# The webhook didn't arrive > A decision tree for a missing webhook: which path it should take, whether it was sent at all, why the delivery fails and what to do once Rivr has given up. A patient has paid, but the journal hasn't moved. Either Rivr sent no webhook, or it arrived and the receiver didn't take it. Go through the steps in order. Most faults already show in the delivery log on the Webhooks page, with an explanation of the error. - Market: Sweden (`se`). Norway differs in currency, payment methods and what happens when nobody pays: https://developers.rivr.io/guides/webhook-troubleshooting.md?market=no - Language: English (`en`). Svenska: https://developers.rivr.io/guides/webhook-troubleshooting.md?lang=sv - 6 min read · 5 steps - Page in the portal: https://developers.rivr.io/guides/webhook-troubleshooting Every example targets the sandbox (`https://api.test.rivr.io`) and needs test credentials. A platform client's tokens come from `https://auth.test.rivr.io`, an organisation key's from `https://auth.test.rivr.tech`. ## 1. Which path should the webhook take? *Rivr → Journal system* Rivr sends webhooks on two paths, and you troubleshoot them separately. **The clinic path** goes to the order's `callbackUrl`, or to the address Rivr has configured for the clinic or the platform when the order has none. **Your organisation's endpoints** are the addresses you register on the Webhooks page. They get the events for the orders your organisation's API keys create. An order that an organisation above the clinic creates with its own key does not use the clinic's configured address. It goes to the organisation's endpoints, and to `callbackUrl` as well if the order has one. A key that belongs to the clinic itself keeps the clinic's address. The same event has its own `Rivr-Webhook-Id` on each path. **What your system does:** Find out how the order was created: with the platform client or with an organisation key. That decides which path to look at. ## 2. Was it sent at all? *Rivr → Journal system* **On the clinic path** no webhook is sent when the order has no `callbackUrl` and neither the clinic nor the platform has an address with Rivr. **To your organisation's endpoints** no delivery is created when the endpoint is paused, when the event is not among the endpoint's events, or when the endpoint only takes selected clinics and the order's clinic is not one of them. Orders created other than with your organisation's keys, for example in the clinic or at the terminal, give no deliveries to your organisation's endpoints. **What your system does:** Open the endpoint on the Webhooks page and check that it is active, that the event is selected and that the clinic is included. If there is no delivery at all in the log, the fault is before the receiver, not at it. Rivr may also have switched off deliveries to organisations' endpoints, and then no deliveries are created. **In the portal:** [Open Webhooks](https://developers.rivr.io/webhooks) ## 3. The delivery exists but fails *Rivr → Journal system* The delivery log shows each attempt with the status code the receiver answered and the error Rivr saw, and explains the error with what to do. The most common: - **`integrator responded 401`, `500` or another code:** the receiver answered, but not `2xx`. Rivr tries again. - **`integrator responded 400 (permanent rejection, not retried)`:** the receiver answered `400`, `405`, `410`, `413`, `414`, `415` or `422`, and Rivr gave up at once. A wrong signature should get `401`, so that Rivr tries again. - **Timeout:** the receiver didn't answer within 5 seconds, or couldn't be reached. Rivr tries again. - **A redirect** (`3xx`) is not followed to your organisation's endpoints. It counts as a failed attempt, and Rivr tries again. - **`blocked or non-HTTPS target URL`**, or an address that only points at private addresses: your organisation's endpoints must be https and reach a public address. Rivr does not try again. **Why:** Rivr waits 5 seconds on each attempt. A receiver that does the work before it answers is therefore too slow, even when the work succeeds. **What your system does:** Answer `2xx` as soon as the signature is verified and the event is on your queue, and do the work afterwards. Run `rivr verify --url ` against your receiver: it tries a signed delivery, a duplicate, a wrong signature, a stale timestamp, a missing signature and a fast answer. > **Warning.** `no usable signing key for endpoint` is Rivr's side: Rivr could not use the endpoint's signing key. Rotate the key on the Webhooks page, and contact Rivr if the error remains. ## 4. Rivr has given up *Rivr → Journal system* Rivr tries 14 times over about seven days and then gives up, and the delivery is then dead-lettered (`DeadLettered`). After a permanent error, a deleted endpoint or a filter that no longer lets the clinic or the event through, Rivr gives up at once. A delivery that was already waiting when the endpoint was paused keeps getting attempts, so if you resume the endpoint within seven days, what is waiting is sent. Events while it is paused give no new deliveries. In the sandbox you can replay a failed or dead-lettered delivery from the delivery log, once the receiver is fixed. In live there is no replay in the portal. **What your system does:** Fetch the order with `GET /api/public/orders/{orderId}` and act on that. ## 5. Find the same delivery on both sides *Journal system → Rivr* `Rivr-Webhook-Id` stays the same on every retry of a delivery. The delivery log shows it on every delivery. Log the header in your receiver, so that you and Rivr can talk about the same delivery. A test delivery from Send test is not stored in the log. The result is shown at once, with an id of its own. **What your system does:** Store `Rivr-Webhook-Id` for every webhook you have handled and answer a duplicate with `2xx`. **In the portal:** [The events and the webhook's fields](https://developers.rivr.io/events) ## Common pitfalls - Answering `400` to a wrong signature. Rivr then gives up at once, and the webhook never comes again. Answer `401`. - Looking for a webhook at the clinic's address for an order that an organisation above the clinic created with its own key. It goes to your organisation's endpoints, and to `callbackUrl` if the order has one. - Letting the receiver redirect, for example from http to https or to an address with a trailing slash. To your organisation's endpoints Rivr does not follow the redirect and counts the attempt as failed. ## Next guide - [Receive webhooks](https://developers.rivr.io/guides/webhooks.md): The webhook is the truth about an order. How to receive it safely, and only once. - [Verify the webhook signature](https://developers.rivr.io/guides/verify-signatures.md): Code in Node, PHP, Python and .NET, pseudocode for Delphi and 4D, and test vectors to prove your own code against. - [Errors and retries](https://developers.rivr.io/guides/errors-retries.md): One way to handle errors against /api/public: read the code, decide whether to send the call again, wait the right time and send the same Idempotency-Key again.