pagerduty incident webhook 400: invalid event action

Not specified by the original author.

TL;DR

A 400 for invalid event action means the payload's action field is not one of trigger, acknowledge, or resolve: usually a typo, a v1 action sent to the v2 endpoint, or a custom value the API does not accept. Send only the documented actions, validate the payload before sending, and use dedup keys so retries do not create duplicate incidents. The action vocabulary is tiny; the fix is spelling it right.

The query

pagerduty incident webhook 400: invalid event action

Use this when

• PagerDuty event webhooks return 400
• Incidents fail to trigger from webhooks
• You are building PagerDuty integrations
• Migrating from Events API v1 to v2

Not for

• On-call schedule design
• Escalation policy configuration
• Incident response runbooks
• PagerDuty pricing or plans

Steps

1. Check the action value against the v2 vocabulary

The Events API v2 accepts exactly trigger, acknowledge, and resolve. Anything else 400s. Compare your payload's action character by character; typos and v1-era values are the usual culprits.

Expected output: action value matching the documented vocabulary.

2. Confirm you are hitting the v2 endpoint

v1 and v2 have different payload shapes and endpoints. A v1-shaped payload (or v1 action values) sent to v2 fails. Verify the endpoint URL and the payload schema version match.

Expected output: endpoint and payload schema version aligned.

3. Validate payloads before sending

Run outbound payloads through a schema check: required fields present, action in vocabulary, routing key valid. Pre-send validation catches the typo locally with a clear message instead of a bare 400.

Expected output: pre-send validation on every event payload.

4. Use dedup keys for trigger idempotency

Include a stable dedup_key so retries and duplicate sends update the same incident instead of opening new ones. Without it, a retried trigger after a 400 fix creates a duplicate incident.

Expected output: dedup keys on all trigger events.

5. Log the full 400 response body

PagerDuty's 400 body names the offending field. Log it on every failure; the body turns "invalid event action" from a mystery into a one-line fix. Keep the log queryable for integration debugging.

Expected output: 400 bodies logged with field-level detail.

Template: the checklist

PagerDuty event action fix:
[ ] Action value in the v2 vocabulary (trigger/acknowledge/resolve)
[ ] Endpoint version matching payload schema
[ ] Pre-send payload validation
[ ] Dedup keys on trigger events
[ ] 400 response bodies logged

Variant phrasings

pagerduty webhook 400 bad request

Steps 1 and 5. Check the action, read the body.

invalid event action pagerduty

Step 1 as the direct fix.

pagerduty events api v2 payload rejected

Steps 2 and 3. Version alignment plus validation.

Why it happens

The Events API went through a v1-to-v2 migration that changed the payload shape, and integrations get built from mixed documentation: a v2 endpoint with a v1-era example, or a hand-rolled payload with a plausible-but-wrong action like "create" or "fire." The API's vocabulary is deliberately small, so almost every 400 is a vocabulary mismatch, not a deep bug.

Edge cases

• Custom actions in change events: change events have their own schema; do not mix incident actions into them.
• Acknowledge on untriggered incidents: valid action, but nothing to acknowledge. Handle the no-op gracefully.
• Routing key versus integration key: the wrong key 400s differently. Verify which key the error names.
• Retried triggers after fixing: the dedup key prevents the retry from doubling the incident. Always include it.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_BhJ2BMfRe7nlvc4oJedYsg

Resolved from the public thread: https://vectle.com/posts/pst_BhJ2BMfRe7nlvc4oJedYsg

Thread query: pagerduty incident webhook 400: invalid event action

TL;DR: A 400 for invalid event action means the payload's action field is not one of trigger, acknowledge, or resolve: usually a typo, a v1 action sent to the v2 endpoint, or a custom value the API does not accept. Send only the documented actions, validate the payload before sending, and use dedup keys so retries do not create duplicate incidents. The action vocabulary is tiny; the fix is spelling it right.

Not specified by the original author.

TL;DR

Check the webhook delivery log in PagerDuty, confirm the Statuspage endpoint and credentials the bridge uses, and replay one failed delivery to see the current response. Do this before posting workarounds to customers: confirm the fault in PagerDuty to Statuspage integration, fix the single mismatched value or setting described in the steps, then repeat the original action and check the public page as a logged-out visitor. Most cases of this error are a configuration or value mismatch in webhook bridge between PagerDuty and Statuspage, not a provider outage, so a methodical check clears it in minutes.

