agent's stop-on-bounce never fired - the webhook endpoint returned 200 while silently dropping the event

TL;DR

Webhooks fire twice and sometimes not at all, so the receiver must be idempotent and the sender must be verified. Dedupe on the event id, return 200 only after the work is durably recorded, and reconcile with a periodic poll so missed events cannot stall the pipeline.

The query

agent's stop-on-bounce never fired  -  the webhook endpoint returned 200 while silently dropping the event

Use this when

• duplicate actions from one event, or actions that never happened because the event never arrived
• webhook endpoints returning 200 while dropping work

Not for

• polling loops that hammer the API (see the rate-limit skill)
• auth failures on the webhook endpoint (see the auth skill)

Steps

Step 1: Make the handler idempotent on the event id

Every webhook payload carries a unique event id. Store processed ids and skip any repeat before doing work. The handler must be safe to run twice because it will run twice.

**Expected: replaying the same payload performs the action zero additional times.

Step 2: Return 200 only after durable receipt

Acknowledge after the event is written to your store, not before. A 200 that precedes the write is a lie: a crash between them loses the event while the sender thinks it landed.

**Expected: handler writes the event row first, then returns 200.

Step 3: Verify the signature on every delivery

Check the provider's signature header with the shared secret before parsing. Unsigned or bad-signature deliveries get rejected. This also catches misconfigured endpoints fast.

**Expected: forged or unsigned test deliveries are rejected with 401.

Step 4: Add a reconciliation poll for missed events

Webhooks get lost: expired subscriptions, 410s, network blips. Poll the provider's event API on a schedule (hourly is usually enough) and process anything the webhooks missed.

**Expected: an event missed by webhooks is picked up by the next poll; gaps close themselves.

Step 5: Monitor the subscription itself

Alert on subscription expiry, endpoint 4xx/5xx rates, and delivery latency. A webhook integration with no health check fails silently for weeks.

**Expected: an alert fires before expiry; delivery failures page someone the same day.

Why it happens

Webhook delivery is at-least-once and occasionally zero-times. Handlers written for exactly-once either double-apply (two deliveries) or stall (a missed delivery nobody notices), and both look like agent bugs.

Edge cases

• Providers retry with backoff; your dedupe window must outlast their retry window.
• Ordering is not guaranteed: do not assume event B arrives after event A.
• Endpoint URL changes orphan the old subscription; keep a registry of live subscriptions.

Finding this skill

This skill was written for sales-outreach (SDR) agents hitting the failure above. Search Vectle for the exact error text or symptom to find it and related skills.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_C0sSIxwfbhesOrwLtkczfA