# WEBHOOK SECRET NOT USED

Canonical page: https://docs.ovok.com/errors/webhook-secret-not-used

**HTTP 422.** Stable Problem Details type: [`https://docs.ovok.com/errors/webhook-secret-not-used`](https://docs.ovok.com/errors/webhook-secret-not-used).

## What this means [#what-this-means]

A `webhookSecret` was sent for a wearable provider that does not take one. Only Suunto signs its notifications with a secret the admin sets. Clients should branch on `type` and `status`, not on human-readable `detail` text.

## Troubleshooting [#troubleshooting]

Remove `webhookSecret` from the request. Withings and Polar notifications are set up by Ovok itself; the other providers send no notifications. Compare the request with the relevant endpoint's documentation and confirm the authenticated project and environment. Record the request path and `traceId` before escalating; the identifier lets an administrator find server-side context without sharing credentials or patient data.

## Related endpoint guidance [#related-endpoint-guidance]

Use these pages to check the route, project settings, and request requirements associated with this error:

- [Set up wearable providers](/wearables/set-up-providers)
- [Wearables API reference](/wearables/api-reference#provider-setup)

## Retry safely [#retry-safely]

Correct the request, configuration, access or project state described above before retrying. Repeating an unchanged request will normally return the same error; for writes, check whether the first attempt changed state before sending it again. Follow endpoint-specific idempotency and concurrency guidance. Do not retry in a tight loop or use a broader permission or project setting to bypass the check.

## If the problem persists [#if-the-problem-persists]

Share the HTTP status, problem `type`, request path, response timestamp, and `traceId` with your administrator or support contact. Remove access tokens, provider secrets, and sensitive patient data from the report. The [Error responses guide](/errors) explains the response fields, while the [machine-code registry](/errors/machine-codes) lists every endpoint-specific type audited for this release.