A call fails
401 invalid_api_key
401 invalid_api_key
- The key may be incomplete: it’s
agk_live_followed by 32 characters. It’s shown only once — if you can’t copy it again, create a new one. - The header must be
Authorization: Bearer agk_live_…. A key placed in the URL isn’t read. - The key may have been revoked in Paramètres → API (Settings → API) — or automatically, when the admin who created it left the workspace or stopped being an admin.
403 workspace_access_denied
403 workspace_access_denied
The key is valid, but the workspace’s Agentova subscription is unpaid, paused or incomplete. Fix it in Paramètres → Abonnement (the plan) or Paramètres → Facturation (payment method, invoices). The free plan has API access.
404 route_not_found
404 route_not_found
Check the base URL —
https://core-api.agentova.ai/v1, with /v1 — and the path.404 automation_not_found
404 automation_not_found
The automation was deleted or turned off in the Agentova app, its account was disconnected, or it belongs to another workspace than the key’s. List the automations again to get a current ID.
413 or 415 invalid_request
413 or 415 invalid_request
413: the request body is larger than 16 KB. 415: the body isn’t sent as JSON — add Content-Type: application/json.422 automation_not_controllable
422 automation_not_controllable
details.statusisdraftorerror: those can’t be switched through the API. Fix the automation in the Agentova app, then retry.details.reasonisaccount_in_use: you’re reactivating an email automation whose mailbox another active agent already uses. A mailbox can only be used by one active agent: detach it from the other agent in the Agentova app, then retry.
429 rate_limited
429 rate_limited
More than about 100 requests per minute with this key: wait for the
Retry-After delay, then slow down — see Rate limits. Repeated failed authentications from one address also end in 429: fix the key first.It works with curl, not from a web page
It works with curl, not from a web page
The API doesn’t accept calls from browsers (no CORS). Call it from your server — see Security.
Pausing and reactivating
- The response still shows the previous status. Reactivating can take longer than the 8 seconds the API waits before answering — reconnecting a mailbox, for example. The final status arrives as an
automation.status_changedevent; you can also retrieve the automation again a little later. - Reactivation ends in
error. The channel couldn’t be reconnected (expired access, changed mailbox password…). Fix the connection in the Agentova app. - Emails received during a pause got no reply. That’s expected: nothing that arrives during a pause is caught up afterwards — see Pausing and reactivating.
- An automation disappeared. It was deleted or turned off in the Agentova app, or its account was disconnected. When a failure took it away, a last
automation.status_changedevent with theerrorstatus was sent as it left; when its account is reconnected, it comes back with anactiveevent.
A webhook doesn’t arrive
- Does the event really happen? Leads only come from the sources listed in Concepts: a private message or an email your agent replies to doesn’t create one. CRM sources other than Customer.io record leads and runs only when the workspace has a single such CRM automation. Pausing an automation that’s already paused sends nothing, and neither does deleting or turning off an automation in the app.
- Is the subscription still active? Call
GET /webhooks. A subscription that isn’t listed was deleted — in Paramètres → API, or with the key that created it, when that key was revoked: create it again. A subscription withdisabled_atset receives nothing — after failures lasting at least 72 hours, or at once if its URL no longer passes Agentova’s address checks: delete it and create a new one. A subscription to which your endpoint answered410was deleted. A subscription created with a revoked key (box unticked) receives nothing once the admin who created that key is no longer an admin of the workspace: create it again with an active key. - Does your endpoint answer
2xxwithin 10 seconds, without a redirect? A3xxcounts as a failure: subscribe the final URL. - Is a retry pending? A failed delivery is retried for about 27 and a half hours — the next attempt can come hours later. See Retries.
- Was the API switched off? Events that happen while the API answers
503are never delivered: catch up with the list endpoints.
The signature doesn’t match
- Compute it on the raw body, before any JSON parsing.
- Use the full secret,
whsec_prefix included. - Use the secret of this subscription: each subscription has its own.
- Check your server’s clock: a delivery signed more than 5 minutes away from your time is rejected. Keep the clock synchronized (NTP).
- Run your code against the test vector.
Duplicates and order
- The same event arrives twice. Deliveries are at least once: deduplicate on the event
id, and keep the IDs you’ve seen for at least 48 hours. - Events arrive in the wrong order. Order isn’t guaranteed: compare the resource’s
updated_at(automations),created_at(leads) oroccurred_at(runs).