@@ -56,7 +56,7 @@ Start a background Flint agent task that generates up to 10 pages from a templat
 | `apiKey` | string | Yes | Flint API key \(found in Flint team settings, starts with ak_\) |
 | `siteId` | string | Yes | ID of the Flint site the agent should modify |
 | `templatePageSlug` | string | Yes | Slug of the existing template page to generate from \(e.g., /case-studies/template\) |
-| `items` | json | Yes | JSON array of 1-10 pages to generate. Each item requires targetPageSlug \(slug for the new page\) and context \(content details the agent should use\). |
+| `items` | array | Yes | JSON array of 1-10 pages to generate. Each item requires targetPageSlug \(slug for the new page\) and context \(content details the agent should use\). |
 | `callbackUrl` | string | No | HTTPS webhook URL that Flint will POST to when the task completes or fails |
 | `publish` | boolean | No | Whether to automatically publish the generated pages when the task completes |
 
 
@@ -1,6 +1,9 @@
 import { db } from '@sim/db'
 import { settings, user } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
+import { isRecordLike } from '@sim/utils/object'
+import { truncate } from '@sim/utils/string'
 import { eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { adminMothershipQuerySchema } from '@/lib/api/contracts/mothership-chats'
@@ -11,6 +14,10 @@ import { env } from '@/lib/core/config/env'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { getMothershipBaseURL } from '@/lib/mothership/server/agent-url'
 
+const logger = createLogger('AdminMothershipProxy')
+
+const UPSTREAM_BODY_LOG_LIMIT = 500
+
 const ENV_URLS: Record<string, string | undefined> = {
   dev: env.MOTHERSHIP_DEV_URL,
   staging: env.MOTHERSHIP_STAGING_URL,
@@ -54,77 +61,106 @@ async function getAuthorizedAdminUserId() {
   return authorized ? session.user.id : null
 }
 
-/**
- * Proxy to the mothership admin API.
- *
- * Query params:
- *   env       - "dev" | "staging" | "prod"
- *   endpoint  - the admin endpoint path, e.g. "requests", "licenses", "traces"
- *
- * The request body (for POST) is forwarded as-is. Additional query params
- * (e.g. requestId for GET /traces) are forwarded.
- */
-export const POST = withRouteHandler(async (req: NextRequest) => {
-  const userId = await getAuthorizedAdminUserId()
-  if (!userId) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  const adminKey = env.MOTHERSHIP_API_ADMIN_KEY
-  if (!adminKey) {
-    return NextResponse.json({ error: 'MOTHERSHIP_API_ADMIN_KEY not configured' }, { status: 500 })
-  }
-
-  const { searchParams } = new URL(req.url)
-  const queryValidation = adminMothershipQuerySchema.safeParse(searchParamsToObject(searchParams))
-  if (!queryValidation.success) return validationErrorResponse(queryValidation.error)
-  const { env: environment, endpoint } = queryValidation.data
-
-  if (!isValidEndpoint(endpoint)) {
-    return NextResponse.json({ error: 'invalid endpoint' }, { status: 400 })
+/** `undefined` when the body is not JSON. Only called on a non-empty body. */
+function parseJsonText(text: string): unknown {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return undefined
   }
+}
 
-  const baseUrl = await getMothershipUrl(environment, userId)
-  if (!baseUrl) {
-    return NextResponse.json(
-      { error: `No URL configured for environment: ${environment}` },
-      { status: 400 }
-    )
-  }
+/** The upstream's own explanation, from either error envelope the admin API uses. */
+function upstreamErrorMessage(data: unknown): string | undefined {
+  if (!isRecordLike(data)) return undefined
+  if (typeof data.error === 'string') return data.error
+  if (typeof data.message === 'string') return data.message
+  return undefined
+}
 
-  const targetUrl = `${baseUrl}/api/admin/${endpoint}`
+type ProxyMethod = 'GET' | 'POST' | 'DELETE'
 
+/**
+ * Forwards to the mothership admin API. A 4xx passes through for the admin UI to show; an
+ * upstream 5xx or unparseable body is a gateway failure, logged with its cause and answered
+ * with 502 so it is not mistaken for a failure of this route.
+ */
+async function forwardToMothership(params: {
+  method: ProxyMethod
+  targetUrl: string
+  adminKey: string
+  environment: string
+  endpoint: string
+  body?: string
+}) {
+  const { method, targetUrl, adminKey, environment, endpoint, body } = params
   try {
-    const body = await req.text()
     const upstream = await fetch(targetUrl, {
-      method: 'POST',
+      method,
       headers: {
-        'Content-Type': 'application/json',
+        ...(method === 'POST' ? { 'Content-Type': 'application/json' } : {}),
         'x-api-key': adminKey,
       },
       ...(body ? { body } : {}),
     })
+    const text = await upstream.text()
+    if (!text && upstream.status < 500) {
+      return new NextResponse(null, { status: upstream.status })
+    }
+    const data = text ? parseJsonText(text) : null
+
+    if (upstream.status >= 500 || data === undefined) {
+      logger.error('Mothership admin API request failed', {
+        method,
+        environment,
+        endpoint,
+        status: upstream.status,
+        body: truncate(text, UPSTREAM_BODY_LOG_LIMIT),
+      })
+      return NextResponse.json(
+        {
+          error:
+            upstreamErrorMessage(data) ??
+            `Mothership (${environment}) returned HTTP ${upstream.status}${data === undefined ? ' with a non-JSON body' : ''}`,
+        },
+        { status: 502 }
+      )
+    }
 
