Symptom
List queries keep returning 0. Assumed auth was passing.
Cause
The HMAC signing string omitted the query string. The real response was 401 Invalid signature.
★ There's a reason the defect stayed hidden: on endpoints that use no query string (the product API) the signature was correct. It only broke on endpoints that use one.
What it cost
Took the 0 as fact, made a verdict, and that verdict delisted items that were selling (restored).
The clue (worth recording)
The admin dashboard showed revenue while the API returned 0. That mismatch was the lead.
★ Before doing anything irreversible on the basis of a 0, cross-check via another route.
Not every 0 is the same
Another channel's query was also 0, and that one was a real 0, confirmed by reading the raw response by eye.
A 0 that has been through verification and a 0 that hasn't are different values.