Troubleshooting Failed Webhook Deliveries & API Signature Verification

Diagnosing Failed Webhook Deliveries

If your webhook endpoint is not receiving real-time event feeds or deliveries show a failed status in Settings > Developers & APIs:

1. HTTPS Requirement: Webhook endpoints must use valid SSL/TLS HTTPS URLs. Localhost and private intranet IP ranges are blocked by edge SSRF guards.
2. 5-Second Response Timeout: Your receiving server must return an HTTP 2xx status code within 5 seconds. Long-running tasks should be queued asynchronously on your backend.
3. Retries and the dead-letter list: 5xx errors and timeouts are retried with increasing delays, then moved to the dead-letter list. After you fix the endpoint, use Replay on the delivery in Settings > Developers & APIs. A subscription is switched off automatically only when its address is blocked by security policy or returns HTTP 410 Gone; the reason shows next to its status, and you add the endpoint again once it is fixed.

HMAC Signature Verification:

Validate the LGQ-Signature header using your webhook secret to confirm the payload originated from Let’s Get Quoted and was not tampered with in transit.