REST API & Webhook Errors

Understanding API errors

API integration errors are usually a contract mismatch: the client and the server disagree about authentication, encoding, size limits, or which version of the API is in play. Because most API clients swallow the response body and surface only the status code, the single highest-value debugging habit here is to log the full response, headers included, before you touch any code.

How to debug API errors

1. Reproduce the failing call with curl -v outside your application. If curl succeeds and your client fails, the bug is in your client's header or serialisation layer, not on the server.
2. Print the exact Authorization header being sent (redact the secret, keep the prefix). A missing Bearer  prefix and a trailing newline from an environment file are the two most common causes of a mystery 401.
3. Check for an intermediate proxy. A 413 or 502 from nginx, Cloudflare or an API gateway looks identical to one from your application, but is fixed in completely different config.
4. For webhooks, verify the signature against the raw request body. Any middleware that parses and re-serialises JSON before your handler runs will silently break HMAC verification.
5. Confirm the API version. Deprecation errors and unexpected schema changes almost always trace back to a pinned version header that was never updated, or one that was never pinned at all.

Tools worth reaching for

• curl -v
• httpie
• Postman/Bruno
• mitmproxy
• ngrok (for webhooks)

All 20 API errors

• API Gateway 413: Payload too largeRequest body exceeds API Gateway/Lambda payload limits (10MB REST, 6MB HTTP API by default).
• API: Bearer token missing or malformedAPI requires Bearer token in Authorisation header but token is missing or invalid format.
• API: CORS preflight request failedBrowser sent OPTIONS preflight but server returned error. Need to handle OPTIONS requests.
• API: Endpoint deprecatedAPI endpoint is deprecated and will be removed. Need to migrate to new version.
• API: HTTP method override not workingSome proxies/firewalls block PUT/PATCH/DELETE. Need to use X-HTTP-Method-Override header.
• API: Idempotency key conflictSame idempotency key used with different request parameters. Indicates duplicate or conflicting request.
• API: JSON schema validation failedRequest body doesn't match expected JSON schema. Missing required fields or wrong types.
• API: Rate limit exceeded (per minute)Too many API requests in the last minute. Need to implement rate limiting or backoff.
• API: Request payload too largeAPI request body exceeds maximum allowed size. Need to reduce payload or use chunking.
• API: Webhook signature verification failedWebhook payload signature doesn't match computed signature. Possible tampering or wrong secret.
• Discord API: 50013 Missing Permissions NewThe bot is in the server but lacks a permission for this action in this place. Discord evaluates role permissions and…
• GitHub API: You have exceeded a secondary rate limit NewSeparate from the hourly primary quota, GitHub applies secondary limits on burst concurrency, content-creating…
• Google API: Request had insufficient authentication scopes (403) NewThe token is valid, but it was minted without the OAuth scope this method needs. IAM roles can be perfectly correct…
• GraphQL: Query complexity exceededGraphQL query too complex and exceeds server limits. Reduce nesting or field count.
• Microsoft Graph: Authorization_RequestDenied, Insufficient privileges NewThe app's token lacks the Graph permission this call needs. Usually it was added in the portal but admin consent was…
• Slack API: not_in_channel NewThe bot token is valid and has chat:write, but the app has not been added to the channel it is posting to. Slack…
• Stripe: card_declinedThe issuing bank refused the charge. The decline_code provides the actionable reason, such as insufficient_funds…
• Stripe: No such customer; a similar object exists in test mode NewThe ID is real, but it belongs to the other mode. Test and live data in Stripe are entirely separate, so an ID saved…
• Stripe: Webhook signature verification failedThe Stripe-Signature header does not match the raw request body and endpoint secret. Usually JSON middleware modified…
• Twilio 21608: Trial accounts cannot send messages to unverified numbers NewThe request is fine; the account is still on a trial, and trials may only message numbers verified on that account. It…

