Status codes and troubleshooting
What each failure means, which side it comes from, and the first thing to check.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
A source shows no events
Check the vendor’s own delivery log first: GitHub’s webhook page, the EventBridge rule’s monitoring tab, Okta’s event hook page, or the Auth0 stream’s health tab.
| What the vendor shows | Usual cause |
|---|---|
404 | The URL is wrong, or the source was deleted. Copy it again from the source’s page |
403 | The request came from outside the source’s IP allowlist |
413 | The body is over 5 MB |
429 | The month’s fair use ceiling was reached; see limits |
| Nothing sent at all | The vendor-side rule or subscription does not include the event, or is switched off |
Events arrive but nothing is found
- Open the event: if its signature failed, rules did not run. See signature verification.
- Check the event is one a rule reads: the AWS guide lists the event names, the GitHub guide the event types.
- Check the rule is not switched off for that source.
- A repeat of an open finding updates it without a new alert. Look at its last seen time.
A domain scan failed
The domain’s page in Leak Alarm shows why:
| Message | Fix |
|---|---|
| The verification TXT record is gone | Publish the record again, then verify the domain |
| The hostname points at a private or reserved address | Only public addresses are scanned |
| The hostname could not be found in DNS | Check the hostname and its DNS records |
| The site answered its home page with status N | Make the home page answer 200 |
| The site redirects somewhere a scan does not follow | Scan the hostname the site redirects to; verify it first |
| The site’s HTTPS certificate could not be verified | Fix the certificate; the expiry or chain finding says what is wrong |
| The site did not answer in time, or could not be reached | Check the site is up; the next scan tries again |
A log drain or the SDK is refused
| Response | Cause |
|---|---|
401 from a drain | The secret does not match; see log drains |
404 from a drain | The drain was deleted; its URL no longer works |
401 from the SDK | The DSN key was rotated or the project deleted |
429 | A rate limit; the SDK waits and retries on its own |
I need help
Email support@shellorbit.com with the source id or domain, one event or finding id, and the time.