Loading documentation…
Loading documentation…
Diagnose missing outcomes, failed delivery and stream recovery safely.
Confirm the refresh was accepted in the same Project and reached a terminal state. Current/Live Page reads, rejected admission and intermediate retries do not produce these events. Check capture coverage and retained history. A delayed projection may appear later; the occurrence timestamp need not match its arrival time. Do not submit another paid refresh just to repair a missing notification.
Check the endpoint subscription and lifecycle at projection time. Pause-period events have no obligation for that endpoint. Read delivery detail and attempts: configured active is not proof of successful delivery, and health:null means unavailable counts rather than zero failures. Refresh delivery summaries separately from live event updates.
Verify unchanged raw bytes before JSON parsing. Check decoded base64url key material, key ID, timestamp within 300 seconds and the exact timestamp.id.body signing input. Do not include the attempt ID in that input. During rotation, accept either configured overlapping key. Reject duplicate/conflicting security headers. Incoming Paddle webhook verification uses a different protocol.
Your receiver may have committed before its response was lost. Inspect durable acceptance by event ID. Keep deduplication and retry/redrive safe; do not assume the business effect failed. Return 2xx after durable enqueue, then do slower work asynchronously. Never return success before the durable transaction.
Use a valid public HTTPS host and certificate, without credentials or query/fragment secrets. Mixed public/private DNS answers, rebinding, unsafe addresses and redirects are refused. Correct the destination; do not try to disable certificate or address checks. A destination update needs pause and no unresolved in-flight sends.
| Status | What to do |
|---|---|
| 401 | Obtain valid authentication; stop retrying the same expired/revoked credential |
403 event_scope_required | Grant explicit Events permission through existing Service Account management |
| 404 | Check Project ownership/path; foreign and missing resources are indistinguishable |
409 project_archived | Use allowed session history reads; an archived Project cannot stream |
410 event_recovery_required | Follow checkpoint-before-recovery handover |
422 invalid_event_cursor | Check cursor purpose/format; never move it to a query parameter |
| 429 | Respect bounded Retry-After and reduce concurrent readers |
| 503 | Preserve last applied progress; reconnect with bounded jitter |
Applicable Service Account network policy is enforced by shared authentication, including reconnect and periodic authority refresh. Do not interpret a policy denial as an empty feed or attempt to evade it with alternate origins. Customer-session recovery follows its own ownership checks.
The stream needs buffering and compression disabled, a read timeout longer than the heartbeat and graceful draining. A successful HTTP 200 alone does not prove frames are forwarded promptly. Reproduce with timestamped comment/event frames through the actual approved ingress; compare direct and proxied arrival without logging private data.
Record the UTC time, request ID, status, safe error code and relevant operation. Share only the minimum identifiers through the approved support channel. Do not include API keys, bearer tokens, signing secrets, signatures, raw payloads or receiver responses. See support.