Troubleshooting

• confirm the request is hitting the correct WatchTower endpoint
• confirm x-api-key is present and belongs to the correct organization
• confirm idempotency-key is present
• confirm the payload is valid JSON
• confirm required fields are present
• confirm you are in the expected environment
• check the last successful ingestion time

• use the same idempotency key only for retrying the same logical event
• use a new idempotency key for a new transaction
• check whether the upstream transaction reference changed between retries
• log transaction reference, idempotency key, HTTP status, and response body for support

• check that the API key is active
• check that sandbox and production keys were not mixed
• check allowed IP settings where used
• check that the user has the correct role for console actions
• check MFA completion for sensitive users

• confirm the transaction ingested successfully
• confirm the test payload is actually suspicious enough to trigger controls
• confirm required contextual fields for the relevant controls are present
• check rule status and thresholds
• check whether the event was allowed without alert escalation

• confirm the event type is subscribed for the user or channel
• confirm minimum severity settings are not filtering the event out
• check user notification preferences
• check channel status and delivery health
• check whether the event created a notification but delivery failed or was skipped

Login checks

• the account exists in the correct environment
• the password is correct
• MFA is completed if enabled
• the invite was accepted if the user was onboarded through an invitation

Invite and reset checks

• the invite or reset token is active and not expired
• the user is opening the latest email link
• the user is completing the flow in the correct environment
• the email was not filtered into spam or security quarantine

• repeated 5xx responses
• sustained ingestion failure
• no traffic after a confirmed client release
• decision response mismatch in the client system
• alert or case workflows failing after successful ingestion
• notification delivery failures after channel configuration is confirmed