DocsTroubleshooting
Operations & Reliability

Webhook Troubleshooting & Debugging

Learn how to inspect incoming webhook payloads in real-time, interpret HTTP status codes, and debug issues between your automation tool (Zapier, GoHighLevel, Make) and Aevloc.

Live In-App Request Inspector

Every single API call made with your Agency keys is recorded in real-time with millisecond execution latency, HTTP response status, IP address, and payload inspection.

Common Status Codes & Solutions

401 UnauthorizedInvalid or Missing API Key

Possible causes: The Authorization header is missing, improperly formatted, or the key was revoked in your dashboard.

  • Ensure your header value starts with Bearer followed by a single space and your key (e.g. Bearer aev_live_...).
  • Verify that your API key is visible and labeled active in /admin/api.
422 Unprocessable EntityMissing Mandatory Fields

Possible causes: One or more required fields was blank, null, or missing in the JSON payload.

The 7 Mandatory Fields Checklist:
✓ name
✓ adminEmail
✓ shippingName
✓ shippingAddress
✓ shippingCity
✓ shippingState
✓ shippingZip
403 ForbiddenSub-Account Quota Exceeded

Cause: Your Agency subscription has reached its maximum allocated sub-account limit (default 100 client organizations).

Check your current sub-account count in the Admin dashboard. If needed, delete obsolete test accounts or contact support to expand your tier.

400 Bad RequestMalformed JSON

Cause: The incoming request could not be parsed as valid JSON.

  • Check for unescaped double quotes inside client business names (e.g. "Joe's "Famous" Subs").
  • Ensure there are no trailing commas after the final attribute in the JSON object.
  • Ensure the Content-Type: application/json header is present.

Pre-Flight Test with cURL

Before configuring complex Zapier or GoHighLevel automation branches, run this standalone test in your terminal to verify that your Agency API key is active:

Terminal Pre-Flight Test
curl -X POST https://aevloc.com/api/v1/agency/subaccounts \
  -H "Authorization: Bearer aev_live_YOUR_KEY_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Test Pizzeria",
    "adminEmail": "[email protected]",
    "shippingName": "Test Pizzeria (Attn: Manager)",
    "shippingAddress": "100 Main St",
    "shippingCity": "Austin",
    "shippingState": "TX",
    "shippingZip": "78701"
  }'

Security Invariants & Best Practices

Server-Side Only: Never embed your Agency Bearer tokens in client-side mobile apps or browser JavaScript. Webhooks by Zapier and GoHighLevel Workflows run securely on backend servers.
Instant Key Revocation: If an API key is accidentally exposed, immediately revoke it in /admin/api and generate a replacement key in one click.
Data Isolation Invariant: Client sub-accounts are strictly partitioned. Sub-accounts created via API are automatically assigned to your Agency organization and cannot access sibling client data.