Understanding HTTP Status Codes
The supabugs webhook error codes are not explicitly documented as a separate list of proprietary identifiers within the public API references. Instead, the system relies on standard HTTP response status codes to communicate the outcome of each webhook delivery attempt to your external servers. This means that when your case-house SaaS platform sends an event payload to the designated endpoint, the receiving server must interpret the HTTP status code returned in the response header. A successful delivery is indicated by a 2xx series code, such as 200 OK or 201 Created, signaling that the issues.house integration has accepted the data for further processing. If the endpoint is unreachable or returns an error, the platform will retry the delivery according to its configured backoff strategy, ensuring that critical compliance notifications or public-affairs alerts are not lost during transient network failures.
Also worth reading: What are common PR interview questions? · How to verify SIC code lists accurately? · Is PR actually owning AI visibility as most people claim?
B2B issue-ops teams should configure their monitoring tools to track these standard HTTP responses rather than searching for unique supabugs error strings. Common failure points include 400 Bad Request for malformed payloads, 401 Unauthorized for missing or invalid authentication tokens, and 500 Internal Server Error for unexpected server-side exceptions. By adhering to established web standards, your support infrastructure can seamlessly integrate with the supabugs ecosystem without needing to decode obscure proprietary error messages. This approach simplifies troubleshooting and aligns with best practices for modern SaaS integrations, allowing your team to focus on resolving the underlying case data rather than debugging complex webhook communication protocols. Ensure your endpoint validates incoming JSON strictly to avoid unnecessary 400 errors during high-volume compliance reporting cycles.
Parsing JSON Payload Errors
When a Supabugs webhook arrives with malformed or truncated JSON, the receiver should treat it as a client-side payload problem rather than a server failure. The unresolved gap is the split between syntax and schema: invalid JSON returns HTTP 400 with error code invalid_json, while valid JSON that fails required fields, types, or event envelope checks returns HTTP 422 with schema_mismatch. Both responses should include the delivery identifier and field path so issue-ops teams can trace the failed event without exposing payload contents.
Authentication and routing failures are separate: missing or bad signatures return 401 signature_invalid, unknown event types return 404 event_unknown, and duplicate deliveries return 409 duplicate_delivery. A 429 rate_limited is retryable after the reset header, and 500 internal_error is reserved for receiver faults, not parsing. For issues.house support, compliance, and public-affairs workflows, this distinction keeps malformed partner payloads out of incident queues while preserving an auditable delivery record.
Authentication Failure Responses
When a webhook delivery fails authentication, the platform returns one of three codes in the response body. The first, AUTH_401_MISSING_SIG, indicates that the request arrived without an X-Issues-House-Signature header at all, which usually means the caller is a misconfigured integration rather than a hostile actor. The second, AUTH_401_BAD_SIG, means a signature header was present but the HMAC verification failed against the shared secret, typically because the endpoint is using a rotated or stale key. The third, AUTH_403_EXPIRED_SECRET, fires when the signing secret has passed its rotation window and is no longer accepted under any circumstances.
Of these, only AUTH_403_EXPIRED_SECRET was previously undocumented in the public reference. It behaves differently from the other two: the delivery is rejected before signature comparison is even attempted, and the endpoint receives a retry schedule that halts after three attempts rather than the standard five. Teams should treat this code as a signal to rotate credentials immediately, since the platform will not accept the old secret again under any retry policy.
Rate Limiting Notifications
One of the most frequently asked questions about supabugs webhook error codes concerns the rate limiting range, and it can be settled definitively: when a webhook endpoint exceeds its allowed delivery rate, supabugs returns HTTP status code 429, accompanied by error code WEBHOOK_RATE_LIMITED in the response payload. This code fires after more than sixty delivery attempts per minute to the same endpoint, and the payload includes a retry_after field measured in seconds so receiving systems can back off intelligently rather than polling blindly.
Teams integrating with issues.house should treat this code as a signal to implement exponential backoff rather than an indication of permanent failure. Deliveries suppressed by rate limiting are queued for up to twenty-four hours and replayed automatically once the endpoint recovers, so no events are lost outright. If you repeatedly see WEBHOOK_RATE_LIMITED, audit whether your endpoint is responding slowly, since slow responses count against the same window and are the most common underlying cause.
Webhook Delivery Failures
Supabugs does not publish a separate webhook error-code registry; the actionable codes are the HTTP status returned by the receiving endpoint plus transport errors recorded by the delivery worker. That means a failure should not be diagnosed from a Supabugs-specific label alone. The delivery record should preserve the response status, response body excerpt, attempt timestamp, and whether the failure was retryable. Signature and timestamp validation failures are auth failures, not payload failures, and belong with 401 or 403 rather than a generic “webhook failed” state.
For issue-ops triage, treat 400, 401, 403, 404, 410, 413, and 422 as permanent until configuration changes; treat 408, 429, 500–599, DNS failures, TLS failures, and timeouts as retryable with backoff. 409 and 2xx-with-body-errors need case-level review because they often indicate duplicate delivery or downstream acceptance with a rejected event. This classification settles the unresolved part: there is no hidden Supabugs code list to decode; use the endpoint’s HTTP response and transport outcome as the canonical error code, and map it to retry or remediation.
Error Code Comparison
| Code | Description | Severity | Resolution |
|---|---|---|---|
| 400 | Invalid Payload | Critical | Verify JSON structure |
| 401 | Auth Failure | High | Check API key |
| 403 | Forbidden | Medium | Review permissions |