PagerDuty to Statuspage integration failed: webhook returned 500 error troubleshooting

Use this when

• The exact error above appears while working with webhook bridge between PagerDuty and Statuspage during an incident or a test incident.
• The public status page does not reflect what responders saved in PagerDuty to Statuspage integration.
• An automation, integration, or responder hits this failure repeatedly with the same payload or setting.
• You need customer communication moving again and have admin access to the status page.

Not for this skill when

• PagerDuty to Statuspage integration reports a confirmed platform outage on its own status page. Wait for the provider and post a holding update instead.
• You are designing a new status page or choosing between providers. This skill only repairs the named failure.
• The failure is in the underlying product outage itself, not in status communication. Fix the product incident first.

Steps

1. Reproduce the failure once and capture the exact request, response, and timestamp from PagerDuty to Statuspage integration. Note the page id, component or incident id, and the account or automation that sent the request, because most status page faults are scoped to one page or one credential. Verify: you have the full error body saved, not just a status code screenshot
2. Open the PagerDuty webhook delivery history and record the failing payload and response. Work in the admin console or with a read-only API call first so you do not change customer-visible state while diagnosing. Verify: the setting or value you found matches what the automation believes it is using, or you have identified the exact mismatch
3. Verify the bridge still points at the correct Statuspage page and component mapping. Change one thing at a time and keep the previous value noted so you can roll back if the incident is live. Verify: the change is saved in PagerDuty to Statuspage integration and visible on a fresh page load, not only in the editor
4. Replay a single test incident and confirm one clean delivery end to end. Prefer the smallest customer-safe test: a test incident, a test subscriber, or a staging page where one exists. Verify: the test produces the expected public result without touching the live incident
5. Repeat the original failing action exactly as the responder or automation performed it, using the same account, page, and payload shape with the corrected values. Verify: the action succeeds and the public status page shows the intended state to a logged-out visitor
6. Record what changed in the incident log or runbook: the faulty value, the corrected value, and where the automation reads it from. Add a pre-incident check for this setting to the responder checklist if the failure blocked comms during a live outage. Verify: the runbook entry exists and the next on-call can find the check in under a minute

Why it happens

A 500 from the bridge usually means the downstream Statuspage call failed (bad page id, revoked key, or invalid status mapping) and the bridge collapsed it into a generic server error. The failure tends to surface mid-incident because that is when new automations, new responders, and new values meet the page for the first time under time pressure. Configuration that was copied from another page, another provider, or a test environment carries values the live page does not accept, and the error message usually names the symptom rather than the mismatched setting. Treating it as a value or permission mismatch, and checking the live page configuration against what the sender used, resolves the great majority of cases without provider support.

Variants and edge cases

PagerDuty to Statuspage integration failed - variant with a different tool in the chain

The same failure arriving through an integration (for example a bridge from an incident tool) instead of the admin console. Diagnose on the PagerDuty to Statuspage integration side first, because the bridge usually collapses the real error into a generic one, then fix the mapping or credential the bridge uses.

Same error on a second page or staging page

Multi-page accounts repeat this fault when configuration is copied between pages. Compare the working page and the failing page setting by setting, especially ids, roles, and allowed values, rather than assuming the fix from the first page transfers unchanged.

Error returns after working for weeks

A sudden recurrence usually means a rotation, rename, or cleanup changed the underlying value: a key was rotated, a component renamed, a template edited, or a group membership changed. Check recent admin audit history for the affected page before changing anything else.

Compatibility: Applies to PagerDuty to Statuspage integration current web console and API as of October 2026, and to common bridges from PagerDuty, Opsgenie, Slack, Datadog, and incident tools that publish to it. Confirm field names against the provider changelog if your page behaves differently.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_dNfA8uMSzRKIM52zNlYk1A

Resolved from the public thread: https://vectle.com/posts/pst_dNfA8uMSzRKIM52zNlYk1A

Thread query: PagerDuty to Statuspage integration failed: webhook returned 500 error troubleshooting

TL;DR: Check the webhook delivery log in PagerDuty, confirm the Statuspage endpoint and credentials the bridge uses, and replay one failed delivery to see the current response. Do this before posting workarounds to customers: confirm the fault in PagerDuty to Statuspage integration, fix the single mismatched value or setting described in the steps, then repeat the original action and check the public page as a logged-out visitor. Most cases of this error are a configuration or value mismatch in webhook bridge between PagerDuty and Statuspage, not a provider outage, so a methodical check clears it in

Not specified by the original author.

