> ## Documentation Index
> Fetch the complete documentation index at: https://docs.goliathdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Errors

> HTTP error codes returned by Goliath inbound webhook endpoints.

All inbound webhook endpoints return standard HTTP status codes. Error bodies are JSON.

***

## Error codes

| Status | Meaning               | Common cause                                                                               |
| ------ | --------------------- | ------------------------------------------------------------------------------------------ |
| `400`  | Bad request           | Missing required fields — e.g. no identifiers on a find request, no `contact_id` on update |
| `401`  | Unauthorized          | Token is invalid, not found, or the webhook has been disabled by an org admin              |
| `404`  | Not found             | Unknown path under `/contacts`, or contact not found on an update request                  |
| `405`  | Method not allowed    | Request was not a `POST`                                                                   |
| `500`  | Internal server error | Handler threw before sending a response body                                               |

***

## Error body

All errors return a JSON body with an `error` field:

```json theme={null}
{
  "error": "Unauthorized"
}
```

```json theme={null}
{
  "error": "Provide at least one of full_name, phone_number, contact_email"
}
```

***

## Async endpoints and silent failures

For async endpoints (`create-with-ai`, `create`), validation happens in the background worker — not at the HTTP layer. This means:

* A `200` response does not guarantee a contact was created
* If `unstructured_text` is empty, no contact work is performed despite a successful response
* If none of `full_name`, `phone_number`, or `contact_email` are present on a structured create, the worker returns early without creating

<Warning>
  Do not treat a `200` on an async endpoint as confirmation that a contact exists. If you need to verify creation, follow up with a [`find`](/webhooks/inbound/endpoints/find) request.
</Warning>

***

## Duplicate events

Async endpoints deduplicate payloads using a hash of the request body. If the same payload is received more than once:

* The response is still `200`
* `acknowledged` is `true`
* `eventId` is **omitted**

This is not an error — it is expected behavior. Use the presence of `eventId` to distinguish new events from duplicates.