When leads stop arriving from an integration, there is exactly one question worth asking first: did the request reach the CRM at all? Everything else depends on the answer, and Sales → API Logs settles it in about ten seconds.
The two possibilities
Nothing in the log. The request never arrived. The problem is on the sending side or between the two — a wrong URL, a firewall, a service that silently stopped running, a form plugin that was disabled during a site update. Nothing you change in the CRM will help, and this is the single most valuable thing the log tells you because it stops you debugging the wrong system.
Entries present but failing. The request arrived and was rejected. Now the status code tells you why.
Reading the status codes
- 200 / 201 — accepted. If the sender still reports failure, the problem is in how it reads the response, not in the CRM.
- 401 — the API key was missing, wrong, or revoked. Check the key is being sent
as
X-API-KEYand has not been regenerated since the integration was built. - 403 — authenticated but not allowed. Usually an IP whitelist on the key: once any address is whitelisted, every other address is refused. Also the code you will see if a landing page's allowed origin does not match — see that specific error.
- 422 — the request was understood and the data was not acceptable. Almost
always a missing
namefield, which is the only genuinely required one. - 429 — rate limited. The key exceeded its per-minute allowance. Raise the limit on the key, or find out why the sender is looping.
- 500 — something failed on our side. Worth reporting, with the timestamp.
A 401 that used to work is nearly always a rotated key. Revoking a key takes effect immediately and cannot be undone — there is no secret half to restore. If someone revoked and reissued, every integration using the old key needs updating, and each will show exactly this.
What the log does not cover
It records requests to the authenticated Lead API. It does not record inbound provider webhooks — Meta Lead Ads, Google Lead Form, WhatsApp, Instagram — because those authenticate with a signature or token rather than an API key and never touch this path.
If leads have stopped arriving from one of those, check the provider's own delivery status instead. Meta and Google both show recent delivery attempts and errors in their dashboards, and that is considerably more informative than anything visible from this side.
A useful habit
When you build a new integration, send one deliberately malformed request first — omit the name field, for instance — and confirm you can see the 422 in this log. It takes a minute and proves the whole path works end to end before you rely on it silently.
Integrations rarely fail loudly. They usually fail by quietly delivering nothing, and the failure is noticed a week later when somebody asks where the leads went.