Diagnose missing deliveries, signature mismatches, timeouts, and duplicate processing.
Confirm the integration is installed for the correct inboxes and event types. Verify the callback is public HTTPS, follows no interactive authentication flow, and is not blocked by a firewall.
Log the event type, content length, encoding, and computed signature—not the secret. Confirm you sign
only the JSON-encoded data value and that your parser has not reordered or re-escaped it.
Return a 2xx after durable enqueueing instead of waiting for downstream APIs. Monitor latency,
queue depth, status codes, and receiver exceptions.
Assume delivery can repeat. Store a deduplication key before sending email, charging money, or updating another system.
Provide the webhook name, event type, conversation ID, approximate timestamp and timezone, callback status code, response time, and redacted headers to [email protected].