Sporadic 401 Unauthorized Response - Working Fine 97% Of The Time

[CallMeUp]

Hey there, I'm struggling to chase down the root cause of an issue here that just popped up a couple weeks ago and is causing everybody a headache. 

We have Workato in between an ECM tool and an ERP tool. 97% of the time the calls are returned properly, 200 is logged, and everything looks good.

A little under 3% of the time though we're getting 401 Unauthorized back. This is logged in Workato in the logs under API Management. Every 401 Unauthorized log is reporting 0ms total response time, and the client column is empty. 

I checked in the ERP logs, and I don't see any requests with the timestamps of the 401 Unauthorized returns, only the successful 200 responses are in there. I checked in Entra to see if there was any issue in there, but I only see the account being logged into ever 24 hours by Workato which is showing successful. 

I'm not sure where the issue is - so I figured I'd post here to see if anybody had any ideas on where to look.

[Bhagya_pola]

Hello @CallMeUp ,
Just checking, are you using one client or multiple clients for these endpoints?

[CallMeUp]

There's only the one client. Multiple endpoints for different transactions, but all through the one client. The sporadic 401 responses seem to be distributed across all of them at approximately the same rate proportional to the number of calls being made.

[Bhagya_pola]

Then I guess there might be an issue with the token refresh timing. The 3% you mentioned could be hitting the expired token before the refresh completes.

[CallMeUp]

The strange thing is that it'll be in the middle of other successful calls. 

For example, it may be fine at 12:30, 12:31, and 12:32 then get 401 at 12:33 and be fine again at 12:34. Do you think that could be what you're describing?