[waleedlatif1]

Summary

• Webhook providers now throw WebhookDeploymentConfigurationError when a user-supplied trigger field is missing or malformed at subscription creation. That covers API keys, IDs, subdomains, hosts, trigger type, and the selected credential. It is the class HelpScout, QuickBooks and Zoho Desk already use.
• POST /api/webhooks answers that error with a 400 and logs it at warn. Any other subscription failure is still a 500. This is the same rule the deploy path already applies in webhookConfigFailureStatus, so a deploy with one of these errors now fails terminally with a 400 instead of retrying a 500.
• The providers' outer create catch blocks pass the config error through without logging it at error a second time.
• planeWebhookRequest rejects a blank or CR/LF-containing token, and Airtable reads baseId/tableId with toStringOrNull, so these malformed values also get the 400 instead of a crash or a 500.
• These stay plain errors: OAuth token fetch failures (they can be transient), unknown or unmapped trigger IDs (code bugs), DNS validation, and every provider API failure.
• executeResumeWorkflow logs through logFailureOnce, keyed on the paused run, so a failure the manager already logged is not logged again. A refusal below 500, such as a 409 when the pause is already resumed, is marked a user failure and logs at info. 5xx and statusless errors still log at error. The thrown error and its status are unchanged.

Type of Change

• Bug fix

Testing

• biome check on every changed file
• Grepped for alarm, metric or test consumers of the log messages whose level changed; there are none
• Existing route tests that expect plain errors to return 500 are unchanged
• Type-check, audits and the Vitest suites run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 4, 2026 4:43am UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with a non-blocking mismatch in the resume refusal log level.

Findings

1.  Refusals lose their warning level ▶

Summary

The PR separates missing webhook settings from provider failures.

• Webhook setup errors now return HTTP 400 instead of looking like server failures.
• Resume errors with client statuses are logged as user-attributed failures.

_{Reviews (2) · Last reviewed commit: "fix(webhooks): type blank Plane tokens a..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 32 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 33 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}