Other categories

• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Ansible 18Unreachable hosts, become passwords, undefined variables and Jinja2 failures.
• Apple 20Command line tools, dyld, Homebrew permissions, notarisation and Keychain.
• Auth 20OIDC, SAML, Auth0, Okta, Keycloak, passkeys and MFA failures.
• BigData 17Spark, Kafka, Airflow, Snowflake, Flink and Databricks failures.
• C# 18NuGet restore, null references, EF Core migrations, async deadlocks and Blazor…
• C++ 20Segfaults, linker errors, memory corruption and template deduction failures.
• Caching 20Cache stampedes, stale content, Varnish and CloudFront failures.
• CI/CD 18GitHub Actions, GitLab CI, Jenkins, CircleCI: permissions, runners and…
• Client 21CORS, mixed content, module resolution, memory limits and framework runtime…
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Dart 20Null safety, pub version solving and build toolchain problems.
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• DNS 20NXDOMAIN, SERVFAIL, timeouts, propagation and delegation problems.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• Elixir 18GenServer timeouts, supervision failures and Mix compilation problems.
• Email 20Delivery failures, relay denial, authentication, SPF, DKIM and DMARC.
• Frontend 23Hydration mismatches, bundler resolution, layout shift and font loading.
• Git 20Merge conflicts, rejected pushes, detached HEAD, LFS and repository corruption.
• Go 19Nil map assignment, concurrent map access, context cancellation and deadlocks.
• GraphQL 19Validation, depth limits, N+1 queries and fragment problems.
• gRPC 17Status codes, deadlines, message limits, TLS and HTTP/2 transport failures.
• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• ICMP 23Destination unreachable, time exceeded, fragmentation needed and redirects.
• Ingress 20404 default backend, missing TLS secrets, IngressClass and path matching.
• Java 19Class loading, dependency resolution, connection pools and JVM version…
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Logging 18Log4j, Logback, Fluentd, Logstash and CloudWatch ingestion problems.
• MessageQueue 20Kafka, RabbitMQ, SQS, NATS and Celery: lag, rebalancing and poison messages.
• Mobile 20Gradle, CocoaPods, Xcode signing, Metro bundler and toolchain mismatches.
• Monitoring 18Prometheus scrapes, Grafana data sources, OpenTelemetry exporters and agent…
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Performance 19GC pauses, thread pool starvation and event loop blocking.
• PHP 20Memory limits, execution timeouts, autoloading, Composer and PDO connections.
• Proxy 20nginx, Envoy, HAProxy, Traefik, Caddy and Cloudflare upstream failures.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Regex 17Catastrophic backtracking, back references, escaping and engine differences.
• Ruby 20Bundler, migrations, native extensions, encoding and asset compilation.
• Rust 19Borrow checker, ownership moves, trait bounds and lifetime mismatches.
• Scala 17Dependency resolution, binary compatibility and type inference failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• Serverless 20Lambda timeouts, package size limits, VPC networking and cold starts.
• Shell 19Command not found, permissions, quoting, expansion and Makefile syntax.
• Storage 19S3 permissions, NFS mounts, quotas, signed URLs and volume attachment.
• Svelte 20Store subscriptions, load functions and server/client boundaries.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Terraform 18State locks, provider auth, drift, dependency cycles and plan-time unknowns.
• Testing 18Jest, pytest, JUnit, Cypress and Playwright: fixtures, snapshots and timeouts.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
• TypeScript 19Assignability, missing declarations, strict null checks and generic constraints.
• Virtualization 20VirtualBox, VMware, Hyper-V, WSL, KVM and hypervisor conflicts.
• Web3 17Gas estimation, nonce management and reverted transactions.
• WebAssembly 17Compile errors, memory bounds and host binding mismatches.
• WebServer 20nginx, Apache, IIS and Caddy: binding, permissions, rewrites and TLS.
• Windows 20Installer failures, missing runtimes, update errors and permission problems.