-    const data = await upstream.json()
     return NextResponse.json(data, { status: upstream.status })
   } catch (error) {
+    logger.error('Failed to reach mothership admin API', {
+      method,
+      environment,
+      endpoint,
+      error: getErrorMessage(error, 'Unknown error'),
+    })
     return NextResponse.json(
       {
         error: `Failed to reach mothership (${environment}): ${getErrorMessage(error, 'Unknown error')}`,
       },
       { status: 502 }
     )
   }
-})
+}
 
-export const GET = withRouteHandler(async (req: NextRequest) => {
+/**
+ * Query params:
+ *   env       - "dev" | "staging" | "prod"
+ *   endpoint  - the admin endpoint path, e.g. "requests", "licenses", "traces"
+ *
+ * The request body (for POST) is forwarded as-is. For GET and DELETE, additional query
+ * params (e.g. requestId for GET /traces) are forwarded.
+ */
+async function proxyAdminRequest(req: NextRequest, method: ProxyMethod) {
   const userId = await getAuthorizedAdminUserId()
   if (!userId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
   const adminKey = env.MOTHERSHIP_API_ADMIN_KEY
   if (!adminKey) {
+    logger.error('MOTHERSHIP_API_ADMIN_KEY is not configured', { method })
     return NextResponse.json({ error: 'MOTHERSHIP_API_ADMIN_KEY not configured' }, { status: 500 })
   }
 
@@ -146,85 +182,25 @@ export const GET = withRouteHandler(async (req: NextRequest) => {
   }
 
   const forwardParams = new URLSearchParams()
-  searchParams.forEach((value, key) => {
-    if (key !== 'env' && key !== 'endpoint') {
-      forwardParams.set(key, value)
-    }
-  })
-
-  const qs = forwardParams.toString()
-  const targetUrl = `${baseUrl}/api/admin/${endpoint}${qs ? `?${qs}` : ''}`
-
-  try {
-    const upstream = await fetch(targetUrl, {
-      method: 'GET',
-      headers: { 'x-api-key': adminKey },
+  if (method !== 'POST') {
+    searchParams.forEach((value, key) => {
+      if (key !== 'env' && key !== 'endpoint') {
+        forwardParams.set(key, value)
+      }
     })
-
-    const data = await upstream.json()
-    return NextResponse.json(data, { status: upstream.status })
-  } catch (error) {
-    return NextResponse.json(
-      {
-        error: `Failed to reach mothership (${environment}): ${getErrorMessage(error, 'Unknown error')}`,
-      },
-      { status: 502 }
-    )
-  }
-})
-
-export const DELETE = withRouteHandler(async (req: NextRequest) => {
-  const userId = await getAuthorizedAdminUserId()
-  if (!userId) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  const adminKey = env.MOTHERSHIP_API_ADMIN_KEY
-  if (!adminKey) {
-    return NextResponse.json({ error: 'MOTHERSHIP_API_ADMIN_KEY not configured' }, { status: 500 })
-  }
-
-  const { searchParams } = new URL(req.url)
-  const queryValidation = adminMothershipQuerySchema.safeParse(searchParamsToObject(searchParams))
-  if (!queryValidation.success) return validationErrorResponse(queryValidation.error)
-  const { env: environment, endpoint } = queryValidation.data
-
-  if (!isValidEndpoint(endpoint)) {
-    return NextResponse.json({ error: 'invalid endpoint' }, { status: 400 })
   }
-
-  const baseUrl = await getMothershipUrl(environment, userId)
-  if (!baseUrl) {
-    return NextResponse.json(
-      { error: `No URL configured for environment: ${environment}` },
-      { status: 400 }
-    )
-  }
-
-  const forwardParams = new URLSearchParams()
-  searchParams.forEach((value, key) => {
-    if (key !== 'env' && key !== 'endpoint') {
-      forwardParams.set(key, value)
-    }
-  })
-
   const qs = forwardParams.toString()
-  const targetUrl = `${baseUrl}/api/admin/${endpoint}${qs ? `?${qs}` : ''}`
 
-  try {
-    const upstream = await fetch(targetUrl, {
-      method: 'DELETE',
-      headers: { 'x-api-key': adminKey },
-    })
+  return forwardToMothership({
+    method,
+    targetUrl: `${baseUrl}/api/admin/${endpoint}${qs ? `?${qs}` : ''}`,
+    adminKey,
+    environment,
+    endpoint,
+    ...(method === 'POST' ? { body: await req.text() } : {}),
+  })
+}
 
