Incident summary – Deliver API excludeElements error (2026-04-15)

Summary

On 2026-04-15, a change introduced an incompatibility in our content processing that caused some Deliver API requests using the excludeElements query parameter to fail. Specifically, in certain cases an item could be returned without an expected field, and the excludeElements processing path did not handle that scenario. This resulted in an internal error and a 500 response.

Impact to Customers

Customer requests to the Deliver API that included the excludeElements query parameter could intermittently receive HTTP 500 responses during the incident window. The issue affected a limited subset of traffic (only requests meeting specific conditions were impacted).

The failures occurred only when all of the following were true:

• The requested variant (or one of its dependencies) had been updated after the deployment.
• The request was served uncached (or required a fresh origin fetch).
• The request included the excludeElements query parameter.

Resolution

Timeline (CEST):

• 08:58 – Deployment completed.
• 13:33 – Customer reported errors through Support; we started triage.
• 13:37 – Engineering investigation started.
• 14:17 – Root cause identified and fix prepared.
• 15:32 – Fix deployed.
• 16:00 – Service monitored; error rates returned to normal.

Detection

We became aware of the incident after a customer reported the issue via Support. We then confirmed elevated error rates on the affected request path and engaged engineering to investigate and mitigate.

Guidance

During the incident window, retrying the request could succeed depending on whether a fresh fetch was required. If errors were persistent for a specific call, temporarily removing excludeElements would avoid the affected code path (with the tradeoff of a larger response). No data loss occurred; this was a request-processing error only.

Preventive actions

• Add end-to-end test coverage for excludeElements, including missing-field scenarios.
• Improve automated detection and alerting specifically for elevated 5xx rates on Deliver API request paths.
• Add additional safeguards in the API code to handle missing/optional fields defensively.

Duration

Incident window: approximately 08:58–15:32 CEST