How to triage a repeatable webhook 500 without guessing

A 500 response tells you that a server-side path failed. It does not prove why. This checklist helps you preserve useful evidence, remove secrets, and decide whether the next step is classification, deeper diagnosis, or implementation.

Effective October 23, 2026

1. Freeze the failing path

Record one endpoint role, one triggering action, the observed status, whether the failure repeats, and the retry sequence. Do not broaden the task into a whole-system review before one path is reproducible.

2. Sanitize before sharing

Remove authorization headers, API keys, cookies, personal information, payment data, confidential payloads, internal hostnames, and unrelated request bodies. Replace stable identifiers with consistent placeholders only when the relationship between attempts matters.

3. Separate observations from hypotheses

• Observed: the retry used the same sanitized event identifier and returned HTTP 500.
• Unknown: whether a downstream write completed outside the supplied trace.
• Hypothesis: duplicate-state or idempotency handling may deserve the next controlled check.

4. Choose the smallest safe next check

1. Check the buyer-owned completion ledger for the sanitized event identifier.
2. Compare the first attempt and retry at the last confirmed successful boundary.
3. Reproduce against a non-production fixture with state-changing operations disabled.
4. Escalate only when the evidence supports a contained diagnosis or repair plan.

5. Know when classification is enough

If the immediate decision is “what category of failure is this, what evidence supports that classification, and what should we safely inspect next?”, the fixed-scope Workflow Health Check is the appropriate entry point. If you already have a reproducible path and need a tested repair recommendation, use Workflow Rescue instead.

What the $49 review delivers

One evidence-backed classification, cited trace observations, stated uncertainty, and the smallest safe next diagnostic step. It does not include production access, a patch, deployment, whole-system diagnosis, or a guaranteed resolution.

Inspect the synthetic sample · Describe one sanitized trace and review the $49 scope

Contact