Skip to content
Error codes · Status pages & incidents

RU-5006: Inbound incident signature missing or wrong

This inbound webhook was created with a signing secret, so every POST must carry an X-RealUptime-Signature header holding sha256=<hex HMAC-SHA256 of the raw request body>, and this request's header was absent or did not verify.

On the wire

Ships with HTTP status 401, carrying "code": "RU-5006" in the response body alongside the human-readable error message. Existing fields are never replaced by the code: it is additive.

Common causes

  • The alerting tool does not sign bodies and the webhook was created with signing turned on.
  • The secret was rotated (rotating a token also rotates its secret) and the tool still signs with the old one.
  • The body was re-serialized after signing (whitespace or key order changed), so the signature no longer matches the bytes received.

How to fix it

  1. Sign the exact bytes you send, with the secret shown once when the webhook was created or rotated.
  2. If your tool cannot sign, create the webhook without a signing secret instead; the token in the URL is still the credential.

Related codes

  • RU-5004: Inbound incident webhook token not recognized
  • RU-5005: Inbound incident payload not understood

Still stuck?

Ask support and mention RU-5006: the code pins down the exact refusal path, so you skip the diagnostic back-and-forth.