QuickBooks webhooks deliver, but the payload parses as empty
The endpoint is being called. The HMAC signature verifies. You return 200. And nothing downstream happens, because the code reads a root key that is no longer there. This failure is silent by construction: every check that would have alerted you still passes.
- Jul 312026 — Intuit's migration deadline for the CloudEvents payload structure, moved out from May 15, 2026. The migration is complete: this is the current format, not an upcoming change.
- Root keyCode that looks for a top-level
eventNotificationsroot finds nothing. The notification content you were already handling is inside the envelope; the routing around it is what has to change. - SilentDelivery and signature verification are unaffected, so no error is raised and no alarm fires. The handler processes zero notifications, forever, while the sync quietly falls behind.
- Pinned SDKOlder QuickBooks SDK versions parse against the legacy shape and silently drop data — Intuit's .NET SDK,
node-quickbooks-style Node packages,python-quickbooks-style Python packages. A stale pin is the usual cause, not the application code.
deadlinescan scan ./my-repo
Before that: log one raw request body, unparsed, and look at the root keys — that single log line settles it faster than any other check. Then add the alert that was missing: a processed-notification count of zero over a period where deliveries arrived. And check your Reports API calls — v2-only since Sept 1, 2026.
A finding count of zero means no affected call sites were FOUND — not that you're unaffected. That line carries extra weight here: the QuickBooks rules have never been run against a real QuickBooks codebase, so a clean report on a QuickBooks integration is a starting point for your own review, not a certificate.
Scan your code
Free, local, one command. Flags legacy eventNotifications-root parsing and QuickBooks SDK references.
Get the scanner: email [email protected] and you'll get the source and a Windows binary by reply — the public repository is being prepared.
deliveries arriving, endpoint 2xx
signature verification passes
parsed notification count zero
last event predates the cutover
nothing in your deploy history lines up