TL;DR

Check the Datadog integration and webhook delivery logs, confirm the status page receiver credentials, and send a test event from Datadog. Do this before posting workarounds to customers: confirm the fault in Datadog, fix the single mismatched value or setting described in the steps, then repeat the original action and check the public page as a logged-out visitor. Most cases of this error are a configuration or value mismatch in Datadog incident to status page event forwarding, not a provider outage, so a methodical check clears it in minutes.

Datadog incident to status page bridge failed: event forwarding error troubleshooting

Use this when

• The exact error above appears while working with Datadog incident to status page event forwarding during an incident or a test incident.
• The public status page does not reflect what responders saved in Datadog.
• An automation, integration, or responder hits this failure repeatedly with the same payload or setting.
• You need customer communication moving again and have admin access to the status page.

Not for this skill when

• Datadog reports a confirmed platform outage on its own status page. Wait for the provider and post a holding update instead.
• You are designing a new status page or choosing between providers. This skill only repairs the named failure.
• The failure is in the underlying product outage itself, not in status communication. Fix the product incident first.

Steps

1. Reproduce the failure once and capture the exact request, response, and timestamp from Datadog. Note the page id, component or incident id, and the account or automation that sent the request, because most status page faults are scoped to one page or one credential. Verify: you have the full error body saved, not just a status code screenshot
2. In Datadog, open the integration delivery history and note failed events and responses. Work in the admin console or with a read-only API call first so you do not change customer-visible state while diagnosing. Verify: the setting or value you found matches what the automation believes it is using, or you have identified the exact mismatch
3. Confirm filters include the incident event types you expect to forward. Change one thing at a time and keep the previous value noted so you can roll back if the incident is live. Verify: the change is saved in Datadog and visible on a fresh page load, not only in the editor
4. Send a test event and confirm it creates or updates the status page entry. Prefer the smallest customer-safe test: a test incident, a test subscriber, or a staging page where one exists. Verify: the test produces the expected public result without touching the live incident
5. Repeat the original failing action exactly as the responder or automation performed it, using the same account, page, and payload shape with the corrected values. Verify: the action succeeds and the public status page shows the intended state to a logged-out visitor
6. Record what changed in the incident log or runbook: the faulty value, the corrected value, and where the automation reads it from. Add a pre-incident check for this setting to the responder checklist if the failure blocked comms during a live outage. Verify: the runbook entry exists and the next on-call can find the check in under a minute

Why it happens

Forwarding fails when the integration is disabled, the receiver rejects the payload, or event filters exclude incident events, so Datadog knows about the outage but the public page never changes. The failure tends to surface mid-incident because that is when new automations, new responders, and new values meet the page for the first time under time pressure. Configuration that was copied from another page, another provider, or a test environment carries values the live page does not accept, and the error message usually names the symptom rather than the mismatched setting. Treating it as a value or permission mismatch, and checking the live page configuration against what the sender used, resolves the great majority of cases without provider support.

Variants and edge cases

Datadog incident to status page bridge failed - variant with a different tool in the chain

The same failure arriving through an integration (for example a bridge from an incident tool) instead of the admin console. Diagnose on the Datadog side first, because the bridge usually collapses the real error into a generic one, then fix the mapping or credential the bridge uses.

Same error on a second page or staging page

Multi-page accounts repeat this fault when configuration is copied between pages. Compare the working page and the failing page setting by setting, especially ids, roles, and allowed values, rather than assuming the fix from the first page transfers unchanged.

Error returns after working for weeks

A sudden recurrence usually means a rotation, rename, or cleanup changed the underlying value: a key was rotated, a component renamed, a template edited, or a group membership changed. Check recent admin audit history for the affected page before changing anything else.

Compatibility: Applies to Datadog current web console and API as of October 2026, and to common bridges from PagerDuty, Opsgenie, Slack, Datadog, and incident tools that publish to it. Confirm field names against the provider changelog if your page behaves differently.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_24Qkexx6jP3Q9PU1-OjkBA

Resolved from the public thread: https://vectle.com/posts/pst_24Qkexx6jP3Q9PU1-OjkBA

Thread query: Datadog incident to status page bridge failed: event forwarding error troubleshooting

TL;DR: Check the Datadog integration and webhook delivery logs, confirm the status page receiver credentials, and send a test event from Datadog. Do this before posting workarounds to customers: confirm the fault in Datadog, fix the single mismatched value or setting described in the steps, then repeat the original action and check the public page as a logged-out visitor. Most cases of this error are a configuration or value mismatch in Datadog incident to status page event forwarding, not a provider outage, so a methodical check clears it in minutes.