Support playbooks

Common transaction investigation paths

Use these patterns to decide whether the evidence points to auth, search, posting, finalization, or time-window cleanup.

HTTP 401 During Customer Search

Use this when a user-facing error appears during customer search, member lookup, or account lookup.

Symptoms

  • Search request returns HTTP 401 or HTTP 403
  • A login or session request appears nearby
  • A later search may succeed after retry

Look for

  • Selected failed search request
  • Correlation ID on the failed request
  • Session or auth activity shortly before or after the failure

Frame this as an auth/session sequencing or recovery issue until Engineering confirms a different backend cause.

Trace a transaction locally

Post Succeeded but User Saw an Error

Use this when post and completion calls look successful but the user still saw an error.

Symptoms

  • Transaction post returns HTTP 200
  • Completion returns HTTP 200
  • Receipt, final status, or UI follow-up appears after completion

Look for

  • First failed request after completion
  • Receipt or finalization endpoint status
  • Correlation ID tied to the failing follow-up request

Frame this as post-completion handling, receipt, or UI status recovery instead of a failed core post.

Trace a transaction locally

No Entries in the Selected Window

Use this when the evidence file loads but analysis finds no entries inside the incident time range.

Symptoms

  • File range does not overlap the incident window
  • Timezone selection may be wrong
  • Start and end times are too narrow

Look for

  • Detected UTC bounds
  • Incident timezone
  • Timestamp format from the source ticket

Do not escalate yet. Tighten the incident window and confirm timezone before drawing a workflow conclusion.

Trace a transaction locally