Start with the request ID and delivery

Management errors use application/problem+json. Record the request_id when contacting Oway.
Delivery detail includes safe attempt status, duration, outcome, and retry time without exposing
your response body.

Problem reasons

Reason	What to do
`cursor_invalid`	Restart pagination without the cursor; cursors are scoped and opaque.
`delegation_invalid`	Reauthenticate and retry; contact support with the request ID if the error persists.
`idempotency_key_conflict`	Use the original bytes or a new idempotency key.
`idempotency_key_required`	Add one printable `Idempotency-Key` header.
`internal_error`	Retry safely with the same idempotency key and retain `request_id`.
`precondition_failed`	Read the endpoint, reconcile, and retry with its latest ETag.
`precondition_required`	Add the latest strong `If-Match` ETag to the PATCH.
`request_too_large`	Keep the management request body at or below 64 KiB.
`validation_failed`	Correct the invalid or unknown request fields.
`webhook_audience_forbidden`	Use credentials for the endpoint's shipper or carrier audience.
`webhook_delivery_not_found`	Confirm the delivery belongs to the current company/audience.
`webhook_delivery_not_replayable`	The immutable body passed its retention boundary.
`webhook_endpoint_archived`	Create a new endpoint; archive is permanent.
`webhook_endpoint_limit_reached`	Archive an unused endpoint before creating another.
`webhook_endpoint_not_found`	Confirm the endpoint belongs to the current company/audience.
`webhook_endpoint_paused`	Correct the delivery failure and complete the resume test.
`webhook_event_not_available`	Refresh the catalog and choose an event for your audience.
`webhook_url_forbidden`	Use a public destination; a DNS answer was non-public.
`webhook_url_invalid`	Use a canonical HTTPS URL on port 443 without embedded credentials.

Delivery outcomes

http_error: inspect the status. 410 pauses immediately; other non-2xx responses retry.
network_error: confirm public DNS, firewall rules, port 443, and the Oway egress allowlist.
timeout: respond within 15 seconds and move processing behind a queue.
ssrf_rejected: the URL or a fresh DNS answer violated destination policy; update the URL.
cancelled: the attempt stopped before completion. Check the endpoint state and delivery history.

Terminal reasons gone, ssrf_rejected, retry_exhausted, and
retry_window_exhausted pause the endpoint. Correct the cause, then call resume; Oway requires a
successful signed test before production delivery becomes active.

Invalid signatures usually come from parsing before verification, using the whsec_ text as the
HMAC key without base64-decoding it, ignoring the second rotation signature, or clock drift beyond
five minutes.