Payments::Paypal::InvalidAPIEventError: Payments::Paypal::InvalidAPIEventError (Payments::Paypal::InvalidAPIEventError)

[ops-handler]

Error

Payments::Paypal::InvalidAPIEventError (Payments::Paypal::InvalidAPIEventError)

Stack trace

app/commands/payments/paypal/verify_api_event.rb:12 in call
mandate/call_injector.rb:10 in Payments::Paypal::VerifyAPIEvent.call
app/commands/webhooks/process_paypal_api_event.rb:10 in call
config/initializers/mandate.rb:39 in perform
active_job/execution.rb:68 in block in ActiveJob::Execution#_perform_job
active_support/callbacks.rb:121 in block in ActiveSupport::Callbacks#run_callbacks
anycable/rails.rb:39 in AnyCable::Rails.with_socket_id
anycable/rails/socket_id_tracking.rb:37 in block (2 levels) in <module:SocketIdTrackingJob>
active_support/callbacks.rb:130 in instance_exec
active_support/callbacks.rb:130 in block in ActiveSupport::Callbacks#run_callbacks

Tracking Details

• Project: exercism-rails
• Sentry: Payments::Paypal::InvalidAPIEventError: Payments::Paypal::InvalidAPIEventError (Payments::Paypal::InvalidAPIEventError)
• Culprit: MandateJob
• First seen: Apr 8, 2026

[rnagulapalle]

This looks narrower than “PayPal sent an event we do not handle.”

InvalidAPIEventError in your code is only raised when the call to PayPal’s verify-webhook-signature endpoint comes back with verification_status == "FAILURE", so the failure is happening before event_type dispatch, not inside the handler switch.

A couple things that seem worth checking first:

• whether Exercism.secrets.paypal_webhook_id matches the webhook that actually delivered this event
• whether the failing delivery was live vs sandbox (or a simulator/test webhook), since that can make postback verification fail even when the payload shape looks fine
• whether the production debug log already captured the event id / event type / transmission id for this failure, since you are logging the payload and PayPal headers before verification

Given the current code, I would treat this first as a webhook identity/environment mismatch or unsupported delivery type, rather than a missing event handler.

One small gap in the current test coverage: the verifier tests exercise generic SUCCESS/FAILURE responses against sandbox, but not cases like wrong webhook id / wrong environment / test deliveries, which feels close to the operational failure mode here.