destination/member resource limit was reached. Retrying immediately will not help.
• 429 rate_limited — the request rate limit was exceeded; honor Retry-After.

Check the Organization's billing page and usage. Do not assume a specific plan's limits from another workspace.

Delivery stopped or expired

• Stopped: automatic retries are terminal. An in-flight request may still complete.
• Expired: the Delivery deadline or Event retention elapsed. A replay may be unavailable if the raw payload is gone.
• Destination archived: restore the Destination before replaying.

Response body unavailable

Capture is opt-in. A response can be absent because:

• response capture was off at the time;
• the body was empty or unsupported;
• the snippet expired;
• the payload was purged.

Attempt metadata can remain even when the body is gone. Enable capture before reproducing the failure.

Replay unavailable

• Check the Delivery state; not every state can replay.
• Restore an archived Destination.
• A purged payload cannot be replayed.
• Check that your role includes replay permission.

Replay queues a new cycle; it does not guarantee success.

Still stuck

Collect the Event reference, Delivery reference, attempt number, timestamp, and the Destination status. Do not send Source or Destination secrets, webhook payloads containing personal data, or dashboard credentials. Open a support ticket from the dashboard if you need help.