-    const data = await upstream.json()
-    return NextResponse.json(data, { status: upstream.status })
-  } catch (error) {
-    return NextResponse.json(
-      {
-        error: `Failed to reach mothership (${environment}): ${getErrorMessage(error, 'Unknown error')}`,
-      },
-      { status: 502 }
-    )
-  }
-})
+export const POST = withRouteHandler((req: NextRequest) => proxyAdminRequest(req, 'POST'))
+export const GET = withRouteHandler((req: NextRequest) => proxyAdminRequest(req, 'GET'))
+export const DELETE = withRouteHandler((req: NextRequest) => proxyAdminRequest(req, 'DELETE'))
@@ -45,7 +45,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   try {
     const startedAt = performance.now()
     const masked = await maskPIIBatch(texts, entityTypes, language, customPatterns)
-    logger.info('Masked PII batch', {
+    logger.debug('Masked PII batch', {
       count: texts.length,
       durationMs: Math.round(performance.now() - startedAt),
     })
 
@@ -1,4 +1,5 @@
 import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
 import { telemetryContract } from '@/lib/api/contracts/telemetry'
 import { parseRequest } from '@/lib/api/server'
@@ -122,7 +123,7 @@ async function forwardToCollector(data: Record<string, unknown>): Promise<boolea
       clearTimeout(timeoutId)
 
       if (!response.ok) {
-        logger.error('Telemetry collector returned error', {
+        logger.warn('Telemetry collector returned error', {
           status: response.status,
           statusText: response.statusText,
         })
@@ -133,9 +134,11 @@ async function forwardToCollector(data: Record<string, unknown>): Promise<boolea
     } catch (fetchError) {
       clearTimeout(timeoutId)
       if (fetchError instanceof Error && fetchError.name === 'AbortError') {
-        logger.error('Telemetry request timed out', { endpoint })
+        logger.warn('Telemetry request timed out', { endpoint })
       } else {
-        logger.error('Failed to send telemetry to collector', fetchError)
+        logger.warn('Failed to send telemetry to collector', {
+          error: getErrorMessage(fetchError),
+        })
       }
       return false
     }
 
@@ -722,17 +722,32 @@ export async function resolveWebhookExecutionProviderConfig<
   }
 }
 
-async function resolveCredentialAccountUserId(credentialId: string): Promise<string | undefined> {
+/**
+ * The user who owns the OAuth account behind a credential. `accountless` credentials
+ * (service accounts, managed OAuth such as a custom Slack bot) have no account row by
+ * design; `missing` means the credential or its account no longer exists.
+ */
+async function resolveCredentialAccountUserId(
+  credentialId: string
+): Promise<{ status: 'resolved'; userId: string } | { status: 'accountless' | 'missing' }> {
   const resolved = await resolveOAuthAccountId(credentialId)
   if (!resolved) {
-    return undefined
+    return { status: 'missing' }
+  }
+  if (
+    resolved.credentialType === 'service_account' ||
+    resolved.credentialType === 'managed_oauth'
+  ) {
+    return { status: 'accountless' }
   }
   const [credentialRecord] = await db
     .select({ userId: account.userId })
     .from(account)
     .where(eq(account.id, resolved.accountId))
     .limit(1)
-  return credentialRecord?.userId
+  return credentialRecord
+    ? { status: 'resolved', userId: credentialRecord.userId }
+    : { status: 'missing' }
 }
 
 /**
@@ -873,15 +888,16 @@ async function executeWebhookJobInternal(
             workspaceId
           )
         : loadDeployedWorkflowState(payload.workflowId, workspaceId)
-      const [workflowData, webhookRows, resolvedCredentialUserId] = await Promise.all([
+      const [workflowData, webhookRows, credentialAccount] = await Promise.all([
         workflowStatePromise,
         db.select().from(webhook).where(eq(webhook.id, payload.webhookId)).limit(1),
         payload.credentialId
           ? resolveCredentialAccountUserId(payload.credentialId)
           : Promise.resolve(undefined),
       ])
-      const credentialAccountUserId = resolvedCredentialUserId
-      if (payload.credentialId && !credentialAccountUserId) {
+      const credentialAccountUserId =
+        credentialAccount?.status === 'resolved' ? credentialAccount.userId : undefined
+      if (credentialAccount?.status === 'missing') {
         logger.warn(
           `[${requestId}] Failed to resolve credential account for credential ${payload.credentialId}`
         )
 
@@ -5,7 +5,7 @@ import { registerBlockOverlayResolver } from '@/blocks/custom/overlay'
 import type { BlockConfig, BlockIcon } from '@/blocks/types'
 
 /** A row for the overlay, optionally carrying live-derived Start input fields. */
-type CustomBlockOverlayRow = CustomBlockRow & {
+export type CustomBlockOverlayRow = CustomBlockRow & {
   inputFields?: WorkflowInputField[]
   /** When `false`, the block resolves but is hidden from the palette (disabled). */
   enabled?: boolean
 
@@ -97,7 +97,7 @@ export class DAGBuilder {
     // Validate loop and parallel structure
     this.validateSubflowStructure(dag)
 
-    logger.info('DAG built', {
+    logger.debug('DAG built', {
       totalNodes: dag.nodes.size,
       loopCount: dag.loopConfigs.size,
       parallelCount: dag.parallelConfigs.size,